Canadian Cops Want a Law That Forces People to Hand Over Encryption Passwords | Hacker News Reader

Canadian Cops Want a Law That Forces People to Hand Over Encryption Passwords

motherboard.vice.com

43 pointsdoener24 comments

The body of this piece is much less alarming than the title:

The CACP is merely an advocacy body and resolutions they pass have no effect on the law of the land. Moreover, the organization has a history of asking for powers that go well beyond what the law currently allows.

Here's hoping this advocacy group get shut down again. The Vice article is already citing strong academic pushback to this nonsense.

Though on the other hand, ever since Bill C-51 was put in place, I've had less faith in the Canadian government in these matters.

I have a way of setting and entering passwords without ever knowing what the password is. I've only ever done it on accident, but if this ever became law in the US it would become my standard way of entering passwords. They can't compel me to reveal the password because I literally don't know it.

Care to expand?

If I tell then people will know about it and then they'll write my method into any law they create to force revealing of passwords. It's stupidly simple though.

The cops' response will be: "Bullshit. You have to know the password, and you're going to sit in that cell until you tell us what it is."

Don't try to hack around the law. You'll fail.

How about under stress you have trouble remember the password, and thinking of the wrong password, can corrupt your knowledge of the right password (in my experience and knowledge this can actually happen yes)? How about old encrypted backup zips ? Encrypted media files from your browser by media streaming services ? How about pressure ? How about some people cannot remember a password without being in the right place (yes this exists) ? How about passwords you use for more then service ? What about public encryptions keys stored on your computer, are they encrypted data or random bytes ? How about the stenography data probably encoded in the music you downloaded from your music provider ?

These sort of laws create many problems one can not hope solve without a few punishing/ruining the life/killing of a few innocent bystanders.

> How about under stress you have trouble remember the password

Reply will be: "You'll get plenty of time in jail to relax and think about it".

I know we're talking about Canada in the article, and that there are differences in the laws around this.

There's a guy currently sitting in a US jail, I think in Georgia, held on contempt of court charges. He was originally charged with murder, and during his trial, he managed to goad the judge into an absurd argument, part of which involved the defendant wanting to defend himself. I'll skip the details. There's a Rick and Morty cartoon out there about it...

Anyways, to my point. The judge has the power to keep this guy in jail more or less indefinitely. You can argue with the cops, you can argue with your lawyer, but if it's in the law and you try to argue it with the judge, you're staying in jail.

Canada has strong protections against indefinite incarceration.

5 years isn't indefinite. It's definite. 5 years is a ridiculously long time, but it's what England implemented for RIPA if the encrypted material is thought to be images of child sexual abuse.

I'd have to look it up but if I recall correctly in the UK not disclosing your password carries a penalty of 2 years maximum.

Which if you think about it is stupid since in a situation where you have encrypted data that proves your are a terroist, paedophile or serious criminal, 2 years for not disclosing your password vs 10+ for disclosing it is simple game theory.

Not to mention the stigma of going to prison for not disclosing your password vs the above mentioned crimes.

It's not "hacking" around the law anymore than stopping at a red light instead of blowing right through it is "hacking" around traffic laws. If I literally do not know the password the onus is on the prosecution to prove that I do know it before they can put me in jail. And if you think the police get to hold you in contempt of court or convict you of not following the password reveal law you clearly have no idea how the justice system works.

this is why services with sensitive information need an optional duress password.

I do the same – write down a long password where upper and lower case letters a mixed liberally. Type it a many many times but don't memorize it. Now you have the password as muscle memory but have no way to tell anyone what it is. Make sure to save the password in a password manager!

Let's say a law like this did get passed. How could it even be worded?

For example, if it merely says "you have to give the cops your password when a judge tells you to" then using a password manager should technically protect you, because you don't know the password and have no way of retrieving it.

They could add "or the password for your password manager" but then the judge would have to say "give up all of your passwords", not just the one(s) relevant to the investigation.

Either way, the law would also have to say "and don't change your password(s) until the investigation is over" or "and give the cops a copy of your password whenever it changes".

Even then, you'd only be getting the people with 1) nothing to really hide or 2) so stupid they would have gotten caught some other way anyway because all a criminal would have to do is set their data to permanently lock, or self destruct, when the cops enter the fake password the criminal turned over.

The only way this could work is if the cops could just straight up compel you to assist in your own investigation. They can already do that by tricking you, so I don't think this would add much.

It's much simpler than that. A judge orders you to give police access to your account. Regardless of whatever labyrinthian setup you use to unlock the actual credentials, and barring a stay of the order pending appeal, if you do not give police access you will be held in contempt of court and you may be sent to prison until such time as you comply with the court order. Claims of "but technically I don't actually know the password" are going to impress a judge as much as an argument of "but technically it was the bullet that murdered him" would.

What if you "forogt" how to gain access to your account?

Are you drunk?

Also, what if you forgot how to gain access to your account?

But what if you set your system up with plausibly deniable encryption? Say you encrypt two data sets, one with perfectly legal data, the other with the secret incriminating stuff. How will law enforcement be able to tell you gave them the key to the innocent data only? Block cipher output is indistinguishable from pseudorandom numbers. Deniable encryption is not a new thing in any way.

Edit: How would this be different from police saying "we know you've gone out and buried something, a neighbor saw you leave with something heavy and a shovel", and then you give them a location where you've buried something innocent (a long way away from your secret criminal stuff)?

You could setup a complicated series of plausibly deniable encryption, steganography, and so on and I suppose that might work. But you need to maintain perfect opsec as well as hope they don't already have sufficient evidence that you possess the information they're after. They might have already installed a keylogger plus covert video surveillance and your denials are now contempt of court plus obstruction of justice.

In your burial scenario, they might already possess video surveillance of you dragging a body into the woods, then leaving 30 minutes later but they'd like you to provide an exact location to avoid an extensive search. Telling them you went to the beach with your metal detector won't bode well.

Have another iPhone waiting on the other side of the border and carry a flip phone. Not that hard.

It's not the data they want, now. It's the control.

How decidedly un-Canadian of them

this sounds shitty

Reply on news.ycombinator.com