Hacker News Reader

Comment by sesutton | Hacker News Reader

>If you're running things yourself and control the encryption keys required to access your data, then your service provider can't be compelled to release your data as it's not possible

The court can just hold you in contempt until you do[1]. They also probably won't buy "I forgot".

[1]: https://arstechnica.com/tech-policy/2016/04/child-porn-suspe...

View on HN

If you delete the data, prior to getting the notice to produce the data and it wasn't deleted in anticipation of such a notice, sure the court could hold you in contempt, but legally you've done nothing wrong.

You cannot easily make a third random third-party delete your data.

You might put yourself in a worse position if the court compels you to produce the data, but now you can't. You better be very certain that you are able to prove that you deleted the data prior to any notice, or you might find yourself in for a long jail stay.

This is what a lot of people overlook - when the court compels you to produce evidence, or ill gotten gains, saying ,"I can't" - isn't a legal defense.

> This is what a lot of people overlook - when the court compels you to produce evidence, or ill gotten gains, saying ,"I can't" - isn't a legal defense.

We're getting closer and closer to testing that. IANAL but I'd imagine that some combination of the 4th and 5th amendments should cover that situation. The onus would be upon the prosecutor to prove that you destroyed the evidence after the fact.

As a general rule, one does not have to prove they didn't commit a crime, the prosecutor has to prove that they did. Where this gets murky is if a judge orders you to present the non-existent data as contempt of court may apply.

There's lots of case history where people are faced with a court order compelling them to return ill-gotten gains, and when they claim "I can't do it, I don't have the money." - they are found guilty of contempt of court if the court believes otherwise. Burden of evidence is not on the court to prove you do have the money, just as in this case, the burden wouldn't be on them to prove you can retrieve the data....

It depends. If you delete all data after a year pursuant to a well established practice, the court should not be able to hold you in contempt. But if your explanation smacks of destruction of evidence, then you've got a problem. Remember, it's not about what you did, in fact (the judge and the prosecutor can't know that). It's about what the circumstantial suggests you did.

Just to be clear, my assumption was the jurisdiction was US federal law, the entity deleting the data was an individual, the data was their data, and the systems deleting the data were owned by them; this based on the context as I understood it provided by the comment I replied to of this thread.

As such, would you please explain why you provide a timeframe for keeping the data prior to deleting it?

I think he's saying "If you have a policy of deleting your data older than X, you are OK." You have to be able to prove that well before being asked for the data, you had a policy that resulted in it being deleted.

Where I work, we delete emails older than 6 months as a company policy. I have to assume this is done for exactly this reason. Don't ask why we might want to do that, I'm not in charge. :-)

Right. It's about insulating yourself from the accusation that you deleted that data to cover up wrongdoing, rather than for other reasons.

There are quite a few situations where you have an obligation to not delete data so "legally you've done nothing wrong" is probably overly broad.

Right, though my assumption is the relate statements are in the context of the comment I replied to, that being an individual using only systems owned by them. As such, beyond my prior comment in this thread, I'm not aware of any law related to an individual that would bar them from deleting data at will assuming to legal request to do so was expected or in place.

Opening up to any situation beyond that would be dependent on the context of that situation.

If I am missing something, please explain explicitly what you are referencing.

Under which circumstances is an individual required to retain data that they created?

Under which circumstances is an individual required to retain data at all?

Well it would still be a whole lot better than what happens now. Microsoft, for instance, sued the DoJ recently because almost half of its data requests came with a gag order.

So you wouldn't even know when they got your data, and then perhaps used it against you - in secret (like putting you on a no-fly list, etc). And then they won't even tell you why you're on the no-fly list or why you're getting an audit.

The whole system is broken from top to bottom, and I think that has a lot to do with the fact that politicians who are supposed to represent the people, don't care about what the people want anymore or to actually represent them. They care about what various rich people or powers want them to do. It's not just me saying that:

https://www.youtube.com/watch?v=5tu32CCA_Ig

Leave the thing on a timed kill switch requiring secure input to reset the timer. It acts like a warrant canary, because the default is that without acting to intercede, your data is physically destroyed. That said... unless you have something really critical you must hide, potentially at the expense of whatever an angry/frustrated state might do to you... don't do it.

If you have an incredibly valuable idea, if you're protecting state secrets, if you're a journalist with real integrity, or a criminal who stands to lose more through exposure... then it makes sense. Otherwise, just for kicks, I don't see the point.

Reply on news.ycombinator.com