Hacker News Reader

Comment by flipp3r | Hacker News Reader

Truecrypt and variations have something like this, I believe they call it Hidden volumes

If they find out or even suspect it, hello felony obstruction of justice and making false statements charges.

Can you be charged with obstruction of justice if you haven't been charged or served a warrant? i.e. just being suspect doesn't put you in line of perjury charges in this case.

I'm not a lawyer, but that was my interpretation in case that's wrong.

Yes, you absolutely can be charged with obstruction without a warrant. If you are being interviewed by an LEO and you lie to them to disrupt their investigation, that's potentially a crime. It doesn't matter if you haven't been subpoenaed or aren't under oath.

OK, how about this. I offer FDE as a service, anonymously via Tor. Your Linux machine uses LUKS, with remote unlocking via dropbear. But you don't have the decryption passphrase. Before booting, you must alert me via Signal with video, stating that you are not under coercion, with identity and time verification. Then I SSH via Tor, and unlock your machine.

The argument is that authorities can't force you to lie to me, in order to get your machine unlocked. And you don't need to lie to them, either.

But of course, you'd need to trust me implicitly ;)

It's a cute scenario.

I'm not a lawyer, but I'm fairly sure they can compel me to lie to you. I think the standard is that the police can, at least with a warrant, compel you to do anything that you would do normally. For instance, if you're a company that keeps a database of user actions, they can compel you to give them access to that database, because accessing that data is a part of your normal business process. They can even compel you to write some software to extract the specific data they need (within reason). And in your scenario, I am able to access my own computer, and do so regularly as part of my normal life.

You probably came up with this scenario thinking about so-called "warrant canaries," which hinge on law enforcement not being able to force companies to lie to their users. But it should be noted there is no case law or precedent regarding warrant canaries, and the legal consensus seems to be it is unlikely to hold up in court.

Yes, I was thinking of warrant canaries. I'm also unaware of case law or precedent. But I do note that Riseup did not update its warrant canary while under subpoena. This generated considerable controversy. But Riseup made no statement either way, except for this enigmatic tweet:

    listen to the hummingbird, whose wings you cannot see,
    listen to the hummingbird, don't listen to me.
    #LeonardCohenpic.twitter.com/PZisFt6mHm
    — riseup.net (@riseupnet) November 11, 2016

So it seemed to work, and I haven't seen any fallout.

How about this. When you use my FDE as a service, part of my payment is selling your computer to me for a nominal fee. So you're never using your computer, you're using mine. And my lease agreement requires confirmation that you're not under compulsion.

Fantasizing a bit, one can imagine a multi-probe EEG net that could report your state of mind. Perhaps the remote processor could be trained to recognize coercion, nervousness, etc.

> my lease agreement requires confirmation that you're not under compulsion.

You can't have a "no cops" requirement in a lease agreement, that wouldn't be remotely enforceable.

> Fantasizing a bit, one can imagine a multi-probe EEG net that could report your state of mind

Ordinarily, at this point, the warrant would then be given to you, not me. This is complicated by the fact that you presumably are trying to stay anonymous and there are questions of jurisdiction. But they will at least try to contact you and compel you to give them access. If you refuse now you're committing a crime, and they'll go after you. So you'd better hope your OPSEC is solid. And, after a certain point of ridiculousness, they might go after me, saying I purposefully used this system to elude lawful requests for access (which would be true!). That's going to be tricky to prove, and at that point I don't have enough legal knowledge to figure out if that holds up.

I'm sure in this kind of human rights stuff the problem is absolutely not technical. It's just a detail. What counts is to be able to put yourself in a position where you can be defended by a lawyer or whatever support (like an Ecuadorian embassy ? :-) ). Trying to technologically sidestep the law enforcement is just ridiculous. It proves that you recognize you're doing wrong stuff (wrong in the eyes of those running after you), it sends a very bad signal.

And anyway, as said elsewhere, at some point you are opposing a government. And if you're opposing in a strong way, then well, you basically declared war and you'll have to fight the Goliath. Thus before attempting any fight, make sure you have a very good network of supporters...

Technology won't help :-(

In my experience, changing unjust laws is at least as hard. Consider the fights against slavery, for women's rights, to end segregation, for gay rights, for gender freedom, and generally for decriminalization of all victimless crimes. Privacy has arguably played key roles for all of them. For peer discussion, for organizing and logistics, for fund-raising, etc. And technology has always played a key role in protecting privacy.

yep. I was talking about using technology to protect against an ongoing threat. Technology can help to make myself invisible but as soon as the opposing force gets me, it's very tough to use technology to keep invisibility...

So I'll use Tor and Tox to hide myself as long as possible. But when the bad guys rings my bell, I know the only way out is to burn everything. They won't be deterred by some 2048 bits password...

Yes, my thoughts exactly :)

Based on an OPSEC risk assessment, it may seem rather unlikely that the NSA and other national intelligence agencies are adversaries. Why would they care about Mirimir?

However, I find it useful to assume that they are. And so I employ many countermeasures that might seem foolish. Basically, I do whatever is workable. And then I write about it for income and pleasure. I do keep in mind, however, the "possibility that [a] countermeasure could create an OPSEC indicator" (DoD OPSEC manual at p. 14).[0]

But burning everything, that's also obstruction, I think.

0) https://www.OPSECprofessionals.org/official/081103_DOD_OPSEC... OPSEC manual

You could add shamir secret sharing and restrict your remote access to running a program that accepts your secret.

Sure. I don't know how to integrate that with LUKS, however.

But even so, once I had remote SSH access to initramfs, and had unlocked LUKS, I could mount /root and mess with the system, adding my own trusted key for remote access, etc.

So basically, users would need to trust me fully.

Your special login shell would not allow you to do anything except provide your secret, after which you are simply disconnected without having the opportunity to do anything else. A different process not under your control would mount the volume. At no point would you get to execute arbitrary commands or open any files. You would only have to be trusted not to hold your secret for ransom.

Then exactly what happened here occurs - he gets arrested for not unlocking his laptop, I'd imagine.

Except, as I say above, it's not his laptop. It's mine, and I'm just letting him use it. If they want access to it, they can come after me :)

Right, but in this case, when there isn't a crime. When they're looking for evidence to charge you with or use as a reason to deport or something in that area. In that case, can that be construed as Obstruction of Justice?

> Right, but in this case, when there isn't a crime

There wasn't a crime, until you deceived officers. It doesn't matter if you deceived them to cover up a crime, or to protect your privacy, or just for fun, it's still illegal.

How is that illegal? They asked for a password to their device. He gave a password which then cleaned the device. For all the authorities know, it was a clean device i.e., brand new. Maybe they enjoy regularly installing new OSs using a clean install.

This being illegal is equally as bad them searching devices in the first place without just cause.

They'd have to prove beyond a reasonable doubt you were tampering with potential evidence to convict you. So they'd have to try and prove in court you gave them a password which cleaned the device.

> For all the authorities know, it was a clean device i.e., brand new

Just because you can get away with something doesn't mean it isn't a crime.

Lying to or misleading investigators is a crime, I don't know how to be more clear than that.

If the password you give them also cleans your device you have given them the password to access your device. How is that lying or misleading?

I would argue their invasion of privacy is a crime but no one is watching the watchers, thus these types of measures are going to be used.

They ask to access your files, and you delete your files. I guess that isn't lying per se, but it definitely is destruction of evidence, which falls under the general heading of obstruction of justice. And before you ask, yes, it is still considered evidence even if there's nothing incriminating there. It is considered evidence because an LEO asked for it as part of an investigation.

Yes and that's why you should never lie to investigators. They can lie to you and it's legal, if you lie to them it's a crime.

You're always better off to pass all communications through a lawyer. They're not allowed to lie to a lawyer.

Really? For a search? You are allowed to hide things in your house. This is certainly not legislated.

It's illegal to lie to investigators. (They're allowed to lie to you, but not vice-versa.)

This fact actually makes it a potential offense to say anything to them. After all it's not their fault if they misunderstand you...

Reply on news.ycombinator.com