Hacker News Reader

Comment by netgusto | Hacker News Reader

Wouldn't an alternative "destroy everything" password be a good idea also ?

Would work like this : When forced to enter / give the password to your vault, you enter/give this one, and everything the vault contains is wiped out before the vault is unlocked.

View on HN

Once again we drum up technical "solutions" to what ultimately is a policy issue.

A better idea is to change our laws so that our constitutional rights are respected. If that's not possible then the next solution is to change our elected officials.

While it is a policy issue at its core, changing law and policy moves at a glacial pace, and it's not even a certainty that it'll get changed at all (the "nothing to hide" defense gets brought up a lot on these matters, and it's a pretty persuasive argument to those that can't recognize the fallacy). Technical solutions have the benefit of being much quicker to enact, albeit in a flawed way that is, if highly successful, a band-aid on a bullet wound.

genious idea though

Nothing wrong with using technical "solutions" to prove the point of needing policy changes.

> change our elected officials

In America, who you vote in has very little effect on public policy, and by very little I mean a near zero/statically insignificant amount (unless you're part of the top 10% of income earners):

http://fightthefuture.org/videos/does-voting-make-a-differen...

Eeyore / South Park style cyncism actively forments apathy. Self-fulfiling prophesy.

Counterpoint: My friends and associates do amazing things. Marriage equality, marijuana legalization, DREAM Act, etc, etc. I (a yeoman) also do what I can.

Maybe think of politics, society, culture like thermodynamics:

Organization requires continuous effort, to mitigate entropy.

Keep in mind Marriage Equality in America came via the supreme court, not legislation (unlike New Zealand, Canada, et. al.)

I'm not saying people shouldn't be active. Groups like The Anti-Corruption Act (https://www.youtube.com/watch?v=lhe286ky-9A) are doing a lot, not to mention the group that pushed Maine's ranked voting amendment.

But the vote itself is not very useful. There are other forms of activism that are more worthwhile; those that seek to slowly and fundamentally change the system. Focusing on the left right paradigm will ultimately lead people to being angry at two parties that are essentially the same.

> Keep in mind Marriage Equality in America came via the supreme court, not legislation […] But the vote itself is not very useful.

Liberal supreme court judges do not materialize out of thin air, do they?

It's a matter of practicality.

> A better idea is to change our laws...

Oooookay, sure. We'll get right on that one. In the mean time, I'll take a technical solution.

Have you called your congressional representatives and made it known to them how important these issues are? I find that many people who despair about our political climate can't even name their representative.

Start there and work your way out.

Blow up Sovereign Immunity ffs. If someone gets detained they have no recourse or compensation to mitigate it being used as a threat.

That's basically the definition of spoliation of evidence, if things were to ever escalate to civil or criminal proceedings.

This qualifies already.

18 U.S. Code § 1519 defines it as "Whoever knowingly...conceals...with the intent to impede...the proper administration of any matter within the jurisdiction of any department or agency of the United States"

So technically, entering travel mode for the purpose of hiding your stuff from border agents could be interpreted as a violation of that statute, regardless of whether there was an active investigation or legal proceeding.

Of course, it would trigger a massive backlash if a federal prosecutor went after people for this. But it's there...

I think there is a line to be drawn somewhere, and I don't know where — but taking this further, if I erase my laptop before going to the US and then restore it from a backup online, isn't this the same thing as „knowingly concealing with the intent to impede”?

And what if I don't take the laptop at all? Am I „concealing” anything? Theoretically — yes.

There has to be a limit to how far one can take the application of that law.

If you aren't aware of a matter concerning your data you can't intend to impede that matter by choosing not to transport your data on your person.

Entering travel mode is literally deleting the data off your computer. It's not concealing anything. I think a federal prosecutor would have a hell of a time arguing that people aren't allowed to erase data from their computer before traveling.

In the law, intent matters. You're deleting the data with the intent to hide it from border agents. A federal prosecutor absolutely could argue that, if they wished.

I'd be entering travel mode with the intent of removing the ability to access the data from the device. I would be surprised if travel mode deleted my data.

You're deleting the data because you don't want to travel with that data. You're not hiding it. You literally just don't want to have access to it while you're traveling. In that sense it's no different than, say, leaving a hard drive with all your data behind (plugged into an internet-enabled computer that you can SSH in to and transfer your files back to yourself after you've crossed the border).

Read rosser's comment above. If push came to shove, your clever wordplay would amount to getting into a rules-lawyering contest with Federal prosecutors, and I promise you that is a contest you would lose.

I don't think it's rules lawyering to say that literally not having the data is different than hiding it. There's nothing illegal about choosing to not bring stuff with you when you travel. And as long as the CBP's authority is limited to searching your devices and not forcing you to log into websites, then simply not carrying the data on your device seems perfectly reasonable.

Furthermore, I don't think there's anything productive at all about making the argument that federal prosecutors will get you no matter what you do. That's just shutting down the discussion entirely.

> Furthermore, I don't think there's anything productive at all about making the argument that federal prosecutors will get you no matter what you do. That's just shutting down the discussion entirely.

Well, it is true that if the government wants to come after you- as in, you specifically- then it is basically true that they will get you no matter what you do. But that's not the point I was making in my previous posts, so let's drop it.

The point I was trying to make was that this 1Password feature will not help you, legally, if CBP realizes you're using it and they want to make a fuss. Maybe if you rolled your own PW manager and decided not to sync the incriminating data, you'd have a case. But this feature is literally advertised as "protect your data from unwarranted searches [clearly implying, searches by the government] when you travel". The technical implementation (your "deleting" vs. "not having" distinction) does not matter: the intent is clear.

> The point I was trying to make was that this 1Password feature will not help you, legally, if CBP realizes you're using it and they want to make a fuss. Maybe if you rolled your own PW manager and decided not to sync the incriminating data, you'd have a case. But this feature is literally advertised as "protect your data from unwarranted searches [clearly implying, searches by the government] when you travel". The technical implementation (your "deleting" vs. "not having" distinction) does not matter: the intent is clear.

We are hinging on the subtle difference between deletion and non action. If I choose not to bring my phone with me to the border, and an agent remarks on the suspiciousness of that fact, if I were to reply, "I didn't bring it because I didn't want to travel with it," did you commit a crime?

Even if you were arrested for that statement, dor a prosecutor to convince a jury that you didn't bring data with you because you didn't want it to be inspected at the border vs you didn't bring it because you didn't want it to get stolen/whatever does not seem likely, but that is just my opinion.

> If I choose not to bring my phone with me to the border, and an agent remarks on the suspiciousness of that fact, if I were to reply, "I didn't bring it because I didn't want to travel with it," did you commit a crime?

Probably not.

> We are hinging on the subtle difference between deletion and non action.

I agree, and my argument is that "activating Travel Mode" is clearly the former, regardless of its technical implementation, because it requires positive action.

I don't see why the distinction matters. Deleting data because you don't want to travel with it should be no different than leaving your phone at home because you don't want to travel with it.

I think I would feel reasonably comfortable telling a border agent that I didn't bring a phone / specific data because I felt uncomfortable about the idea of having it searched at the border. There's certainly nothing wrong with that, and I doubt it would get you denied entry (unless they pulled you out for a non-routine reason anyway). You're certainly not required to bring anything across a border.

This is starting to head down the road into absurdities, though.

If I have a laptop and phone with sensitive work information on them, and simply choose not to take them with me on a trip, would you argue that's a crime? After all, the reason I chose not to take them with me was to "conceal... with the intent to impede" CBP's ability to access all that data.

What if someone just refuses to travel to the US as long as policy allows this type of search? Would they need to be extradited for their act of concealment?

And I could argue that my intent was to protect myself from identity theft, should my device be stolen. It's a reasonable explanation for having deleted the data.

I'd also argue that I could've purchased a completely new device immediately prior to travel and brought that along, with the intention of being able to say that the device had never contained information that I was trying to hide.

I think that part of the point is that they'd have to prove intent. It's easiest to prove if you refuse to unlock the device, harder to prove if you provide a destrutive password, harder still if you remove your passwords and keys before leaving, and essentially impossible if you have a device that never contained sensitive data in any form.

> [proving intent is] essentially impossible if you have a device that never contained sensitive data in any form.

I'd like to see a short story based on this premise: man is arrested and tried for crossing the border with a brand new phone, having left his usual phone at home. The prosecution argues that since he presumably usually keeps sensitive information on his phone, not copying that data to the phone he was carrying proves his intent to hide information from border police.

I think it's a race already, between the story being written and it actually happening to someone.

> he presumably usually keeps sensitive information

Wouldn't they have to argue that he was a person of interest for some time now. That they have records of him traveling two and from countries of interest. That he is on a watch list?

For the average Joe. I don't think this would get very far.

My response would be. "What sensitive information are you looking for?"

I was proposing a short fictional piece based on this premise -- not sure if you meant to respond to that specifically. In any case, it's speculative fiction: we put the story in a not-too-distant dystopian future where the laws and norms have changed just enough to make this plausible. I think it's more fun too if the protagonist actually doesn't have anything to hide, and is not suspected of any criminal activity before, during, or after his attempted border crossing.

Or literally anyone else in the country to which I'm travelling. Perhaps I feel I'm at an increased likelihood to either lose or have my phone stolen? Saving my passwords from a potential thief (who may or may not have tools to break into the device assuming I secured it) is a reasonable precaution.

No, you're deleting it because you don't want to transport it across the border. You're just not bringing it, and border control can't inspect what you don't bring.

There would be no backlash unless the person was well-known, all they would have to do is show an unflattering picture of the victim and accuse them of 'possessing hacking tools' and 'hiding information from law enforcement.' Both would be true, the latter being actually true and the former applying to anyone using a terminal with black background and green text.

The "matter within the jurisdiction" of border control is to inspect anything being brought across the border. You're not impeding that. You're simply not bringing something across the border. This is different from e.g. hiding drugs in your suitcase (or even data on a device): there you're impeding their ability to inspect those drugs.

No. That's only a good idea if the criminal sentence for destruction of evidence is less than the criminal sentence you'd receive for possessing whatever data it is you just destroyed.

Perhaps not wiped out, but your normal password could unlock your normal store, while a "duress" password would unlock a store of dummy information.

You'd want to make sure it erased the data while making it seem like the data set was empty. You'd even need that special password to remove traces of itself and how it erased the encrypted data, as anything left over could be evidence for destroying evidence.

I think using it would be tampering with evidence in the USA. So probably a bad idea.

Not clear you're destroying evidence -- is it evidence if there's no probable cause for the search? If a crime hasn't been committed?

Hard to apply ordinary statutes & case law here because the 4th amendment doesn't seem to apply to border agents.

Is it evidence at the point where, say, a CBP agent asks you to show him your data? I mean, they're not a judge, and it's not a trial, or even an investigation into some crime.

Do you want to go to prison?

Reply on news.ycombinator.com