Hacker News Reader

Comment by DarthGhandi | Hacker News Reader

This exists in Australia as law, you are considered just as guilty as not providing it. Max penalty is 10 years jail from memory. No other crime needs to be committed.

We are the electoral proving grounds for US/UK/CA laws.

It's totally coming for you if you think this is some silly Australian thing.

I deleted a bunch a of old veracrypt drives that I've lost the passwords for and clung onto hoping I'd work it out one day after the laws came in, they've done incredibly well to make encryption seem criminal, it's terrifying and China-esque.

View on HN

So if I wanted a relative in jail, just ensure they use a password manager then do something from their wifi, or plant a keypass database on their computer.

Going to have to raise the bar a bit. This is Australia, we all do things on wifi.

From their wifi. eg go to your enemy's house, connect to their WiFi, frame them with an encrypted file that they don't have the password to.

If only reasonable doubt still got bad cases tossed.

The problem for that is in the US, such laws would be unconstitutional under the 4th, 5th and 1st amendments

Just like Australia's Gun Ban is unconstitutional under the 2nd Amendment

First, the 5th amendment protection against revealing a password seems completely wrong to me, i.e. I'd expect it to get overturned at some point. The point of the 5th amendment was to prevent forced confessions, not to somehow block access to evidence (which the justice system is otherwise entitled to).

Second, the protection doesn't apply if you're given immunity (because, again, it's not about blocking access to evidence). So if the court provides immunity and then orders you to reveal the password and you claim you can't because you don't know... the 5th amendment will not help you.

>First, the 5th amendment protection against revealing a password seems completely wrong to me, i.e. I'd expect it to get overturned at some point. The point of the 5th amendment was to prevent forced confessions, not to somehow block access to evidence (which the justice system is otherwise entitled to).

This slope is arbitrary and slippery. There's a reason to stand on the extreme principle here. There are very few violations into a person's right to remain silent that cannot be weaponized.

I'd rather not empower the next arbitrary group of political appointees to wield that kind of power just because you think "the justice system is entitled to" evidence.

That sort of short term thinking without long term consequences does massive damage. Think harder.

Otherwise entitled in this context means that there's a warrant, court order, reasonable suspicion, etc. that establishes the existence of evidence and that the defendant is completely able even if not willing to produce it.

Of course, where the line is blurry, is as you rightfully note, beyond a point no justice system can be certain that the defendant really still has access to whatever evidence, be it some part of their mind's contents (so a memory, the location of a body, a password, a face), and even if somehow we know they had access but now they don't it'll be impossible to determine intent. (So destruction of evidence cannot really stand when it comes to forgetting things. Unless, maybe if the defendant caused brain damage to themselves intentionally.)

> ... establishes the existence of evidence ...

This phrase doesn't sit well with me. They cannot establish the existence of evidence without having found it. They can't find it without a proper search. They can't execute a proper search with a warrant or reasonable suspicion.

The existence of evidence is established once it's found and documented.

Edited to add: if they can arbitrarily establish the existence of evidence, and then don't find it, then "obviously" the suspect is a no good dirty rotten evidence destroyer.

That's why I said it's always a matter of certainty. It's up to the judge, the (grand jury), the tribunal, etc.

It's not arbitrary. It depends on other pieces of legal proof, like statements from witnesses, other material evidence, etc. For example in case of hidden partitions people usually get busted because forensics find data directly referring to it (eg. in caches, metadata, logs, thumbnails).

>It's up to the judge, the (grand jury), the tribunal, etc.

The judge has the power to let them search your property.

Nobody has the power to let them search your mind, and they can only do so by imprisoning you or otherwise depriving you of your rights.

The distinction between a search warrant and self incrimination is a big one. You should always have the right to say nothing.

If forensics and data know for sure you did something, the stuff in your mind is unnecessary. Either they have the weapon or not, so to speak. You shouldnt be placed in a position where the justice department "is entitled to" the knowledge in your head.

>there's a warrant, court order, reasonable suspicion, etc. that establishes the existence of evidence

Warrants dont establish existence of evidence. they just authorize the state to override your rights, because they convinced a judge. All of this is weaponizable.

The way to establish evidence is to have evidence. If you dont have evidence you haven't established it. Forcing you to divulge something in your head is to force you to give up evidence against yourself, and the ultimate trespass.

I can't think of a situation I'd authorize someone else to do that.

No, warrants authorize searches/seizures.

I'm not agreeing with the practice, I just explained it, how pieces of evidence (and testimony) can legally establish that there's evidence that the defendant has ways to produce.

what you're suggesting is even worse - a court order to force someone to divulge some information under threat of jail. Unauthorized searches are an violation of rights but what you're suggesting is another level and on the same authority.

I dont want to live in your society. I don't want to empower anyone to do that to me, even if they claim they're only going to do it to criminals and bad guys.

The terms of service change.

I'm not "suggesting". It's the current reality. Numerous articles over the past years demonstrated it. (This was already linked here https://en.wikipedia.org/wiki/H._Beatty_Chadwick )

>the point of the 5th amendment was to prevent forced confessions

No the purpose of the 5th amendment was to prevent people from being forced to be a witness against themselves, that is why the 5th amendment says

"nor shall be compelled in any criminal case to be a witness against himself"

Forcing to revel what is in your mind (aka a password) is a clear and obvious violation of the 5th amendment, and I do not expect it to be over turned

>Second, the protection doesn't apply if you're given immunity

If they give you immunity then is no longer a case for which they can compel you to give up anything in the first place. Unless they are going after someone else in which case the 5th amendment did not apply in the first place.

I fail to see while this relevant to the discussion.

> to prevent people from being forced to be a witness against themselves

Also known as a "forced confession"?

> If they give you immunity then is no longer a case for which they can compel you to give up anything in the first place. Unless they are going after someone else in which case the 5th amendment did not apply in the first place.

Two people committing a crime together.

Honestly and fully testifying against one's partner in a jointly commissioned crime would constitute a confession. Immunity allows that testimony.

> Also known as a "forced confession"?

Not really -- you could be compelled to testify against yourself and not confess to a specific crime, the very fact there is even a trial presupposes one plead "not guilty".

> First, the 5th amendment protection against revealing a password seems completely wrong to me, i.e. I'd expect it to get overturned at some point. The point of the 5th amendment was to prevent forced confessions, not to somehow block access to evidence (which the justice system is otherwise entitled to).

There's already established case law that the 5th protects case combinations; this is the reason why American safes use combinations while those everywhere else in the world use physical keys. Encryption keys are very similar on the face.

What happens if important evidence is inside a safe, and the combination was written on a piece of paper that is now lost or destroyed? I imagine eventually the safe would be destroyed in order to access the evidence, but is the owner of the safe liable for withholding the evidence even if they don't know the combination?

the Police can employ people to "crack" or other wise physically open the safe if they have a warrant.

The owner is not liable for withholding evidence, even if they know the combination as they are under zero legal requirement to tell the police the combination

This is on to something as encryption is basically a practically unbreakable safe (which can only store information).

I find it completely natural that cannot put people in jail just for possessing something which may possibly be an unbreakable safe just because unbreakable safes happen to exist.

Forced confessions... like providing the key to an OTP that makes it seem like your whole drive was filled with CP.

Even then, most encrypted data is indistinguishable from random data. Doing dd bs=1024 count=12345678 < /dev/urandom > childporn.aes on your own machine should not be an one-way ticket to jail. (and not to mention the cases where you have forgotten the password)

This is why the whole debate is whether being forced to reveal a piece of information in your mind (aka the pass phrase) is testimonial in nature. Yes, the court may well be able to demand the evidence, but they cannot require you to testify against yourself.

> The point of the 5th amendment was to prevent forced confessions, not to somehow block access to evidence (which the justice system is otherwise entitled to).

It's not just about forced confessions. It's about not putting people -- including innocent people -- into a situation where they have a powerful incentive to lie because silence is prohibited. Even innocent people may have secrets they don't want in the public record, and allowing them to say nothing is better for all parties than dishonesty. Revealing a password is no different. It saves everybody a lot of trouble and crime and immorality to be able to say nothing than to make up some nonsense about how the device belongs to some fictional person that law enforcement would then have to waste resources trying to track down, or worse yet some real innocent person who the person being compelled to testify would then have the incentive to divert blame to.

Moreover, the 5th amendment regularly does block access to evidence which the justice system is otherwise entitled to. If you're accused of committing a murder then the body of the murder victim is evidence which the justice system is otherwise entitled to. They can get a warrant to search your property and seize it if they find it. But the 5th amendment still doesn't allow them to compel you to tell them where it is.

> Second, the protection doesn't apply if you're given immunity (because, again, it's not about blocking access to evidence). So if the court provides immunity and then orders you to reveal the password and you claim you can't because you don't know... the 5th amendment will not help you.

Immunity has very little to do with not knowing. It makes no logical sense that providing immunity could allow you to tell them something you don't actually know. Consequently it makes no sense that providing immunity should allow them to punish you for not knowing. It could allow them to require you to tell them that you don't know, but what then? How do you expect them to prove that you didn't actually forget?

There are situations the fifth amendment protects against other than forced confessions.

Here's a hypothetical example: you are accused of murdering your ex-lover. You witnessed the crime and know that the real killer is the chief of police. While disclosing those details could potentially implicate him, they will certainly prove that you know details of the crime, which implicates you. You don't think anyone will believe you, and the other evidence against you is weak (you didn't do it, after all), so you don't want to say anything until you're acquitted.

We have that in the UK already. Technically on the statute book before Australia's although not activated til 2007. https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...

In the U.K. you can be convicted for not being able to decrypt data in your possession which the prosecutors think is encrypted. Ie if I filled a hard drive with random bits and sent it to you, you could be found guilty of not knowing the decryption keys for that disk.

Everyone start sending your representatives encrypted thumbdrives and sd cards. Contents? A document asking for reform of this law.

> if I filled a hard drive with random bits and sent it to you, you could be found guilty of not knowing the decryption keys for that disk.

Technically true but misleading. It's true in the same sense as "if I plant evidence to frame you for murder, you could be found guilty of murder". I mean, sure, but that skips over the bit where the prosecution has to prove to a jury, beyond reasonable doubt, that you did actually commit the murder. Or in this case, that the hard drive is filled with encrypted data and that you have the key to it.

In particular, the implication that if the police find some random data that they think is encrypted, you can be convicted just on the assumption that it's encrypted and that you have the key to it (unless you can prove otherwise) is false. If there's enough evidence to raise a question about whether you have the key to something that could be encrypted data, the burden of proof is on the prosecution to prove you do have the key to it (and therefore that it is encrypted data) beyond reasonable doubt: s.53(3) http://www.legislation.gov.uk/ukpga/2000/23/section/53

(to be clear I definitely do agree it's a bad law, just not for burden-of-proof-reversal reasons)

The problem with this is that proving that someone didn't forget something beyond a reasonable doubt is basically impossible. People forget stuff all the time. Especially once you throw in the stress and change in environment of a legal proceeding.

The result is that either the law has no practical effect because anybody can claim they forgot, or the courts fudge the requirement to prove that beyond a reasonable doubt in order to give the law effect, and then you put innocent people behind bars because they really did forget.

Then I would XOR it with any plaintext of the same length and use the resulting "key" to satisfy my obligation under the law to enable "decrpytion" by the one-time pad algorithm.

That would imply you're smarter and have more power than the law which is not the case.

They'd ask you to provide actual readable files, pictures, etc, or else would reject your "decryption".

It is true but not really relevant that they're smarter and more powerful than me. Since they don't trust me, they won't let me decrypt the disk D but will demand the key K to do it themselves. Recall K = D XOR P for some readable plaintext pictures or files, etc., I've already chosen. The "decryption" yields the perfectly readable output P = D XOR K.

Well, I read the original comment as being a: "here, K is the password, D XOR K is your results" idea -- based on that any D XOR K is technically a decryption, whether random stuff comes from the process.

If you intend K to provide "perfectly readable output", then

(1) if you actually produced the contents of D yourself to hide data, then you need to come up with some scheme so that K provides "perfectly readable output" and some alternative V provides D XOR V (or another decryption scheme) that gives you your actual secrets. I don't think it's that easy to have "perfectly readable data" on D XOR K plus have your secrets with another key. Except if you mean through steganography, but then K is not needed at all.

(2) if you were just send a random noise drive to "frame you" then you need access to the drive to come up with a K so that D XOR K decrypts to valid data.

This is a one-time pad. Given a ciphertext D it's trivial to come up with a key K that "decrypts" D to whatever plaintext P you want (K = D XOR P). This is why one-time pads are immune to brute-force search.

"We are the electoral proving grounds for US/UK/CA laws."

... and I would say you're falling down on the job ...

The US is still a mostly constitutional republic where mob rule can’t just do as it pleases. There’s been a recent uptick in efforts to delegitimize the courts, but historically that goes nowhere.

IE the first amendment is still solid protection against this kind of insanity.

VeraCrypt has a hidden volume mode where an inner encrypted volume is stored within the contents of an outer hidden volume, and the inner volume is indistinguishable from random data when the outer volume is decrypted for plausible deniability.

IIRC the configuration that allows hidden volumes is distinguishable from the basic configuration, so they could tell if there's the potential for a hidden drive to exist. If so, they could assume the hidden container exists and throw you in jail if you don't produce a password that unlocks one.

If the format schemes are indistinguishable that's good news.

If it is distinguishable, then it has no point.

If it is indistinguishable then you run the risk of losing data in the nested container if you copy enough data (accidentally) on the outer container.

Not sure which is the case with veracrypt though.

It's indistinguishable but there's a way to put in both passwords while using the outer container so it prevents overwriting the inner one.

IIRC free space on the outer volume has to be continuous―normally at the end of the fs. I.e. the volume will look like it's not used too extensively. Which I guess may or may not look suspicious depending on your claimed use-case.

The recommended practice is multiple hidden volumes. "Oh no, you made me decrypt this volume that contains inappropriate photos!"

Reply on news.ycombinator.com