Hacker News Reader

Comment by ______- | Hacker News Reader

I wish there was some sort of island or safe haven country setup by cryptographers so they could safely work on crypto without legal issues or crypto being seen as a munition and a threat to government. We could call it `01` and have it in a non fourteen-eyes jurisdiction preferably as an independent nation.

We could export code containing cryptographic algorithms to countries that need it for privacy and safety reasons. Cryptography actually is needed for safety more than it is used by undesirable people to commit crimes!

View on HN

Creating an island nation to evade laws won't work. It's the same thing as trying to evade tax laws but for content laws.

What has happened to tax havens is they are labeled tax non-compliant and then an IGO effectively embargoes them unless they turn over all tax records and come into compliance with their laws. So the same thing would apply to creating an island nation to evade some cryptography export law, or content restriction.

I don't think convincing the respective governments with arguments will work either because the incentive they have to require censorship on internet content that they are not mentioning is that they can censor it for their own purposes. For example, Russia is considering blocking Twitter entirely for having illegal content (you know what I mean by this) but I think everyone knows that's not the real reason they are considering blocking Twitter.

I don't know what the best solution is.

Well, corporations do evade taxes using island nations and other such machinery, and mostly get away with it.

It probably won't work for "just people", without strong lobby powers and corrupting financial temptations dangled before politicians.

IMHO there's no running away from resisting/circumventing oppressive legislation in our social surroundings, not by looking for far-away havens.

> I wish there was some sort of island or safe haven country setup by cryptographers so they could safely work on crypto without legal issues or crypto being seen as a munition and a threat to government.

This has always been a fascinating concept to me as well — but I think history demonstrates that you can't just set up a safe haven without significant international leverage, whether financial or military. And if you're actively exporting "munitions" to other countries, it's only a matter of time until someone tries to knock you off.

The more likely scenario is that your safe haven will be dependent on a larger nation-state patron—and therefore ultimately vulnerable to changes in its domestic politics. (E.g. Israel, or Taiwan.)

It's difficult to build leverage in a country the size of an island—and once you're big enough to have any leverage, autarky becomes nearly impossible as you're always dependent on someone else for logistical reasons (food, fuel, etc.). This is essentially what the Second World War was fought about; autarky lost.

In the UK if you won't give up your password (or essentially give means to decrypt data) when requested you can get 5 years for that. Encryption will not protect against the state in this case. Likely other countries will start to copy that...

https://en.wikipedia.org/wiki/Deniable_encryption

I know it's the law already, but has it actually ever been used against anyone? I always thought it would be extremely difficult to successfully prosecute because if you give them "a" password and swore it's "the" password to the best of your knowledge you couldn't be accused of maliciously refusing to cooperate. I imagine they would still throw a book at you somewhere, but probably not the 5 years under this law.

Yes! Plenty of times e.g.

https://www.techdirt.com/articles/20140116/09195525902/uk-ma...

You can Google more easily...

Yes, thank you for reminding me I can Google.

From your own link - he said he forgot the password, which(I assume) in itself wasn't enough to prosecute, it was the fact that he eventually caved in and provided it 4 months later, so they got him on purposefully obstructing justice for 4 months. It's not clear if he could be successfully prosecuted for this crime if he never remembered the password.

Here you have someone directly sentenced for not disclosing their password:

https://www.bbc.com/news/uk-england-hampshire-45365464

I mean, we can be doing this back and forth for a while, but again, to quote from the article:

"Judge Christopher Parker did not accept Nicholson's "wholly inadequate" excuse that providing his password would expose information relating to cannabis."

So basically he said "I know the password, but I'm not going to tell you". That's obstructing justice.

My point is if you say you don't remember and maintain saying you don't, can you be persecuted purely on this one law. Because so far it looks like you can't.

This is the reason America's 5th amendment exists, people have the ability to not self-incriminate because it gives way for a different form of obstruction of justice, compelling people to speak under duress mainly.

I've long wished most of the American constitution made it's way over to Britain. We've had many of the freedoms enshrined in it for centuries but a few, particularly the principle of freedom of speech, has been trampled over in the internet age.

While the fifth amendment in the US is certainly a good principle, even it doesn't (currently) appear to provide a blanket protection against providing your passwords. My (likely incomplete) understanding of the current situation is that things are still ambiguous with many nuances not yet having been settled by the courts.

On the one hand, there is federal precedent (https://law.justia.com/cases/federal/appellate-courts/ca3/17...) that the government must be able to demonstrate both that the defendant knows the password and that criminal evidence is known to exist on the device. The bar for both of these things appears to be fairly high.

On the other hand, there is precedent at the state level in Pennsylvania (https://law.justia.com/cases/pennsylvania/supreme-court/2019...) that disclosure of passwords is testimonial in nature and therefore always (I think?) protected, even if you admit both to knowing the password and to the existence of criminal evidence.

Note the different jurisdictions for the precedents here. In federal courts that fall under the third circuit (which includes Pennsylvania), the first one applies. In state courts within Pennsylvania, the second one applies. This oddity won't change until and unless the US Supreme Court chooses to hear a relevant case. So in Pennsylvania, the law is currently different depending on if the FBI or the local police is the one prosecuting you.

Also note that from the first case, failure to provide the password is a form of civil contempt and therefore confinement is limited to 18 months at most.

Ok I see you point - I have read an solicitor opinion that this may be a valid defense, however, you could likely be expected to prove that you have a medical condition or history of forgetting things. I am pretty sure you cannot just say "oh I forgot, my bad, sorry."

https://www.legislation.gov.uk/ukpga/2000/23/part/III

The police think Bob has material that they need to see.

They think that:

    The key, password, code is in the possession of the person given notice.
    Disclosure is necessary in preventing or detecting crime.
    Disclosure is proportionate.
    The protected material cannot be obtained by other reasonable means.

They serve a section 49 notice.

Bob can ignore this. But that means he may be guilty of an offence under S53.

One of the defences available is to say that he's not in possession of the key. He'd have to persuade the court that either He'd forgotten the key or your encryption was set up in a way that he'd never had the key in a memorable form.

> For the purposes of this section a person shall be taken to have shown that he was not in possession of a key to protected information at a particular time if—

> (a)sufficient evidence of that fact is adduced to raise an issue with respect to it; and

> (b)the contrary is not proved beyond a reasonable doubt.

So, to answer your question: yes, a person could be prosecuted, and they'd have to prove they forgot the key. The prosecutors wouldn't have to prove that the key had not been forgotten.

Absolutely, but that loops back all the way back to my original question - has anyone ever been successfully been prosecuted for actually forgetting their password. Or at least saying "look, my passwords are auto generated and 32 characters long, I think the 5th and 8th characters were a # but I'm not sure". What then? You're not refusing to provide the password, you are just not exactly sure what it was, and if you look into my password manager you can see all my passwords are at least 32 characters long so I'm not making it up.

I don't think anyone has been prosecuted. I'm not arguing with your point - this stuff is messy. It's not clear cut. There's a combination of how the law is written, how courts have interpreted that in the past, whether that would stand up to the supreme court or the EU courts, and what you can persuade the jury and judges to believe.

If you're providing part of your password you run the risk that

i) you'll be convicted of the S53 RIPA offence (potentially 2 years for most stuff, potentially 5 years for child sexual exploitation or terrorism)

and

ii) they'll decrypt it somehow and you'll also be convicted of the original offences.

Criminals are well aware of the trade-offs of the English courts. Do you plead guilty at the earliest opportunity (and get a reduction in sentence as a result) or do you wait until the day of the trial (because many trials collapse before they get to court).

> Cryptography actually is needed for safety more than it is used by undesirable people to commit crimes!

This is actually more because criminals on balance tend to be too dumb to hide their traces than because of any demographic truth. There are a lot of criminals.

Focusing on "crypto" is, I think, a forest for the trees argument. Look instead at anonymity for evidence of where this kind of thing goes. Put up any reasonably anonymous forum where people can interact without their identities being reveals (which often includes, but doesn't always require, some kind of crypto protocol). Within a year it will be filled with criminals. Minor criminals like drug dealers. Worse things like market manipulation and fraudsters. Weapons sales. Black market rings. Revolutionaries of all sorts and sizes. Child porn. Mail order brides and other trafficking trades.

Seriously, run a Tor exit node for a while and see where this goes.

Your neighbors in your imagined "safe haven country for cryptographers" aren't going to be who you think they are.

I recently made a federated, anonymous / pseudonymous messageboard. It took about 2 months before I had found cyber criminals had translated it into another language and were using it to sell narcotics on the darkweb.

I wish there was some sort of island of safe haven country setup by compiler developers where C didn't have problems with memory safety.

Why is politics the only domain where HN'ers think they can make the domain's problems disappear entirely by moving it physically to an island? It's inane.

You're HN'er yourself.

To the downvoters let me explain what I meant. jancsika is an HN'er as we all are. But jancsika is on here trying to say the community as a whole is a bunch of arrogant idiots. This annoying type of comment where you make yourself seem smart by putting down the entire community has become common in this community. I see it more and more often on here.

They created it and called it rust. Time fixes all bugs.

There's Liberland, an attempt at a libertarian country, but it's still far from being an actual country.

That sounds a lot like a place for liberals rather than libertarians.

It’s very interesting to read about, thanks.

https://liberland.org/en/about

Liberal as in "classic liberal"

Ironically the UK is pretty much a handful of islands. I don't think the islandness means much.

We can't have communist countries in latan america because of the good ole u s of a. You think you are going to get some slight utopia that helps people b/c of their ideals? Never going to happen... sadly.

You can’t have communist countries in “Latan” America because their industrial base and population expertise is even worse than the USSR. Not to defend the CIA’s actions, but Venezuela was never going to work out.

I don't think he was talking about Venezuela.

It’s a synecdoche.

Reply on news.ycombinator.com