A Man on Death Row Has Waited Years for GitHub to Provide Key Evidence
gizmodo.com
gizmodo.com
That’s clearly unconstitutional, yet it has been happening for years.
> Both GitHub and California courts are sticking by tech companies’ traditional hardline interpretation of an arcane 1986 privacy law the Stored Communications Act (SCA). While the SCA makes a provision for government entities, like the police, to demand electronic communications, it doesn’t make the same exception for civilians—giving prosecutors a leg up while kneecapping defense teams.
They are not allowed to look inside.
We have many algorithms that are difficult to understand, difficult to debug, difficult to analyse, but the results are easy to verify. Look at famous algorithms like quicksort — understanding the code is hard, but looking at the output of a single invocation and verifying that it is sorted is trivial.
The report does sound like quicksort in this respect. The code will have done a lot of analysis, but in the end, the DNA (fragments) it reports were either there or not.
OK, so how do we verify if they're there?
For your example of sorting, we have the ordered output, can read the values of each item in the output, and have a definition of sorted.
What confirms the presence of DNA external to the methodology they don't want to allow external analysis of?
I don't doubt there could be a way. But you've just asserted it can when the how is actually the material question to the case.
It is of course possible that the program doesn't emit a detailed enough report. That it says "match found" without saying where in which files it found a match. But it's also possible that it does say where, in which case the presence of the needles can be verified easily, even if the method used to detect that those were relevant needles rather than irrelevant straws isn't specified.
Either way, rejecting an unknown algorithm because it's unknown is wrong. What matters is whether the output can be checked by others.
Obviously a headline with “STRmix” is not as click-bait as GitHub.
Regardless, how is it legal for the DNA software to get away with this?
I don't think it should be allowed as evidence otherwise.
A court has ordered GitHub to hand over the source code. GitHub has refused, believing that they only have to honor requests for the government, not for defendents. This article argues that stance by tech companies has led to morally reprehensible happening. They say tech companies often just pay fines rather than obey court orders to help defendents, while always helping prosecutors. The defendents's lawyers argue this is unconstitutional.
I don't consider that clickbait.
The article states that it would actually be illegal for GitHub to release the data.
I might be misreading but doesn't it state a much less strong position of "GitHub and California courts are sticking by tech companies’ traditional hardline interpretation of an arcane 1986 privacy law" - they believe it to be illegal but it may not necessarily be the case because, as they continue, "Arguably, GitHub’s interpretation of the SCA infringes on a defendant’s rights as repeatedly upheld by the Supreme Court itself".
Also you can call it a "hardline interpretation", but that probably means it's following the text. Companies are supposed to take a "traditional" interpretation anyway legally, although typically this is referred to as "precedent"!
If we remove the words "Hardline", "Interpretation", "Traditional" and "Arcane" which are all hyperbole, the statement actually would read "GitHub and California courts are sticking by a 1986 privacy law" - which of course they would, they are legally required to.
> "Arguably, GitHub’s interpretation of the SCA infringes on a defendant’s rights as repeatedly upheld by the Supreme Court itself".
This is just saying that arguably by not breaking one law, they were possibly breaking another law - and in this case the courts need to move.
And the answer is yes, if they are legally obliged to do so (i.e. enforcing a court order).
But there doesn’t seem to be an easy answer here. It’s not a simple technology or moral issue, it seems to be a somewhat complicated legal dispute, in case GitHub has a legal case to defend their stance (which I can’t judge).
That aside I wonder why exactly they’re going after GitHub instead of just going after the company directly, which should also be legally obliged to provide the code, i.e. why go after the bank if you have legal leverage over the guy with the key?
Something along the lines of "Any software used to determine guilt in a court of law, either directly or indirectly, must be open sourced to the public. Binaries used must be provably obtained from the published version, using an open source toolchain, reproducible by the public, free of charge."
I think the larger issue is that the political and legal class in the U.S. has a combination of arrogant ignorance and willful ignorance when it comes to anything to do with tech.
Imagine if finger print matching and other sorts of identifying methods were so opaque?
Somewhat more difficult for the guy about to be executed.
https://www.strmix.com/news/strmix-updates-defense-access-po...
Edit: Just reread the article: it seems that the defence followed the above but refused to agree to the conditions dictated by strmix.
Some of this case/article seems less like a fight between an convicted murderer trying to clear his name against Github/strmix, and more like a jurisdictional spat between Texas and California courts.