Hacker News Reader

Comment by karzeem | Hacker News Reader

Suppose you've been charged with a crime and the police have obtained a warrant to seize the contents of a safe you keep in your house. American courts have ruled that the 5th Amendment does not protect you from being compelled to open the safe.

That precedent doesn't bode well for this case. I don't see a qualitative difference between the contents of a safe and those of an encrypted drive.

One workaround: fail-deadly. Automatically wipe the encrypted data if the password isn't entered every n days. With a small enough n, the courts can't move fast enough to get the data before it's gone. (Whether this scheme constitutes obstruction of justice, I have no idea.)

View on HN

The difference is that any safe can be opened anyway in a few hours. A judge faced with a defendant unwilling to reveal the combination to a safe would figure he was just making things difficult, order a locksmith and find him in contempt. Requiring people to reveal safe combinations doesn't change their legal rights, it just saves time and mess.

A properly encrypted disk is undecryptable by anyone, and owners have a genuine expectation of privacy for things on it. So revealing the key materially affects the evidence. It is clearly something the 5th amendment was meant to protect against.

Not true. A properly encrypted disk can be opened in a few thousand or million years. The judge can just order a decryption specialist and find the defendant in contempt.

Unless you're saying it's about "how inconvenient" it is? Because there is no encryption on the planet that is 100% impossible to decrypt.

I am perhaps being a bit snarky, but I think it's a valid question. You pose it like disk encryption is impenetrable, which it is not.

Edit: normally I don't care about downvotes, but I would really like to know this time; why do you believe it not valid? I am interested in what you have to say.

I haven't downvoted you, but I think OP made a valid point highlighting how encryption differs from a safe, while you are, in my opinion, nitpicking on details.

For the practical purposes of a trial, I believe a well encrypted drive is 100% impossible to decrypt, while a safe is relatively easy to open. Again, the point here is to assume good faith and think about a real situation, not if it's hypothetically possible to decrypt it.

  > ... you are, in my opinion, nitpicking on details.

Isn't that more-or-less the practical definition of what lawyers do? Isn't this more-or-less what the courts are for?

OTPs are 100% impossible to decrypt in absence of the key material. Mathematically guaranteed.

Of course nobody uses OTPs with harddrives, but people most certainly do/have use OTPs manually.

Furthermore, citing the difference between "few thousand or million years" and "undecryptable by anyone" is unnecessarily pedantic, not to mention wrong. There have been no documented cases of people living more than a few years over one tenth of a thousand years, so such a drive would be undecryptable to anyone.

You are right (I upvoted you :). Given current technology it is not reasonable possible to decrypt strongly encrypted data, however - there is strong evidence that using quantum computers this task is a matter of seconds. This technology is well defined theoretically already, just not reasonably implementable so far, which might be just a matter of some decade of time. In this respect, an encryption is the virtual equivalent of a safe, yes.

There is a complete other point I want to bring to your attention - our computers not only contain evidence, they also (might) contain lot of private and sensitive data, things you don't want anybody to know and where constitutional protection might fit since it's unrelated (I'm not knowledgable in the respective laws though, that's why I say 'might'), like a mental cache, and also hyper-links to other unrelated storages and networks (you can store much more virtual things on a computer than in a physical safe) - this makes a computer and it's disk somewhat different from a safe. It can potentially contain anything and the government would get access to a chain of homes like wandering through worm-holes because they were given one important entry code. This might affect the privacy of several other people, and they might not agree with that procedure. What is the law saying here? Are we going to be forced to use seperate computers for each task? rofl.

Quantum algorithms such as Shor's Algorithm give us a complexity improvement, as in "make it easier to solve". They don't say a thing about how long it will actually take as the clock ticks. That's dependant entirely on hardware that 1) doesn't properly exist yet, and 2) will likely be incredibly slow for many years and will take quite a while to even become large enough to load the problem.

Which raises the question, what if you had a safe that was practically impossible to open without the key? Let's say it's made of 100ft thick carbon nanotubes or it has a really good self-destruct mechanism. Do you get 5th amendment protection just because you have a really good safe? Doesn't seem quite right.

Given ldar15's assertion that you are not required to give up the combination to a safe, I wouldn't expect a court to be allowed to order the destruction of your property, unless they have strong evidence that something useful may be in the safe. But they usually don't: they want to open it because it may contain evidence. Not because they strongly expect it does.

> Whether this scheme constitutes obstruction of justice, I have no idea.

Not a lawyer but...

Courts seem to treat programs as proxies for their owners so if it's a program actively doing some kind of destruction then it probably would be. If you could ensure passively, that the data would become unusable after a certain time period it wouldn't.

A physical example would be an briefcase rigged with small explosives. Opening it without the code or waiting to long to enter the code would trigger it to destroy the contents. I imagine this would be considered willful destruction of the contents. On the other hand, if the materials inside could decay into ash in a short time peroid, then it's not willful destruction.

That would probably be the best defense. If the destruction was carried out as part of a regularly scheduled program instead of as a specific response to law enforcement's demand for the data, you might be alright.

Lots of companies automatically delete all email older than six months for this exact reason, actually.

According to a post I read a while back on the Cybercrime Blog, you cannot prevent authorities from opening the safe or refuse to hand over a physical key (with a lawful warrant, at least), but you are under no obligation to provide a combination. I'm pretty sure the combination thing was SCOTUS precedent, but I'm not 100% certain.

But you've handed them the data. You gave them (or let them take) the hard drive. You've opened the safe. Now they're expecting you to explain its contents and how they incriminate you.

I am required to open my safe for you. I am not required to decode the encryption I perform by hand (or with my graphing calculator).

i think they could argue obstruction/destruction of evidence with the dead-man's switch thing. although a legit counter argument is the wipe is a general security measure to protect the data. if we saw phones as if they were our credit/debit cards that would be a perfectly reasonable security measure to prevent against theft.

On the contrary. If the safe requires a combination, the higher courts have held that the 5th protects you from giving it up.

This is from the 5th Circuit Court of Appeals in Texas, and makes for interesting reading:

http://ftp.resource.org/courts.gov/c/F3/272/272.F3d.748.00-5...

Reply on news.ycombinator.com