Hacker News Reader

Comment by roc | Hacker News Reader

The truly interesting bit, will be when a case of (real or alleged) multiple hidden encrypted volumes is publicized.

If the government feels the information they want is on a laptop, the laptop's owner would suddenly find themselves forced to prove a negative (there are no more hidden volumes), lest they be held in contempt.

If they can seemingly compel you to reveal something they can't proven even exists and lock you up until you can prove that it doesn't, the door for abuses isn't even wide open; it'll have been removed from its hinges along with most of the wall.

View on HN

US v Hubbell makes clear that the government cannot compel production of documents (except under immunity to prosecution) which it does not know, ahead of time, to exist.

Then how can they compel someone to unlock a laptop to enable arbitrary access? Wouldn't they be limited to requesting specific documents?

The legal system allows them to do things analogous to that, such as compelling someone to open a safe to enable arbitrary access to the contents (as mentioned in the article). Presumably they must suspect that the safe contains documents relevant to the case.

Every case is a little different, but investigators do need probable cause to search a laptop.

This is a mortgage fraud case involving years of criminal activity, so I'm guessing that it's probably not too hard for the prosecution to produce witnesses who can say "yes, she sold me that crappy mortgage and used her laptop when I went to meet with her.", or direct information of her internet usage (ISP, or logs from cable modem), or observation of her using the laptop by police during the investigation.

So the moral of the story is, conduct your criminal activity via software running on an external server on a TrueCrypt partiton, and always interface with it via Tor?

Then they can't prove it's "your server" and thus order you to reveal the key.

(For example, if you have access to a credit card not in your name, you can set up an EC2 micro instance for free for a year. Then install TeueCrypt and be on your merry criminal way. What could the DOJ do?)

The DoJ would simply get a judge to sign an order giving their forensics lab a snapshot of the virtual machine with the key sitting decrypted in RAM. Amazon would be under a gag order not to tell you that they even had it (not that Amazon would even care to tell you anyway).

If they wanted to pin it to you, they could easily show timing correlations between your client system activity and the VM activity. Probably they would also go to the person who lent you their credit card and threaten them with prosecution unless they fingered you.

Cryptography is not going to save you from prosecution if you do any noteworthy crime. There is no security "in the cloud" from any government with a jurisdictional or financial relationship with the provider. (Though Tahoe LAFS is an interesting project).

Interesting. Good point.

the DOJ have laptop (like a knife in a murder case). According to Miranda, the defendant have the right to remain silent (incl. all kinds of communications, ie. oral, keyboard typing, Morse alphabet using campfire smoke, etc... ) and, in particular, can't be compelled into communicating any information in connection with her/his using of the laptop (or murder knife), while the DOJ is free to have as much witnesses as they can describing defendant's usage of the alleged crime tool.

Miranda doesn't apply, here. That derives from the 5th amendment, but it pertains to police interviews after arrest. The ability to obviate the 5th amendment by offering immunity amounts to a way to compel potentially incriminating testimony. It's likely that eventually the question here is going to be the extent of the immunity required to compel testimony of the password: just immunity for information contained in the password itself, or for information contained in the files it unlocks?

http://en.wikipedia.org/wiki/Miranda_warning

So what if the govt suggests a document exists (claims to know exists) and therefore could be located on an encrypted volume is that grounds for them to force someone to decrypt that volume or be held in contempt of court?

I think it will still be a requirement for the gov't to show that there's cause. In the same way that the gov't can't hold you if they suspect you know where a kidnapped victim is held, unless they have evidence that you do know where they're at (it's similar in that you don't have to prove a negative, rather the police must show that there's reason to hold you).

So they must have evidence that suggests there is another volume.

Suppose someone uses my wifi connection to hack into, say, a Sony server and retrieve a database of credit card information.

The government would have evidence and reason to believe I have that data. So, naturally, they'll get to seize my laptop and apparently can compel me to unlock it and allow them arbitrary access.

It seems to me that they don't know the stolen data resides on that laptop any more than they know whether I have a hidden volume that contains the data they're searching for. So if their evidence is good enough to compel me to produce a password, why would it not be good enough to insist a hidden volume contains the data and that I'm withholding the sought-after data?

If someone can simply say "nope, no hidden volumes here" and that's the end of it, it would be trivial to defeat a digital investigation.

In short, I'm skeptical about what defines the reasonableness of an investigation and this apparent power to compel arbitrary access to documents.

I think that's where forensics would come in: "This is a 2TB drive. All the data on the drive amounts to 1.5TB. QED, there is 500GB of data missing."

More interesting, IMO, would be how alleged steganography would be handled.

Thankfully that is not how truecrypt works. The volume would be reported as the full 2TB (or however large the container is), it is up to you to not use all the space (which you could do, it will just silently start overwriting the hidden volume. They would have nothing to go on other than you didn't fill the disk (who does?).

When writing a byte, how does truecrypt knows it isn't overwriting a random file in a hidden volume ?

It doesn't. Essentially, you have to make sure that you don't fill up the volume space or else you will overwrite the hidden volume.

So, if my volume size is 100G on a 200G drive, I have 80G of data, If I write another byte, how Truecrypt knows it won't overwrite one byte of the hidden volume ?

It doesn't.

If you write anything to the non-hidden volume while you don't have the hidden volume mounted, you risk overwriting part of the hidden volume.

Now, I got it, You have to mount both the hidden volume and the first level volume to safely write to the first level. Great.

No, since people everywhere don't use the full capacity of their hard drives. Hidden volumes look no different from empty space so that doesn't prove anything.

I think what it amounts to is:

* The government 'knows' that you have a bunch of digital data, therefore it must be stored on a digital device. Therefore, all your digital devices are reasonably suspect.

* The government can't search your laptop without full access to files. If you have full-drive encryption (or even just homedir/per-user encryption), the government can reasonably claim that you haven't given then full access, with some amount of proof that there is encryption being used.

* Once you have unlocked your primary partition, the government would probably have a hard time convincing a judge that there is any reasonable way to know if you have a hidden partition, other than asking you with a polygraph... which I don't think you can be compelled to take.

I think the govt would have to use the same means it would use to prove that you know the whereabouts of a missing person.

They can't hold you forever (except maybe in enemy combatant like scenarios), much like if you picked up a girl from a club at midnight, and no one ever saw her again. Your claim is you dropped her off at her apartment at 3am, but there's no evidence of it. They can ask you what they want, but w/o more evidence they can't just lock you up forever.

But with more evidence, for example, if they find IMs where you mention that you've hidden something in hidden volumes, they may have more options open to them.

I guess my point is that this seems to fall into standard practice, more than this being a one off rule specific to hidden volumes.

Yea. Your point is that they can't lock you up forever based on the suspicion of a hidden volume. My point is that it would likely to be hard to them to reasonably assert a hidden volume, and even if they could assert a hidden volume, if you unlocked one but had several, they wouldn't be able to reasonably convince a judge of suspicion of several hidden volumes.

Then, having several is difficult since they all have to nest, and can't reside in parallel (i.e. the second hidden volume has to be inside the first hidden volume, it can't reside along side the first hidden volume within the top-level volume).

For her sake, she has a hidden & real TC volumes -- i.e. she has both a real and fake TC OS volume. I don't know of any other encryption methods that allow hiding a volume within another volume as such. Even so, if I boot up your fake volume and it's pretty apparent it hasn't been used in 8-months or simply has a blank My Docs folder, I don't know how that will go.

I suppose somebody could make the argument that all that unused space is slack or something like that ("Oh yeah I only use 20GB/200GB HDD). Though, as people have said, this is pretty new territory.

Perhaps I misread the article, but I didn't see a mention of whether this involved hidden TC volumes or not.

EDIT: Clarity.

The standard method is to use one operating system in normal, day-to-day operations and another (in a hidden volume) whenever you're doing something sensitive or potentially illegal (you would also change the MAC address, not use it on your own wifi network, and so forth). However, it's probably too much to hope that most people actually realize this, especially criminals. Extremely paranoid people will have absolutely nothing incriminating on the computer, leave it unencrypted (to avoid suspicion), and use disposable flash drives with a small Linux image on them whenever they want to do something illegal. The flash drives are destroyed after one use.

Oh, and anyone smart enough to do that wouldn't describe their method on a public forum.

Also, your first sentence really irritates me: having the entire OS volume encrypted in no way means that you have two OS volumes, which you seem to be saying.

I didn't mean to imply that, I meant to imply one "should" have two different volumes with different operating systems as to ensure no artifices from your misdeeds are on the "day to day" volume (assuming said criminal is using Windows). I'm merely going off my understanding of the ideal TC setup, as I don't bother having one setup in such a manner.

I am of the opinion, as you stated, most criminals are not wise enough to go through the extra steps necessary to truly make TC hidden volumes reliable. From my experience, the extent of most peoples' tech savvy is running CCleaner or in the RAREST of cases Eraser. Though, I should say my experiences are 90% corporate.

Reply on news.ycombinator.com