Hacker News Reader

Comment by jmyeet | Hacker News Reader

Except that's not going to happen because evidence spoliation (legal term) is a crime. And that's what he did. You can say it shouldn't be but it is. This is slam dunk and it happens all the time. It's the same crime as destroying evidence that's been subpoenaed or that it has a preservation hold on it.

And the court gets to assume that whatever was on that phone hurts your case, regardless of whether or not it did.

It would've been better if he'd crossed the border with a phone already factory reset and just restore it after entry.

View on HN

What case law allows for the establishment of “evidence” before a crime was alleged? Is it not a catch-22?

First, the law applicable here is 18 USC § 2232 [1]:

> (a)Destruction or Removal of Property To Prevent Seizure.—

> Whoever, before, during, or after any search for or seizure of property by any person authorized to make such search or seizure, knowingly destroys, damages, wastes, disposes of, transfers, or otherwise takes any action, or knowingly attempts to destroy, damage, waste, dispose of, transfer, or otherwise take any action, for the purpose of preventing or impairing the Government’s lawful authority to take such property into its custody or control or to continue holding such property under its lawful custody and control, shall be fined under this title or imprisoned not more than 5 years, or both.

Now what I think you're asking about is "adverse inference". In civil cases, the courts get to assume the evidence lost hurt you. In criminal trials it's a little more complicated but can show up as, for example, jury instructions. The court is allowed to instruct the jury that they can presume that the destroyed evidence was harmful to the defendant.

[1]: https://www.law.cornell.edu/uscode/text/18/2232

I think the legal question is whether the officers were authorized to make this particular search+seizure without probable cause or even reasonable suspicion.

Independent of the merits of this case, is there legally a distinction between deleting a secret key that decrypts an encrypted blob (maybe not spoilage?) vs writing over the blob itself (spoilage?).

I could see arguments for both, either, or neither but I imagine both are considered spoilage.

This is the problem I run into with technical people discussing the law all the time and I mean this constructively: stop trying to figure out technical workarounds or look for technical compliance. So much of the law comes down to subjective and/or holistic tests of the facts.

As soon as a lawful search is requested, situation has changed. The only question then is if you comply or not. If you remove the ability for that search to take place then how that happened is irrelevant. Destroying a secret key is no different to zeroing a blob of data. Actually the first might be worse. If the key is somehow recoverable (eg you have a copy on a cloud drive) then you can have ongoing penalties by refusing to comply.kkkkkkkkkkkkkkkkkkkkkkkkkkkk

The only thing that matters is the lawful request. Whatever you do up to that point is treated differently compared to what you do after.

You might say: what if I add a deadman's switch where I have to type in a code every 72 hours to stop it wiping itself? Your thought process might be that this is passive. It doesn't matter. As soon as the request is made and you refuse to hit that switch knowing the phone will wipe, legally it's no different. You have destroyed potential evidence when faced with a lawful search.

This is what I mean when I say stop looking for loopholes or technical compliance. It does not matter.

The other question is whether you can prove what you did. If the guy hadn't bragged that his phone was now wiped, the government would have a much harder time proving he did anything wrong, but his secrets would still be safe from the government.

Reply on news.ycombinator.com