Police Claim Encryption Use Is Illegal | Hacker News Reader

Police Claim Encryption Use Is Illegal

cryptome.org

EDIT: You have to read the complaint in the last link. It sounds like there were some laptops or something that were "lost" and the owner believed he stole them, and filed a police report. That's what the charges stem from.

http://s3.amazonaws.com/InnocentBeyondAReasonableDoubt/PDF/C...

With regards to the allegations of theft, I'm not sure what the author's point is. He repeatedly says he offered to pay the owner back for the missing items. Should that mean that he can't be charged with theft? If I steal something and get caught, should I just be able to offer to pay and avoid prosecution? He repeatedly says that the missing items amount to at most a civil matter, but stealing stuff from work is not a civil matter.

For the rest of it, the author doesn't have a leg to stand on. Say instead of an encrypted partition we were talking about a safe. I kept a safe in my office, and one day I was summarily fired and escorted out of the building. I promised that there was no business information or property of my employer in that safe, then refused to hand over the combination. Should the employer leave it at that, saying "gee, if he says he didn't put any business property in the safe, I guess I just have to believe him!"

I can understand where the author is coming from (though his writing makes that difficult). The owner is clearly being a huge asshole. But the author is being naive to think that there must be something "fishy" going on. Unfortunately for him, he's on the wrong end of this story. It's so common for disgruntled employees to steal company property or damage company property that nobody is going to give him the benefit of the doubt except the jury, who is legally required to. The author repeatedly mentions the standard for conviction (beyond a reasonable doubt). However, that's not the standard for prosecution, which is closer to "more likely than not."

He said several times that he would unlock the encryption. He also said that he didn't feel right giving the password to anyone.

Why should the owner trust him that he's actually doing what he says he's doing?

Because he offered to do it at the police department? I doubt that he would be left alone with the computer.

You mean watching him type in the password?

> The author doesn't have a leg to stand on. Say,...I kept a safe in my office

The guy writes: "I was an independent contractor. No employer-employee relationship existed. Federal labor laws afforded me the right to choose when to work, where to work, how to work and what work I was to produce. There were no other work-for-hire contracts or specific performance contracts signed and I did not sign any NDA."

To carry forward with your "safe" analogy: Suppose a plumber came to your house. When he leaves, you demand to search the toolbox he brought to your house. Who's in the right here?

My understanding is that the "toolbox" was the client's, not his.

You cannot just buy your way out of a theft charge. If that were the case, can you imagine how thefts would skyrocket? Steal as much as you want, and when someone catches you, give back the specific item(s) they're missing and keep the rest!

Of course, a private accusation of theft is not an official charge of theft, or a prosecution, or a conviction for it. If a private individual comes to you and accuses you of taking something that belongs to them, and you return it, that ought to be the end of it, unless the victim is really honked off and insists on involving the police. Once the Boys in Blue are involved, it becomes much more difficult to resolve the situation extra-judicially.

> If I steal something and get caught, should I just be able to offer to pay and avoid prosecution?

What we know is, that the owner claims there was a theft and the (lets call him) contractor offered to reimburse the owner. This does not mean that there was a theft. If I should speculate, it is rather likely that the contractor did loose a laptop, and at this point the relationship was already poisonous enough that the owner either assumes that there was a theft or tries to exploit the missing laptop.

> For the rest of it, the author doesn't have a leg to stand on. [...]

I think this strongly depends (IANAL) and the contractor should get the benefit of doubt. So for example if his .ssh/ directory is on that partition, then he may or may not have ample reason to keep the contents ( e.g. a private key for one of his servers) secret.

His timeline and story are all here: http://www.innocentbeyondareasonabledoubt.com/

Lesson: Do not ever cooperate with the police.

Bo should have just let the original issue (I'm not even sure what that issue was) between he and his employer go to a civil court.

Lesson: Do not ever cooperate with the police.

Seriously? So if I get mugged in the street or if I have my home burgled I should do what?

I think it would be more appropriately phrased as "do not ever cooperate with the police if it is unsolicited interaction".

You shouldn't solicit interaction with the police either, unless it's an absolute emergency life-or-death situation. In all other cases, the best outcome of an interaction with the police is that nothing happens. There is a misconception that they're on your side as long as you've done nothing wrong, or as long as you have a reasonable complaint, but they are simply not.

Their job is to get people in front of a judge, to make them pay fines, or to get them into prison. All things being equal, they'll be working with the closest target they can see and that's you if you solicit them. They basically behave like predators.

Hmmm, how bizarre. When we had trouble with a contractor, the police knocked on her door and told her a complaint had been filed. Nothing more was required to stop the trouble. When my kid was ill in the car and I stopped (illegally) on the hard shoulder, the police car that investigated pulled back a bit with it's lights flashing until we could continue. My kids have set in police cars many times when they've been monitoring events. I've worked with the police a number of time when organising events.

Where do you live? I want to make sure I never visit there.

Call your insurance company, if you're insured, then get on with your life.

The cops don't have a time machine and they don't give a shit about you getting mugged or your stuff getting stolen. If you work hard enough you might get a police report out of them for insurance purposes.

I don't have a good text source lying around but here's a law professor and a cop explaining the downside: https://www.youtube.com/watch?v=6wXkI4t7nuc

Not all cops let things slide. Some see it as a job, some get a power trip, and others take pride in their work.

I've posted this before on HN, but will quickly cover it again; A few years ago, my wife was at school and (completely her own fault) left her purse in the class during lunch (this is a medical career school and the class had about 8 students). That night we received a call from Chase asking about a string of purchase attempts using one of her cards - which she then realized was missing. Based on the list of places the card was used, we went to the stores the following day explaining what happened. Once we had done the leg work, confirmed that they would have video surveillance during the time the card was used, we called the police. The officers that showed up went to great lengths to file the report, work with GameStop, Target and Stop&Shop security personnel to not only get us to identify the person, but get video evidence of the crimes at each location. In the end, the classmate who stole the card was prosecuted and served jail time in two separate counties as well as payment of damages (small, but still) for the attempted use of the card which got her nothing in the end. Coincidently, the detective on the case also saw that the girls mom had a warrant out for her arrest so they picked her up as well.

The experience was very positive from our side of things - and perhaps it's not the common experience people hear about, but these officers were very happy to help. As a side note, the county that these officers were in was not a small, nor "safe" county and it wasn't a matter of them not having anything else to do at the time.

All that being said, the original advice of not talking, and knowing your rights should definitely be adhered to if you are on the other side of things. The way everything was used to aide us, can also be used against you. Not all police will treat you the same.

This is a good example of how people should use police services. They were and prepared, and they did as much of the legwork as they could. The advice to stay away from the police and to not talk to them when they are soliciting you is also good advice, but maybe not when taken to the extreme. Imagine if the shop owners refused to cooperate? It would have been much harder to solve this crime.

There are some guidelines that I think can help. If you get stopped for a traffic stop and the cop says he wants to take a quick look through your car, you should (respectfully) decline. That can lead to nothing good for you. If you think you might be suspected of a crime (right or wrong), or you don't know why the police want to talk to you, do not go and meet with them. If you get arrested, get a lawyer and let him/her deal with talking to the police. You can talk to the judge if it comes to that.

If they explain that they are investigating a crime and you have some information or evidence they need, go ahead and help them if you are not a target.

Just remember, the police are not your friend. They do not care about your life. They will lie to you and manipulate you if it suits their purpose. However, they do in fact serve an important function, that you may need them someday. Use them for their intended purpose. The system is certainly imperfect, but does work much of the time. I believe the trend towards police wearing body cameras during every interaction can only lead to good things for everyone.

The experience was very positive from our side of things

Your experience is almost certainly the common experience for people in your socio-economic group. The common worst case being they do let it slide and you are just left with wasted effort on your part.

The problem is that you have no way of knowing ahead of time if you are going to get an outlier -- a cop who decides there is something hinky about you and focuses on that rather than whatever reason you solicited their help for. It is absolutely a rare event (somewhat less rare for other groups, but still rare). The problem is that the consequences of having one of those rare events happen to you can be life-ruining. It is a very real case of one bad apple spoiling the bunch.

In your example, you had nothing to gain from the culprit's arrest and prosecution. The chance of you ending up on the wrong side of the law was quite small, but not zero. Perhaps the purse was recovered and they found a joint in it - even if the drugs didn't belong to your wife, you risk becoming the target of an investigation.

Given that balance of low-chance, high-consequence risk with essentially zero upside it would make sense for most people in that situation to avoid it completely.

I've also used this example before. When we lived in Bangladesh, we had a van full of robbers try to break down our gate. The cops took a long time to get there, but they drove away the robbers.

The only thing worse than cops is no cops.

If you need them, by all means, talk to them. But if they need you, get a lawyer first.

Yes. Well, ish.

At most, do the minimal reporting you have to so. The problem is, as a human you might innocently give the officer some cause to suspect you in some way, or in some way mitigate the crime against you. I know people who have felt more anger after the police turn up to do their thing than they did on discovering the crime.

I would only involve the police in something I felt was very serious, which had to be solved, and could not be solved any other reasonable way. My definition of something very serious? Don't know till it happens, and frankly I'm sure we all have our own ideas of limits.

Burglary wise, don't know about other countries, but here in the UK the only real reason to report a normal burglary is to get a crime number for the insurance company. Mugging is pretty much the same, assuming you have something stolen which is insured. And luckily that can be very minimal, Im think, cant be sure, you can report crime online and get an instant crime number for insurance purposes. I think it probably only worth it is people get physically hurt or something vital is stolen and can't be replaced. Even then...

It's not the U.S., but I was robbed twice in the last few months.

I lived at the most populous neighbourhood in my city, and so I reported the theft to the police station, they made me enumerate my belongings and gave me some papers stating what I had lost.

A few weeks later, I called to inquire if some advance had been made, and the lady told me "no, we haven't recovered anything"... but I hadn't given her my case number ! So they hadn't recovered anything for anyone.. in a 100.000 people neighbourhood...

At least in my country, if there's no violence or some important reason to go after the criminal, police won't pursue. They don't care much about material losses (they do have a decent track record aprehending murderers and such).

The police are allowed to lie. That's why you don't take legal advice from them.

The police aren't attorneys that you are paying for.

THAT is why you don't take legal advice from them.

Yes, always hire your own professional liar first.

Right. Because "Lawyer" is synonymous to "Liar" and the justice system totally isn't based on provable facts, but how well you can lie.

Something is not right about this story. I can't put my finger on it, but the holes in Bo's story make me suspicious. What items were lost originally? What were the circumstances surrounding the lost items? Why wasn't Bo fired immediately after these items were reported missing? Why is Bo offering to pay for any lost items, and why does he seem so eager to do so?

Then, as it pertains to the laptop, what the FRICK is Bo doing installing single user pre-boot authentication on a work computer? That is totally out of line, and I wouldn't blame the employer for feeling like his computer was being held hostage by an ex-contractor.

I could see the theft charge in that case. If someone installed password-protected full disk encryption on my computer and refused to give me the password, yes, nothing was physically "stolen", but the fact that I'm being denied access to my own data is more-or-less equivalent.

The fact that Bo then cuts a check to a detective again makes no sense to me. Why are you paying off law enforcement instead of going through the judicial system? Don't forget, going to court is also there to protect you.

The website isn't exactly presented in a linear fashion, but I gather the issue is the subject's use of Truecrypt to contain his personal files, whereas on a company-owned computer, all data therein is company property.

This certainly seems like it should be a civil matter, not something to involve the guys with guns and blue suits. But more to the point, $21.50 an hour for a 1099 job for a huge bag-of-dicks of a boss who pirates all his desktop software? Is that BSA hotline still around, or do they even care about small fries?

> whereas on a company-owned computer, all data therein is company property.

Are you sure? AFAIK, without signing any contracts, all work I produced is mine, regardless of where it resides. By inference, is all data in my computer mine as well?

When you start with a company you sign over the rights to the work you do with their time, equipment, and resources (most of the time, and exact conditions vary, but that's a very common LCD)

He says in the linked website[1] that he signed no such agreement.

[1] http://www.innocentbeyondareasonabledoubt.com/

I was under the impression that GP was talking about the general case. Specifics are always, well, specific to that case:)

Work created within the scope of your employment automatically belongs to the company: https://news.ycombinator.com/reply?id=6488654&whence=item%3f....

"Employment" yes. But how about as an outside contractor and not an employee. Unless you, the business hiring the contractor, specify that the contractor is performing a work for hire and that all intellectual property rights associated with said work shall be transferred to you, the copyright law says the creator of the work holds the copyright on the work. Under the law, and with an agreement to receive payment but without stipulations regarding ownership, I'd say it's fair to assume you (again, the one hiring the contractor) are obtaining a license to the work, but not to assume that you will own the work.

Right, if you're a contractor it doesn't automatically belong to your employer. I think the issue here is an evidentiary problem: we have nothing other than the author's word that nothing in the encrypted partition belongs to the business.

Why is that a problem? Wouldn't the burden of proof fall on the employer to give evidence that something in the encrypted partition belongs to the business?

First, burden of proof is not a concept that's relevant before criminal charges or a civil complaint have been filed. You don't need to prove that there is something in the encrypted partition to bring charges. Circumstantial evidence is enough.

Second, in an actual trial the author would have to unlock the encrypted partition. There is no right of privacy against a court. If there is disagreement about what's in a box, people aren't going to sit around arguing about burdens of proof and burdens of production. The court is going to order the box be opened and the issue resolved definitively.

Therein is the current question. This is not a box. It is a metaphorical box, that can only be opened by information. This information is only contained in the head of the defendant. Say there is something incriminating in the box. The 5th amendment protects you from being compelled to self incriminate. So, the court could not legally order the box opened, without providing immunity to the defendant.

Your reasoning and my reasoning are the current modes of thought about encryption in a legal context. Neither has been proved correct in that context.

Right, 5th amendment is an issue on the criminal side (not the civil side), and the case law is mixed on whether giving up a decryption password is more like giving up a key to a box (which the court can order you to do), or giving testimony protected by the 5th.

So, if I'm getting this straight: if I'm an employer who's curious to know what's inside an encrypted partition on one of my contractors' laptops, I can simply call the police, say I suspect there's company data there, the police and prosecution don't need any more evidence to bring this to trial, and then the judge will likely order said contractor to decrypt the partition? Then if it's just his personal porn collection, everyone shrugs and life goes on?

You're throwing out all of the context. If you call the police out of the blue like that, they'll ignore you. If you call them with respect to an employee who was fired and "lost" certain property, that's enough to at least investigate.

I see. Thanks for the clarification.

I still find it troubling that there's no burden of proof to violating someone's privacy before the court (there also doesn't seem to be any guarantee that decrypting the partition before the court would be done behind closed doors). But I guess there are many privacy issues not currently well addressed by U.S. laws...

The letter of complaint is a lot easier to digest than going through the site

http://s3.amazonaws.com/InnocentBeyondAReasonableDoubt/PDF/C...

Putting personal files on an employer's computer is a bad idea. Why do such a thing?

Isn't an exchange of funds admission of guilt?

No. In a civil case, often a defendant will compare the cost to defend themselves to the cost of settling, and will opt for the latter, including in the settlement documentation that the settlement is not an admission of wrongdoing.

Silly Police!

Next lock boxes and safes!

They do hire some ignorant yahoos from time to time.

We are moving back to square one.

Reply on news.ycombinator.com