Hacker News Reader

Comment by justanother | Hacker News Reader

The website isn't exactly presented in a linear fashion, but I gather the issue is the subject's use of Truecrypt to contain his personal files, whereas on a company-owned computer, all data therein is company property.

This certainly seems like it should be a civil matter, not something to involve the guys with guns and blue suits. But more to the point, $21.50 an hour for a 1099 job for a huge bag-of-dicks of a boss who pirates all his desktop software? Is that BSA hotline still around, or do they even care about small fries?

View on HN

> whereas on a company-owned computer, all data therein is company property.

Are you sure? AFAIK, without signing any contracts, all work I produced is mine, regardless of where it resides. By inference, is all data in my computer mine as well?

When you start with a company you sign over the rights to the work you do with their time, equipment, and resources (most of the time, and exact conditions vary, but that's a very common LCD)

He says in the linked website[1] that he signed no such agreement.

[1] http://www.innocentbeyondareasonabledoubt.com/

I was under the impression that GP was talking about the general case. Specifics are always, well, specific to that case:)

Work created within the scope of your employment automatically belongs to the company: https://news.ycombinator.com/reply?id=6488654&whence=item%3f....

"Employment" yes. But how about as an outside contractor and not an employee. Unless you, the business hiring the contractor, specify that the contractor is performing a work for hire and that all intellectual property rights associated with said work shall be transferred to you, the copyright law says the creator of the work holds the copyright on the work. Under the law, and with an agreement to receive payment but without stipulations regarding ownership, I'd say it's fair to assume you (again, the one hiring the contractor) are obtaining a license to the work, but not to assume that you will own the work.

Right, if you're a contractor it doesn't automatically belong to your employer. I think the issue here is an evidentiary problem: we have nothing other than the author's word that nothing in the encrypted partition belongs to the business.

Why is that a problem? Wouldn't the burden of proof fall on the employer to give evidence that something in the encrypted partition belongs to the business?

First, burden of proof is not a concept that's relevant before criminal charges or a civil complaint have been filed. You don't need to prove that there is something in the encrypted partition to bring charges. Circumstantial evidence is enough.

Second, in an actual trial the author would have to unlock the encrypted partition. There is no right of privacy against a court. If there is disagreement about what's in a box, people aren't going to sit around arguing about burdens of proof and burdens of production. The court is going to order the box be opened and the issue resolved definitively.

Therein is the current question. This is not a box. It is a metaphorical box, that can only be opened by information. This information is only contained in the head of the defendant. Say there is something incriminating in the box. The 5th amendment protects you from being compelled to self incriminate. So, the court could not legally order the box opened, without providing immunity to the defendant.

Your reasoning and my reasoning are the current modes of thought about encryption in a legal context. Neither has been proved correct in that context.

Right, 5th amendment is an issue on the criminal side (not the civil side), and the case law is mixed on whether giving up a decryption password is more like giving up a key to a box (which the court can order you to do), or giving testimony protected by the 5th.

So, if I'm getting this straight: if I'm an employer who's curious to know what's inside an encrypted partition on one of my contractors' laptops, I can simply call the police, say I suspect there's company data there, the police and prosecution don't need any more evidence to bring this to trial, and then the judge will likely order said contractor to decrypt the partition? Then if it's just his personal porn collection, everyone shrugs and life goes on?

You're throwing out all of the context. If you call the police out of the blue like that, they'll ignore you. If you call them with respect to an employee who was fired and "lost" certain property, that's enough to at least investigate.

I see. Thanks for the clarification.

I still find it troubling that there's no burden of proof to violating someone's privacy before the court (there also doesn't seem to be any guarantee that decrypting the partition before the court would be done behind closed doors). But I guess there are many privacy issues not currently well addressed by U.S. laws...

Reply on news.ycombinator.com