Kostchei

Most police services/forces have a ceiling on that. I worked in one where there was a combination. Not in the US, but the issues are similar and we had a union.

The union absolutely could not protect sworn officers who broke the law. And if a member was in legal trouble, the local branch voted on whether to provide legal support ( good lawyers paid by the union for as long as needed). I saw an officer charged with stealing (from a found wallet) where the branch voted not to provide that support.

My advice- pay police more and expect them to behave as professionals.

As a teenager in Thailand I saw police (1990) who didn't get paid enough to live- they relied on local community giving them rice, blankets, weapons.. or they ripped off folks -mostly from outside the community. Speeding tickets for foreigners etc.

I was paid ok to do my digital forensics- but doubled then tripled my wage in 2 years of leaving- doing ~ the same stuff (what people call incident response is built into your blood after a few years of policing).

I would also argue that I was much better as a police officer after 7 years than after 2, and much better at the specialization that I choose in the police- digital forensics- after 9 years, much better... and when i left @15 years I was much, much more valuable to the service than when I joined (skilled in forensics, understood the court process, could well react to emergencies, could write policy not just follow it etc)- but my pay had gone up maybe 30%. But I didn't go up in rank because I didn't want to manage people, so my wage mostly capped.

And if anything- that is the issue with time based seniority- you force people to stop doing what they are good at and make them managers, with predictable results. (ie poor management)

Edited to not be a single wall of text

THIS is exactly what happened when they (google) pushed "Google Chronicle" a security offering- which my employer might use (having some GCP and a lot of Gsuite)- I wouldn't even suggest it to the CISO, based on the nearly 99.9% chance Google will kill it and we would be left with a huge gap.

There is a more insidious problem at work here. Police are, by dint of their daily work, good at understanding how the law works and how people get away with crimes.

This means that if you treat them equally to a random person, they have the knowledge to/will get away with more crimes.

The only problem with holding them to a higher standard once you understand this, is that it generates resentment, and the higher standard becomes a different system they learn and game.

I say this as someone committed to justice for who 15 years in policing is receding into the past.

I don't have a perfect solution or I might have stayed in policing, at least kept my badge- I work in security now which scratches the itch that got me into law-enforcement in the first place. (don't tell my coworker devs that- some already think infosec is out to get them- we are not) It is hard to stay justice oriented no matter where you are- in gov law enforcement or the private sector, startup or big-corp.

Unfortunately from a ex-LEO perspective, it has been very popular with children and heavily hunted by sex offenders, at least in the communities I served in. Doing digital forensics, almost every police officer in a child protection case would be asking "can we get the kik history off that phone?" Not be cause they were guessing but based on experience or admissions by the victim. Part of the seedy underbelly that 75% of the community don't get exposed to. People found it hard to believe when these sort of network-related offences occurred in churches too. Some religious groups are/were more prone to it than others, often based on opportunity or expectations.

some planning plus a timed "slow cooker" could address this directly

Real zero knowledge would involve you controlling the private keys and either a "lose it and you really lost it" or shamir-escrow model. Then you wouldn't have to rely on their security at all, just your control of the private key and airgapping of the escrow.

So my joke about "I put it on Google+ so it's basically a secret" is coming true.

The answer, as I see it, to this, is transparent decryption via federated ledgers. That way the data is not just "available".

Note- the big guys (facebook, google) could trick/force individuals into handing over keys, but if you make the keys per object this becomes less effective for the same big guys.

In a sense, there is no control without encryption.

Still cogitating the various hows, but transparency to the user is the key.

It's not about avoiding marketing. It's about ownership and control.

If I want my stuff to be analysed- I let that happen- it finds business or social matches- awesome. I just need the option to turn that off for things I don't want greped- like banking.

I too am in favor of paid for services. Because that is what happens eventually. You pay for it. I'd rather make a decision and choose who I pay, as opposed to having my choices and VIEW-OF-THE-WORLD limited because everything is "free" but funded by marketing.

We're trying to build the idea of "paid for storage" that doesn't look at your stuff, but getting people to pay fora service that others provide with advertising for free is hard.

Any company being truthful about what their customers want can't be tracking them 24-7 and sifting everything they type. Almost no-one wants that level of invasiveness. We just put up with it because there are no real (easy) alternatives or aren't aware.

After reading a little I randomly plonked on Brave. Selfishly, I wanted to know if our stuff worked on it- encryption, chunking etc. To my joy, it does and.... Brave is pretty cool. Converted.

I have noticed Xero doesn't work on Brave. Not my product so not so concerned but I'm going to investigate to see what Xero is doing that we are not. ie why my dev's stuff works and xero's does not.

direct deposit works fine in AU. If what you are actually doing is cash to a person. Then you can stay electronic.

Homomorphic encryption, anonomized data coupled with metadata, searching via k-Anonymity models.

I mean, sure it has a cost, some of this stuff is new, but to say "cannot be encrypted"... that's where the fun is- working out how to do it.

Unfortunately it gives them the legal capability to require your startup/IT company/multinational to put development time in at their request to enable your software to give them the access they want.

For example-

get chats in real time

log IP addresses and pass them to gov

open containers stored on your infrastructure

get into the phone or device you have sold to a client previously

These are not interpretations of the legislation- these are the use cases they wrote it to solve.

As ex LEO I get it but the burden on organisations is going to bad for business, not to mention the insecure solutions that are going to get drummed up/coded on the fly to comply with these requests- security nightmare.

There is some reasonable paranoia that this might be a Trojan to enable access in the US. Can't pass legislation in the US? Easy, get your vassal state (AU) to pass it, then ask them to investigate your target and then force people to comply with your vassals state's request.

"yeh I know you can't do that in Texas but you can in Western Australia and we, the US, has a treaty with Australia so you're just going to hand over that data. We'll deliver it to the Aussies for you"

I may be paranoid, but I'm not the only one seeing this angle on it.

Big conspiracies- count me out. Gov is lazy and disorganised. Little conspiracies between gov-buddies ? Absolutely.

Sure, you could say the same of any document, electronic or not. Most crime is not that complicated.

  It turns out that the metadata footprint left on a computer creating a document- if you can seize it- is rich in detail enabling creation date and the like to be identified. Mail servers may hold logs. Often a fake email or document is part of an offense and proving where a faked email was sent from becomes quite relevant, and yes, ends up as evidence in court.

You may hear a prosecutor say "and on the 30th of june 2011 did you send the following email..blah..blah"

There is a reason for that- they are establishing the possibility that it is actually evidence. Its not clear cut, otherwise we wouldn't have courts. You proffer evidence and convince people of it's weight. And that will continue to be the case.

Gopher- I remember setting up and using that as a part of a intern-like job at my local high-school. Back in the days of trumpet winsock and other relics of the hand-crafted TCP stack. shudders Mind you- it does deliver text at low bandwidth. :) Minimalism in communication. I wonder if I can get my SO off facebook and onto Gopher in the interests of the environment... manic laughter fades into the distance

If you are interested in transferring digital data with privacy without having to provide your descendants an ever-changing password... you could use "YourDigitalFile"- which uses keysplits, a nomination process (who receives your file after death or incapacitation) and an escrow. *disclosure- I work for YDF. As our founder came to learn- and this inspired him- sometimes it is important and no-one knows how to get access. https://www.yourdigitalfile.com/data-legacy/

Nope, that's the opposite of luck. Run!

raises both eyebrows but only in the country with the most lethal spiders.. /j

yewp, lol, Laundry Files OPSEC vs Great Old Ones. 1. Don't scan and upload random occult manuscripts to computational devices

..sort of.. I agree that is probably a civil dispute, but that doesn't help if the outcome is "violently arrest someone on camera" What they are supposed to do is act with authority, use their position to resolve situations efficiently and rapidly. They almost always end up between unions and corps during strikes for example- and these sort of "civil" disputes often escalate into violence. So, solve it before it gets there. (15 years LE, LE trainer in use of force, recently retired)

1. Don't take the laptop, preferably don't take a phone, unless you can factory wipe it before entering customs. If this is not an option, don't go. With 10 years in forensics/ more in IT and a good/careful eye to the legislation, I have made the sad decision I can't go. (various work conferences)

I visited from Australia in 2009 and I was going to a law enforcement work conference- that was close enough to work for them to ask me for hotel details. I remember needing everything on that page. LA-X as point of entry. It was un-pleasant. I didn't go to a similar conference this May as a result of this experience. I imagine it is worse now.

yep. Work on the copy, or the copy of the copy in my case. It's digital with a hash, not a vhs tape

Yeh. Now that is a worthy project. Must learn Rust to implement it in character, however

Kurt, I mean, you are ,occasionally, a funny chap, but I get the impression you are too cynical to even breathe damn it breathe! *commences CPR on n-gate

edit: spellin

and Dust

And this, is why the current US president scares the shite out of me. There are a bunch of jobs with a breadth and depth requirement where this is the reality. The first people liars lie to are themselves. (and I'm not being glib- I've done a heap of fraud cases) How does that person ask for help? Not knowing their limits of competence.

Considering even with logging off: journaling file systems, "user assist", device connection logs, pre-fetch (or your OS's equivalent)- these are all huge tranches of data if you are looking at a system shortly after an event. Ask me 6 months later- probably not. Give me a system that hasn't even rebooted, has a heap of ram and hasn't been used much since- 6 weeks is fine, not ideal, but doable.

It could also be a e-discovery tool like Nuix. If you want to find all documents containing X amongst millions of docs- that's the sort of tool I would use (work in computer forensics) *edit. And 9.7 GB of data, assuming it's docs not "just' a lot of CAD is a lot of docs..