Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ: Strong encryption that we don’t have access to is “unreasonable”

arstechnica.com

Post reply on HN
Print view View original

71–80 of 238 posts

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#71

Post by michaelmrose »

Spivak wrote: post #68
JoshTriplett wrote: post #61

Earlier quoted context omitted.

> You can go to jail for destroying evidence, why would encrypting the data and refusing to provide the password or deleting the key be any different? Specifically encrypting incriminating data after you have evidence of a crime in an effort to cover it up should be treated as the equivalent of shredding documents. (Assuming, of course, they can prove it, just as they have to prove that you had the documents in quest…

I don't really think the timeline is meaningful in this case. Having a rule where people cannot be made to decrypt files is just legalizing document shredding with an extra step. To avoid cases where people legitimately forgot their passwords just assume that the police have video evidence of you unlocking the files just before you were arrested. You know the passphrase and the police could prove it beyond reasonable…

"If they were instead physical documents buried somewhere hidden where the police could not possibly find them without your help the court still has the ability to hold you in contempt if you don't produce them"

Are you sure this is so, this sounds awfully similar to compelling you to testify against yourself. Perhaps you are confused.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#72

Post by JoshTriplett »

Spivak wrote: post #68
JoshTriplett wrote: post #61

Earlier quoted context omitted.

> You can go to jail for destroying evidence, why would encrypting the data and refusing to provide the password or deleting the key be any different? Specifically encrypting incriminating data after you have evidence of a crime in an effort to cover it up should be treated as the equivalent of shredding documents. (Assuming, of course, they can prove it, just as they have to prove that you had the documents in quest…

I don't really think the timeline is meaningful in this case. Having a rule where people cannot be made to decrypt files is just legalizing document shredding with an extra step. To avoid cases where people legitimately forgot their passwords just assume that the police have video evidence of you unlocking the files just before you were arrested. You know the passphrase and the police could prove it beyond reasonable…

> This is different than routine shredding because the moment when they become inaccessible is when you refuse, not the moment you encrypted them.

Not true. The moment you encrypted them, they became inaccessible without your consent.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#73

Post by AnthonyMouse »

Spivak wrote: post #68
JoshTriplett wrote: post #61

Earlier quoted context omitted.

> You can go to jail for destroying evidence, why would encrypting the data and refusing to provide the password or deleting the key be any different? Specifically encrypting incriminating data after you have evidence of a crime in an effort to cover it up should be treated as the equivalent of shredding documents. (Assuming, of course, they can prove it, just as they have to prove that you had the documents in quest…

I don't really think the timeline is meaningful in this case. Having a rule where people cannot be made to decrypt files is just legalizing document shredding with an extra step. To avoid cases where people legitimately forgot their passwords just assume that the police have video evidence of you unlocking the files just before you were arrested. You know the passphrase and the police could prove it beyond reasonable…

> This is different than routine shredding because the moment when they become inaccessible is when you refuse, not the moment you encrypted them.

If it really had anything to do with when you refuse then you could just proactively refuse as soon as you encrypt so it happens at the same time. And it would imply that if you were killed before being asked to decrypt then the government would have access to the data because you never refused, which is obviously not true.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#74

Post by shakna »

Spivak wrote: post #53
brian-armstrong wrote: post #45

Here's my biggest complaint with this debate - people are confusing literal with metaphorical. They make the analogy of the unbreakable safe. Encryption isn't that. You can still recover the physical phone and all of the storage chips on it. That the patterns of bits in the chips make up some unrecognizable utterance is seemingly immaterial. I could write gibberish in my journal at home if I wanted to, and I think we…

The other side of this is that enshrining encryption as something that police can't compel you to help with just creates a huge loophole for hiding incriminating documents. You can go to jail for destroying evidence, why would encrypting the data and refusing to provide the password or deleting the key be any different?

You don't know what's in the file.

Police need reasonable cause to take action.

If all you have is an encrypted file, there's nothing to say it is incriminating. Encryption is necessary for a whole range of things.

Would you like banks to be forced to use weak encryption when processing bank-to-bank transfers?

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#75

Post by bradknowles »

unabst wrote: post #65

The argument here is extremely simple. Encryption is the only way to secure information. This is true for criminals and non-criminals alike. To deny encryption is to deny security to everyone. Presuming it's the criminals who will look to exploit these vulnerabilities, denying security is making every non-criminal susceptible to attack. So the only question that needs to be answered is this. Do we want to protect our…

But how do you design a strong encryption algorithm that can be trivially unlocked once a warrant is provided?

Answer: you can’t.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#76

Post by bradknowles »

saulrh wrote: post #39
wahern wrote: post #34

Earlier quoted context omitted.

Clearance rates for homicide have _dropped_ over the past 50 years: America’s homicide clearance rate—the percentage of solved crimes that lead to arrest—has fallen considerably in the past 50 years, from around 90% in 1965 to around 64% in 2012, according to federal statistics. ( https://www.economist.com/news/united-states/21656725-police... ) (See, also, https://www.citylab.com/equity/2017/06/police-arent-getting-…

Wouldn't that be a change in data collection more than in absolute quality of problem-solving? Japan, for example, I remember reading that their near-perfect homicide rate is actually because they'll classify it as "fell down some stairs" if they can't solve it. Particularly in the US with its history of social issues, I can easily see a ton of homicides in the 50s just never being written down.

Or homicides that were attributed to some person that it was convenient to lock away and who were unable to prove their innocence.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#77

Post by AnthonyMouse »

SomeStupidPoint wrote: post #7
olliej wrote: post #5

I wish this could be hammered into the thick heads of congress: there is secure, and there is insecure. There is not a gradient.

That's... just not true. And that kind of misrepresentation just weakens the arguments for strong encryption, because intelligent people will see them as pretty transparent misrepresentations. Have you considered that's why the arguments for strong encryption aren't going well -- that we're not actually engaging with intelligent people trying to understand the issue, we're chanting trite, shallow inaccuracies? I mean…

> I mean -- "there is not a gradient"? ...what do you call changing key size?

It isn't that there are no levels of security, it's that you can't be at two separate levels at the same time. There is no overlap.

Mandating 512-bit RSA is useless because the government could break it but so can everybody else. Allowing 4096-bit RSA wouldn't allow the government to break it.

There is no middle ground. Mandating something like 1024-bit RSA, which is considered weak but nobody has actually broken it yet, is worse than useless. The FBI probably couldn't break it today and some hackers will probably break it tomorrow, so it would only leave people at risk without providing the government access.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#78

Post by unabst »

bradknowles wrote: post #75
unabst wrote: post #65

The argument here is extremely simple. Encryption is the only way to secure information. This is true for criminals and non-criminals alike. To deny encryption is to deny security to everyone. Presuming it's the criminals who will look to exploit these vulnerabilities, denying security is making every non-criminal susceptible to attack. So the only question that needs to be answered is this. Do we want to protect our…

But how do you design a strong encryption algorithm that can be trivially unlocked once a warrant is provided? Answer: you can’t.

That's not the point. Like a body buried in the desert, there is nothing that can force a person to reveal anything. Silence is encryption enough when it comes to secrets. Torture doesn't work either.

So it's business as usual. It's obstruction of justice. Book'em.

And of course, "I can't remember" is always the greatest defense.

This whole thing is about the government endangering the public in exchange for abusing their rights.

It's all bad. You could go as far as argue that the government is obstructing justice and endangering the public by denying basic security.

We already know the enemy will find ways to access all the data. Encryption is not the last line of defense. It's the only line.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#79

Post by alsetmusic »

c3534l wrote: post #52
alsetmusic wrote: post #50

Earlier quoted context omitted.

> that lied about being unable to unlock the phone of the last guy they tried this with to get the law changed… I found it very telling that they announced their inability to access the phone only a few days after the incident. It struck me as a very clear PR move that was designed to lay the groundwork to shape public opinion. My threshold for declaring that the device is inaccessible requires more time for research…

Don't forget that the phone was unencrypted when they got it, and that it was the FBI who locked it in the first place: https://www.nytimes.com/2016/03/02/technology/apple-and-fbi-...

I have no idea how I never knew that. I thought I followed the case fairly well, but had never read about user error on the part of the FBI. For all the articles written, this was a very under reported detail.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#80

Post by hackinthebochs »

bo1024 wrote: post #41

It's hard to know where to even begin in arguing against this. There's the freedom/privacy argument, but I guess this is debatable depending on if you view computer files as an extension of your ideas/knowledge, or an extension of your physical possessions. Someone brought up the entire "risk of overreach and abuse" argument. There's also the likelihood of any tools the government has being leaked and used by bad act…

>Oh, and the "it's technologically impossible" argumentbe the only one you need -- but they refuse to hear that.

Things like DUAL_EC_DRBG seem to prove this claim false.

Post reply on HN