Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Destruction of evidence charges filed for remotely wiping iPhone

dailygazette.com

Post reply on HN
Print view View original

131–140 of 160 posts

Re: Destruction of evidence charges filed for remotely wiping iPhone

#131

Post by SamuelAdams »

mbrookes wrote: post #126
jonstewart wrote: post #94

Howdy, digital forensics software developer here. A few points: 1) yes, the police probably should have put the phone in a Faraday bag, but those aren’t perfect and municipal law enforcement generally doesn’t have the same equipment that state and federal police do. It doesn’t excuse the suspect allegedly taking action to destroy evidence; 2) this is probably about the boyfriend, who they suspect committed a shooting…

Could they not simply have put it flight mode? I appreciate that may not be possible for all makes of phone, but this was an iPhone X.

Probably not, otherwise the police could be tampering with evidence. Obviously you and I know that airplane mode != changing device data, but courts and juries may not see it that way. Or they will say "You put it in Airplane mode, what else did you do?"

Re: Destruction of evidence charges filed for remotely wiping iPhone

#133

Post by turc1656 »

reustle wrote: post #7

What if I use the gmail/slack/whatsapp website instead of the app, and remotely log the phone out of google/etc if my device is seized. That way the data was only stored in RAM, and they shouldn't be able to access it once they get into the phone. Does that count as destruction of evidence?

I assume that if you deliberately do anything to alter the state of the device in policy custody as evidence it will be considered tempering with evidence. A similar analogy - "hey, I didn't destroy evidence, I just remotely instructed my phone to encrypt itself. The data is still there, it's not destroyed." That would land you in a federal prison real fast, and rightfully so - you took action to change the device state after it entered police possession and you knew it was evidence. The contents of the RAM would definitely be considered evidence since by your own explanation they contain the data that the police are looking for.

Re: Destruction of evidence charges filed for remotely wiping iPhone

#134

Post by turc1656 »

mrsteveman1 wrote: post #36
AndrewDucker wrote: post #10

Earlier quoted context omitted.

If you deliberately do anything which will cause evidence to be placed beyond the reach of law enforcement then you are likely to be hit with charges. You can quibble over technical details, but at some point a judge will be asked if it fits the charge, and make a layman decision, not a programmer's one.

Then again, if a browser cookie is the only thing providing access to "evidence" on a particular machine, then it wasn't actually on that machine to begin with. That's far from a mere technical detail, as it also means the person lacked any meaningful physical control of, or proximity to, the evidence. I recall there are some cases that centered on whether someone was aware of the existence of a browser cache and kne…

I think the point you are missing here is that the person would be purposely altering the state of the device after it entered police custody, with the explicit intention of restricting access to the information that the device either 1) had directly, 2) had stored in cache, or 3) had access to through cookies, logins, etc.

If you are doing something to alter the device itself in any way (i.e. the bits anywhere on the device), it's a pretty straightforward path to the clink.

What isn't clear, though, is if the device was, for example, an "approved" device on some site/services and you logged into your accounts and removed access. Let's say for the sake of argument you had an encrypted chat app on your phone and that service has both web and mobile access. Your phone and laptop are approved devices. The police confiscate your phone. As soon as they release you, you log into your account from your laptop and remove the phone's access. The phone itself hasn't been changed. I wonder what would happen there.

Re: Destruction of evidence charges filed for remotely wiping iPhone

#135

Post by mattnewton »

turc1656 wrote: post #120
danso wrote: post #114

Earlier quoted context omitted.

Such as?

I suspect they were alluding to Hillary's email server scandal.

Or the Georgia election server under Brian Kemp’s control https://apnews.com/877ee1015f1c43f1965f63538b035d3f

Re: Destruction of evidence charges filed for remotely wiping iPhone

#136

Post by cyphar »

vageli wrote: post #111
notamerican wrote: post #82

Earlier quoted context omitted.

Well, not if you're physically located in in the U.S. at the tome, but the GDPR effects non-EU businesses and governments as long as the person involved is an EU citizen.

> Well, not if you're physically located in in the U.S. at the tome, but the GDPR effects non-EU businesses and governments as long as the person involved is an EU citizen. In what court would you bring a case against the United States under the GDPR?

If the business operates with the EU, this generally involves having a subsidiary in an EU country (most companies have subsidiaries in Ireland that own all of their "IP" for tax avoidance reasons, and thus can be very trivially fined as they operate as an EU company).

I get your point, but practically most large companies have EU subsidiaries (and in many cases, structure their businesses to exploit the benefits of EU nations like Ireland) and thus must follow EU laws anyway.

Re: Destruction of evidence charges filed for remotely wiping iPhone

#137

Post by cyphar »

briandear wrote: post #127
notamerican wrote: post #82

Earlier quoted context omitted.

Well, not if you're physically located in in the U.S. at the tome, but the GDPR effects non-EU businesses and governments as long as the person involved is an EU citizen.

No it doesn’t! The citizenship has nothing to do with the law. It’s the residency. An EU citizen living in New York has exactly zero to do with GDPR. An American citizen living in Paris though, would be covered by the law.

However it does apply to EU companies regardless of where the data subject is, and given that Apple is clearly an EU company if you see how its business is structured to (illegally) avoid taxes[1], it would apply in both cases.

But, more importantly, the GDPR doesn't help if the data is needed for a criminal investigation. There are very clear exemptions to the GDPR protections, and this is one of them.

[1]: https://en.wikipedia.org/wiki/EU_illegal_State_aid_case_agai...

Re: Destruction of evidence charges filed for remotely wiping iPhone

#138

Post by PurpleBoxDragon »

AndrewDucker wrote: post #10
reustle wrote: post #7

What if I use the gmail/slack/whatsapp website instead of the app, and remotely log the phone out of google/etc if my device is seized. That way the data was only stored in RAM, and they shouldn't be able to access it once they get into the phone. Does that count as destruction of evidence?

If you deliberately do anything which will cause evidence to be placed beyond the reach of law enforcement then you are likely to be hit with charges. You can quibble over technical details, but at some point a judge will be asked if it fits the charge, and make a layman decision, not a programmer's one.

>at some point a judge will be asked if it fits the charge, and make a layman decision, not a programmer's one.

There seems to be a doubles standard in regards to the use of technical vs layman decisions. I've seen legal cases where the judge is making rulings on extremely technical points of law which are far outside the layman's understanding, but these only seem to happen when there are really expensive lawyers pushing for it. Have a public defender? Layman decisions, especially if they aren't in the defendants favor.

I wonder if anyone would have the ability to formalize this into actual research to see if there is any truth behind my intuition.

Re: Destruction of evidence charges filed for remotely wiping iPhone

#140

Post by michaelt »

whatshisface wrote: post #76
chii wrote: post #52

Earlier quoted context omitted.

And everytime you put the phone in a safe, it gets wiped...

Why would you put your phone in a safe? Are the chances of it being stolen really that high?

Replace the word 'safe' with 'metal gym locker' and the answers are probably obvious.
Post reply on HN