5 ms·

Why is that when the government says "But, but computer!" judges abandon common sense and case law. Even when the tables are turned there is still an amazing am

by hsmyers 13y ago

Why is that when the government says "But, but computer!" judges abandon common sense and case law. Even when the tables are turned there is still an amazing amount of techno-ignorance in the process. Consider the long ago (tech time anyway) prosecution of Microsoft. The idiots in charge completely ignored their success with IBM and attacked via the browser vector. Andrew Schulman at the time of pre-trial investigation had three books entitled Undocumented this that and the other thing. Each should have been a successful blueprint in terms of anti competitive behavior. Had this and the browser been part of their war chest I think the result would have been considerably stronger (i.e. the bust them apart goal would have been reached) with a appropriately more useful public result. <end_of_slightly_off_topic_rant/>

betterunix 13y ago
"Why is that when the government says "But, but computer!" judges abandon common sense and case law" I can think of a few reasons: (1) My understanding of the legal theory is that computers are considered to increase the capabilities of the population; hence, the government's power to enforce the law must also be increased. Consider a car analogy: you must display visible license plates to identify your vehicle whenever it is on the road, yet that was never required for horses, carriages, bicycles, or any previous mode of transportation. Likewise with computers: where previously you might have been able to whisper a secret to someone a foot away from you, now you can secretly communicate with someone across thousands of miles. (2) It is assumed that the spirit of the law must be upheld. If the police are legally allowed to wiretap a suspect as part of an investigation, then encryption must not be allowed to get in the way of that. In other words, technology must not defeat the law, even in spirit. (3) Conservative views of technology: quite a few judges are still of the opinion that personal computers are just fancy cable boxes, and so doing anything that violates the will of service providers or governments is "abuse." Entering a URL manually is considered to be vastly different from writing a script to generate and fetch URLs automatically, even if there is no technical difference. If you discover that your phone lets you make a free long distance call when you whistle into it, you are a criminal; if you discover that a web server will give you anyone's account number when you enter the right URL, well, you're an even worse criminal. (4) Ignorance of what is actually possible with computers. See e.g. how Kevin Mitnick was treated when prosecutors claimed he could whistle into a phone line and thus launch a nuclear strike.
- ds9 13y ago
  Re (2), the idea that LE is entitled to have comms decrypted has never been "the spirit of the law" until very recent legislation. In the days of "alligator clip on the wire", the law allowed the police only to intercept whatever the content was, in the form it was in - it did not compel the people speaking to explain their "code words", or to speak in a language the officers could understand. It is precisely this fact which makes the current "going dark" argument an example of overreaching and mendacious, bad-faith deceptive rhetoric: encryption does not take away any powers the police formerly had; to the contrary, the demand for decryption goes far beyond traditional wiretapping principles.
  - betterunix 13y ago
    I am not saying that I agree with the idea, but one could make an argument that modern cryptography is different from speaking with code words, and that the spirit of wiretapping laws extends to forced decryption. Using code words only barely qualifies as "encryption" at all -- it is certainly not going to meet basic semantic security definitions. Further, codewords are not something is built into any communications equipment, not automated, and computed in one's head -- quite different from TLS or OTR. One could argue (as the DoJ does) that the spirit of wiretapping law is that the police can, with the approval of a court, temporarily violate a specific suspect's privacy in an electronic communication system. Hence if the system automatically encrypt's the suspect's messages, the police should be able to obtain plaintexts. Phone companies are not exempted from wiretapping requirements when they multiplex phone calls, despite the fact that that is a technical measure that (as a side effect) impedes wiretapping. Again, this is not an argument I agree with. For one, wiretapping laws do not, as you pointed out, require a suspect to participate in any way in the wiretapping. For another, there is a component of modern encryption that does (or should) occur in a suspect's mind, much like the computation of code words. It is also true that in general, wiretapping laws have expanded far more rapidly than communications technologies have hampered police investigations; the ability of the citizens to have a private conversation is still "catching up."
    - ds9 13y ago
saraid216 13y ago
> Even when the tables are turned there is still an amazing amount of techno-ignorance in the process. Honestly, the EFF is the only entity that it is even bothering to do something about this. Keep this in mind when computer interface design is built towards making sure the user doesn't need to understand what's happening. It's part of it.
- IceyEC 13y ago
  Even in this specific case that is not true; the brief was filed by the EFF in addition to the ACLU.
tedunangst 13y ago
One may as well ask why every time a judge issues a ruling, geeks everywhere shout "I know more about the law than you do, dumb judge!"
rayiner 13y ago
> Why is that when the government says "But, but computer!" judges abandon common sense and case law. It's exactly the opposite. It's technologists that say "but, but computer!" and demand special treatment for computers are involved.[1] Judges generally treat computers in terms of real-world analogies to concrete things, and these analogies often clash with idealistic notions held by technologists. This case is actually an excellent example of that phenomenon. I've heard people say that their laptop/phone/etc is an "extension of their mind" or something to that effect. Because the 5th amendment only applies to testimonial incrimination (because of the use of the word "witness" in the text of the 5th), you need that nexus to the mind in order to justify concluding that forcing someone to give up an encryption key is equivalent to forcing them to testify against themselves. The more obvious (to me, anyway) analogy is that a laptop/phone is like a backpack or briefcase. I keep documents, photos, notes, etc, in my laptop just as I would keep them in a briefcase. Well, under the case law it is not prohibited under the 5th amendment to force someone to unlock a briefcase! That act has no nexus with a person's internal thoughts and is thus not testimonial. [1] Other examples include various CFAA-related things. Nobody would defend just walking into peoples' houses and saying "hey, your locks suck!" but defend analogous behavior with regard to computer security all the time. You also see it in the e-mail context. E.g. most people who complain about the government possibly subpoenaing e-mails they store on Google's servers would not see the problem with the government subpoenaing Enron's records they stored at their accounts' premises. Technologists generally want to ignore the obvious physical analogies in favor of ones based on how they perceive the electronic world (i.e. it's "my personal documents" even though it's stored on a cloud and dozens of engineers and sysadmins have access to them).
- kinghajj 13y ago
  An unencrypted hard drive may be akin to a briefcase, but what about an encrypted one? Wouldn't that be more like a safe with a combination lock? IIRC, courts still cannot compel one to disclose the combination to unlock a safe, only to provide a key to a lock, exactly because safe combinations exist solely within the defendant's mind--just like most encryption keys. Disclosing the key implies that one has access to the data, which may be incriminating in and of itself with certain data. Even if the key is not provided, and the defendant is allowed to enter their password privately so that prosecutors may inspect the unencrypted data, the act of entering the password in and of itself provides evidence that one is aware of the contents, and thus may be used as evidence against oneself.

by hsmyers 13y ago

betterunix 13y ago

"Why is that when the government says "But, but computer!" judges abandon common sense and case law" I can think of a few reasons: (1) My understanding of the legal theory is that computers are considered to increase the capabilities of the population; hence, the government's power to enforce the law must also be increased. Consider a car analogy: you must display visible license plates to identify your vehicle whenever it is on the road, yet that was never required for horses, carriages, bicycles, or any previous mode of transportation. Likewise with computers: where previously you might have been able to whisper a secret to someone a foot away from you, now you can secretly communicate with someone across thousands of miles. (2) It is assumed that the spirit of the law must be upheld. If the police are legally allowed to wiretap a suspect as part of an investigation, then encryption must not be allowed to get in the way of that. In other words, technology must not defeat the law, even in spirit. (3) Conservative views of technology: quite a few judges are still of the opinion that personal computers are just fancy cable boxes, and so doing anything that violates the will of service providers or governments is "abuse." Entering a URL manually is considered to be vastly different from writing a script to generate and fetch URLs automatically, even if there is no technical difference. If you discover that your phone lets you make a free long distance call when you whistle into it, you are a criminal; if you discover that a web server will give you anyone's account number when you enter the right URL, well, you're an even worse criminal. (4) Ignorance of what is actually possible with computers. See e.g. how Kevin Mitnick was treated when prosecutors claimed he could whistle into a phone line and thus launch a nuclear strike.

ds9 13y ago
Re (2), the idea that LE is entitled to have comms decrypted has never been "the spirit of the law" until very recent legislation. In the days of "alligator clip on the wire", the law allowed the police only to intercept whatever the content was, in the form it was in - it did not compel the people speaking to explain their "code words", or to speak in a language the officers could understand. It is precisely this fact which makes the current "going dark" argument an example of overreaching and mendacious, bad-faith deceptive rhetoric: encryption does not take away any powers the police formerly had; to the contrary, the demand for decryption goes far beyond traditional wiretapping principles.
- betterunix 13y ago
  I am not saying that I agree with the idea, but one could make an argument that modern cryptography is different from speaking with code words, and that the spirit of wiretapping laws extends to forced decryption. Using code words only barely qualifies as "encryption" at all -- it is certainly not going to meet basic semantic security definitions. Further, codewords are not something is built into any communications equipment, not automated, and computed in one's head -- quite different from TLS or OTR. One could argue (as the DoJ does) that the spirit of wiretapping law is that the police can, with the approval of a court, temporarily violate a specific suspect's privacy in an electronic communication system. Hence if the system automatically encrypt's the suspect's messages, the police should be able to obtain plaintexts. Phone companies are not exempted from wiretapping requirements when they multiplex phone calls, despite the fact that that is a technical measure that (as a side effect) impedes wiretapping. Again, this is not an argument I agree with. For one, wiretapping laws do not, as you pointed out, require a suspect to participate in any way in the wiretapping. For another, there is a component of modern encryption that does (or should) occur in a suspect's mind, much like the computation of code words. It is also true that in general, wiretapping laws have expanded far more rapidly than communications technologies have hampered police investigations; the ability of the citizens to have a private conversation is still "catching up."
  - ds9 13y ago

saraid216 13y ago

> Even when the tables are turned there is still an amazing amount of techno-ignorance in the process. Honestly, the EFF is the only entity that it is even bothering to do something about this. Keep this in mind when computer interface design is built towards making sure the user doesn't need to understand what's happening. It's part of it.

IceyEC 13y ago
Even in this specific case that is not true; the brief was filed by the EFF in addition to the ACLU.

tedunangst 13y ago

One may as well ask why every time a judge issues a ruling, geeks everywhere shout "I know more about the law than you do, dumb judge!"

rayiner 13y ago

> Why is that when the government says "But, but computer!" judges abandon common sense and case law. It's exactly the opposite. It's technologists that say "but, but computer!" and demand special treatment for computers are involved.[1] Judges generally treat computers in terms of real-world analogies to concrete things, and these analogies often clash with idealistic notions held by technologists. This case is actually an excellent example of that phenomenon. I've heard people say that their laptop/phone/etc is an "extension of their mind" or something to that effect. Because the 5th amendment only applies to testimonial incrimination (because of the use of the word "witness" in the text of the 5th), you need that nexus to the mind in order to justify concluding that forcing someone to give up an encryption key is equivalent to forcing them to testify against themselves. The more obvious (to me, anyway) analogy is that a laptop/phone is like a backpack or briefcase. I keep documents, photos, notes, etc, in my laptop just as I would keep them in a briefcase. Well, under the case law it is not prohibited under the 5th amendment to force someone to unlock a briefcase! That act has no nexus with a person's internal thoughts and is thus not testimonial. [1] Other examples include various CFAA-related things. Nobody would defend just walking into peoples' houses and saying "hey, your locks suck!" but defend analogous behavior with regard to computer security all the time. You also see it in the e-mail context. E.g. most people who complain about the government possibly subpoenaing e-mails they store on Google's servers would not see the problem with the government subpoenaing Enron's records they stored at their accounts' premises. Technologists generally want to ignore the obvious physical analogies in favor of ones based on how they perceive the electronic world (i.e. it's "my personal documents" even though it's stored on a cloud and dozens of engineers and sysadmins have access to them).

kinghajj 13y ago
An unencrypted hard drive may be akin to a briefcase, but what about an encrypted one? Wouldn't that be more like a safe with a combination lock? IIRC, courts still cannot compel one to disclose the combination to unlock a safe, only to provide a key to a lock, exactly because safe combinations exist solely within the defendant's mind--just like most encryption keys. Disclosing the key implies that one has access to the data, which may be incriminating in and of itself with certain data. Even if the key is not provided, and the defendant is allowed to enter their password privately so that prosecutors may inspect the unencrypted data, the act of entering the password in and of itself provides evidence that one is aware of the contents, and thus may be used as evidence against oneself.