Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think it's quite frustrating that apparently nobody in this comment thread bothered to read the relevant laws.

It is a sufficient defence in law to state that you do not have access to the key file. The only requirements being that you can show some backing and that the prosecution cannot prove beyond a reasonable doubt that you do have access to it.



> It is a sufficient defence in law to state that you do not have access to the key file. The only requirements being that you can show some backing and that the prosecution cannot prove beyond a reasonable doubt that you do have access to it.

How do you prove you don't have access to a key to data that isn't actually encrypted? Do you need to keep sets of fake keys for sensor data that you lose, so you have a defense?


If the data isn't actually encrypted or it is otherwise not protected information then you wouldn't need to provide a specific defence.


Sensor data is indistinguishible from encrypted data. How can some law aplly to one and not be used to the other?


To elaborate on this:

Ideally, encrypted data is indistinguishable from random data, otherwise known as "noise". Sensor data, radio telescope data and so forth often contain lots of that: it's just a LARGE file of bits that seem uncorrelated. No one can prove that a multi-gigabyte file of recorded data contains that, as opposed to them having renamed super-secret.tar.gz to sensor-logs.tar.gz.

Since no one can tell the difference, there's a pretty reasonable fear that police could see data related to your hobby (dumping ROMs, analyzing data, etc) and say, "You need to decrypt this so that we can see that it doesn't have $(illegal stuff) in it".


Probable cause. If there's no evidence of any kind that the data is actually encrypted data vs random sensor data then there is no way for this law to be invoked.


Specifically there has to be evidence that the data had a prior 'intelligible form' before encryption, in the case of a file of white noise there can be no such evidence.


The problem is that probable cause doesn't mean it is actually encrypted. What happens when they have probable cause, but it is actually sensor data?


How do you show backing in a case like this? I say I don't have it and I show them in support that... ?

I'm not trying to be mean, by the way, I'd honestly like to know. ^^;




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: