For example, suppose Comey succeeds in mandating encryption backdoors. Then the backdoor gets compromised and published. You suddenly have an obligation to use an encryption mechanism you know is compromised to transmit things you have an obligation to keep secret. Catch 22.
In theory a court might realize the absurdity of that situation and let you out of one of the obligations, but how do you know which one it will be? Or that they won't still demand that you do both, effectively requiring you to shut down your business until the government changes the law?
And now you've got yourself some trouble, because the intent for publishing the free speech flag can reasonably be as criticism of laws purporting to make certain information illegal. Then you're publishing political speech which is a whole different ballgame.
But the better point is that people have become quick to dismiss the math, as if facts and logic and reality are irrelevant to the law. The law has to live inside the universe. It has to do something when the problems the math proves can happen actually do.
So for example, the xor situation is interesting. If you xor with random bytes, the result is indistinguishable from random and is capable of encoding literally any information of equal or smaller length -- at the same time -- by changing what you xor it back with. So A xor B is the Declaration of Independence while A xor C is DeCSS, C xor D is the Bill of Rights and C xor E is a trade secret document.
Now suppose there are some websites allowing anyone to publish xor-encoded data (or arbitrary data). Somebody uploads A to one such website and C to another. Anybody who asks about A, you can show them B and it encodes the Declaration of Independence. Anybody who asks about C, you can show them D and it encodes the Bill of Rights. So now A and C are being published by separate sites, each is indistinguishable from random, but xor them together and you get DeCSS.
DeCSS is being published, but who is publishing it? Who can be forced to remove their half, when doing so would also delete arbitrarily many instances of lawful speech that require the same random bytes (and could be the only copy)? What is the status of B and D, given that you can xor them with public documents to get back A and C? What if you can prove that A is preexisting and C is derived from DeCSS and A? What if there is no way to prove which existed first?
If somebody does this, there has to be an answer better than hand-wavy dismissal of inconvenient math.
In court the judge would attempt to judge the intent of each person involved and rule based on that. You seem to think this is a problem, and indeed it is hard. That why the law uses judges rather than attempting to legislate every possible example.
But the better point is that people have become quick to dismiss the math, as if facts and logic and reality are irrelevant to the law. The law has to live inside the universe. It has to do something when the problems the math proves can happen actually do.
No. This is the key thing you are missing. Elsewhere on this thread someone put it like this: "I would add the concept that the law, unlike software, is capable of openly defying logic. Courts are permitted to dismiss case law and rule in a completely new and unforeseen direction."
The Law is lazily evaluated, in a specific court, in the context of a specific case. It does not follow that the logic in one case applies in another - sometimes it might, sometimes it might not, and things like the intent of the people involved matter.
It isn't. If you encrypt something with most algorithms, there is going to be one key that turns it back into something intelligible and all the others produce garbage. That isn't the case with xor. Different "keys" will produce different intelligible decryptions.
> In court the judge would attempt to judge the intent of each person involved and rule based on that. You seem to think this is a problem, and indeed it is hard. That why the law uses judges rather than attempting to legislate every possible example.
The hardness is the problem. Suppose somebody sends you a DMCA takedown for what appears to be random numbers, arguing that if you xor it with some specific other random numbers you get infringing content. But that proves nothing because it's true for everything, so what are you supposed to do? What is the judge supposed to do?
> No. This is the key thing you are missing. Elsewhere on this thread someone put it like this: "I would add the concept that the law, unlike software, is capable of openly defying logic. Courts are permitted to dismiss case law and rule in a completely new and unforeseen direction."
How is that supposed to solve anything? The problem isn't that the court is going to come across "this statement is false" and have a meltdown, the problem is that we can't predict what the court is actually going to do so we don't know how to behave if we want to stay within the law.
And furthermore that there isn't anything good for the court to do. Of course the court is not required to do something good, but how is it OK when they do something bad?
You do, as soon as you're pointing someone towards C.
One of the main errors techies make about the law is that they tend to see a problem to prove something as fatal to a law.
By this logic pointing out that there are drug dealers in Detroit is distribution of narcotics, pointing out that there is money in a bank is conspiracy to commit bank robbery, publishing a vulnerability is publishing everything on every system with that vulnerability, etc.
It's also an obvious practical problem since you've reduced the resources necessary to publish something from having to host a multi-gigabyte piece of content and have enough bandwidth to distribute it to millions of people, down to distributing a couple of hyperlinks. Which you might do with a mailing list or RSS feed that all the interested parties will then already have a local copy of before anybody can do anything about it, or from a different jurisdiction because transit from overseas is no longer prohibitively expensive.
> One of the main errors techies make about the law is that they tend to see a problem to prove something as fatal to a law.
It's supposed to be. If you can convict someone without proving their guilt then you can convict anyone regardless of their guilt.
You're pointing to C because you want people to xor it with A (and you're probably telling them that, too).
When I say "there are dealers on the corner", I don't want you to buy drugs.
When someone else says the exact same thing, he might want you to buy drugs.
He and I are treated differently by the law.
Ad the second point: no, it's not! You've got it the wrong way around. I'm not talking about convicting someone wihtout proof. On the contrary, I'm saying that the fact that we cannot prove every murder does not mean that the murder statute is fatally flawed and must be repealed.
> When someone else says the exact same thing, he might want you to buy drugs.
> He and I are treated differently by the law.
And that's where the whole thing falls apart. Because it means there are circumstances that allow someone to tell people where they can buy drugs, so the person who wants to tell everyone where to buy drugs can pretend to be doing it for the same reason you are.
I can come up with some plausible valid intentions for doing the xor thing, but lets use the real case. DMCA 1201 prohibits trafficking in circumvention tools. Intent doesn't matter, because there are very obvious legitimate non-infringing uses for "circumvention tools" and nothing about the tool changes based on the intent of the user, so allowing circumvention tools for non-infringing uses would allow them to be widespread (which they are anyway, but never mind that now). However, prohibiting circumvention tools for non-infringing uses may be unconstitutional.[1] So intent has to matter but if intent matters then in practice that law can't be effective. Which means we shouldn't have that law.
[1] https://www.eff.org/press/releases/eff-lawsuit-takes-dmca-se...
> I'm not talking about convicting someone wihtout proof. On the contrary, I'm saying that the fact that we cannot prove every murder does not mean that the murder statute is fatally flawed and must be repealed.
The problem isn't with statutes where you can't prove every instance, the problem is with statutes where every perpetrator can make themselves look like an innocent person and the only way to convict them is to make an assumption that would also convict the innocent people.
There might be other factors to take into account that change that result slightly, but it's not really different from a crime that doesn't involve computers.
You're assuming that you know which one the "second one" is.
The "first" file may have originally been hosted somewhere else or distributed privately. Some hosts don't keep high granularity timestamps or any timestamps at all, or the user may control the timestamp. How do you know who was first?
Suppose there is some thing the law says you can't publish. You encrypt it with AES, throw away the key and then publish the ciphertext. It's not at all clear that the law is going to punish you for that -- nobody can read the information anymore, so whatever evil the law was intended to prevent is not occurring, and anyway the government is going to have a hard time proving their case since without the key they can't actually prove what the ciphertext is.
Now suppose you do the same thing but instead of AES you use 40-bit DES, which anybody can easily break with modern hardware. Now you're arguably publishing the thing, and the government can prove what the ciphertext is, so the outcome could be different. But that wouldn't have been the case in the 1970s when computers were slower.
So what is it about the conclusion that the law could depend on the state of computing power and algorithms that you find so implausible?