News for hackers. Stuff that matters.
Re:Utterly Unpersuasive: Formal Methods and Law (2019) by motohagiography on Saturday April 23, 2022 @01:38PM (#31136374)
Such an interesting project. A non-trivial amount of my consulting work has been in translating statutory requirements into system architecture features as they relate to requirements for privacy and security, often with cryptography. Along the way, you see how laws are not meant to run on machines or be subject to mere logic, and they are not abstract state machines that yield "legal," under the right conditions.

I'm not a lawyer at all - but I am a technologist who builds systems that people and institutions punt thorny legal and ethical decisions to, and they use the tech as a black box of risk, where they hope they can't be held accountable to understand the conseqeunces of the implementation.

The point of most cryptography and security features is to use math to represent and symbolically transfer liability and risk between transaction counterparties, where, law also determines a balance or flow of symbolic liability and risk between parties.

The idea of modelling laws as concrete logic is appealing, but it presumes the quality of a law is if it is resistant to individual interests, judgment and interpretation. To me, that sets up a conflict where the best possible law is either, one that obviates the need for a judge or litigation - vs. - being the most refined and featureful tool for people (and judges) align things like morals, principles, ethics, and interests.

The author's example of that inconsistent common law definition where you didn't actually have to live together in a relationship is arguably an artifact of Canadian charter and British common law where individuals do not have inalienable rights because ultimate and total authority rests with the crown. It doesn't have to be logical or consistent, but this is just my layman observation.

If the written law is illogical, a judge interprets it, and gives it back to the government to refine, and the government often just ignores it until there is a new patron to appease by changing it, or if it doesn't give them the result they want, they just update the regulations of the law without a requirement for debate. Automating legal analysis in Canada seems like more of a way to find arbitrages and loops than to provide any general efficiency or benefit.

Is that what this formal methods project is doing, or do they think people will accept being subject to automated legal decisions?

Re:Utterly Unpersuasive: Formal Methods and Law (2019) by Spivakov on Saturday April 23, 2022 @02:14PM (#31136775)
"The point of most cryptography and security features is to use math to represent and symbolically transfer liability and risk between transaction counterparties"

What is the liability here? For example, the company holds different level of liability in a data breach, depending on whether they implement the security correctly - is that what you mean?

Re:Utterly Unpersuasive: Formal Methods and Law (2019) by motohagiography on Saturday April 23, 2022 @02:31PM (#31136964)
Example would be whose keys encrypt and decrypt data realizes legal things like custody and control and the associated responsibilities.

One area that has recently changed is "de-identification," which used to essentially be a cryptographic problem, but now it's a legal definition where you assert a policy about the data encoded in a way and subject to a risk assessment to make that assertion, and then the de-identified data (PII/PHI) now comes with obligations.

Another example was chip/pin payment cards several years ago, where they transferred liability to the merchant for fraud and chargebacks, where previously, magstrip meant the liability for chargebacks largely stayed with the issuer.

If an online banking account gets hacked, banks have less liability than they did previously - as even though you must assert it was they who were robbed and not you, and they still owe you the money you deposited with them, enhanced authN/MFA has allowed them to imply it's somehow your fault that someone stole the money you trusted them to hold for you.

The security of each tech divides the liability between the parties in these cases.