News for hackers. Stuff that matters.
Re:Police Claim Encryption Use Is Illegal by rayiner on Thursday October 03, 2013 @09:37AM (#6488757)
EDIT: You have to read the complaint in the last link. It sounds like there were some laptops or something that were "lost" and the owner believed he stole them, and filed a police report. That's what the charges stem from.

http://s3.amazonaws.com/InnocentBeyondAReasonableDoubt/PDF/C...

With regards to the allegations of theft, I'm not sure what the author's point is. He repeatedly says he offered to pay the owner back for the missing items. Should that mean that he can't be charged with theft? If I steal something and get caught, should I just be able to offer to pay and avoid prosecution? He repeatedly says that the missing items amount to at most a civil matter, but stealing stuff from work is not a civil matter.

For the rest of it, the author doesn't have a leg to stand on. Say instead of an encrypted partition we were talking about a safe. I kept a safe in my office, and one day I was summarily fired and escorted out of the building. I promised that there was no business information or property of my employer in that safe, then refused to hand over the combination. Should the employer leave it at that, saying "gee, if he says he didn't put any business property in the safe, I guess I just have to believe him!"

I can understand where the author is coming from (though his writing makes that difficult). The owner is clearly being a huge asshole. But the author is being naive to think that there must be something "fishy" going on. Unfortunately for him, he's on the wrong end of this story. It's so common for disgruntled employees to steal company property or damage company property that nobody is going to give him the benefit of the doubt except the jury, who is legally required to. The author repeatedly mentions the standard for conviction (beyond a reasonable doubt). However, that's not the standard for prosecution, which is closer to "more likely than not."

Re:Police Claim Encryption Use Is Illegal by shutupalready on Thursday October 03, 2013 @10:07AM (#6488963)
> The author doesn't have a leg to stand on. Say,...I kept a safe in my office

The guy writes: "I was an independent contractor. No employer-employee relationship existed. Federal labor laws afforded me the right to choose when to work, where to work, how to work and what work I was to produce. There were no other work-for-hire contracts or specific performance contracts signed and I did not sign any NDA."

To carry forward with your "safe" analogy: Suppose a plumber came to your house. When he leaves, you demand to search the toolbox he brought to your house. Who's in the right here?

Re:Police Claim Encryption Use Is Illegal by outworlder on Thursday October 03, 2013 @10:13AM (#6488999)
My understanding is that the "toolbox" was the client's, not his.
Re:Police Claim Encryption Use Is Illegal by R_Edward on Thursday October 03, 2013 @10:15AM (#6489014)
You cannot just buy your way out of a theft charge. If that were the case, can you imagine how thefts would skyrocket? Steal as much as you want, and when someone catches you, give back the specific item(s) they're missing and keep the rest!

Of course, a private accusation of theft is not an official charge of theft, or a prosecution, or a conviction for it. If a private individual comes to you and accuses you of taking something that belongs to them, and you return it, that ought to be the end of it, unless the victim is really honked off and insists on involving the police. Once the Boys in Blue are involved, it becomes much more difficult to resolve the situation extra-judicially.

Re:Police Claim Encryption Use Is Illegal by dpcx on Thursday October 03, 2013 @09:47AM (#6488821)
He said several times that he would unlock the encryption. He also said that he didn't feel right giving the password to anyone.
Re:Police Claim Encryption Use Is Illegal by rayiner on Thursday October 03, 2013 @09:57AM (#6488891)
Why should the owner trust him that he's actually doing what he says he's doing?
Re:Police Claim Encryption Use Is Illegal by outworlder on Thursday October 03, 2013 @10:15AM (#6489013)
Because he offered to do it at the police department? I doubt that he would be left alone with the computer.
Re:Police Claim Encryption Use Is Illegal by darkarmani on Thursday October 03, 2013 @10:55AM (#6489304)
You mean watching him type in the password?
Re:Police Claim Encryption Use Is Illegal by yk on Thursday October 03, 2013 @11:27AM (#6489558)
> If I steal something and get caught, should I just be able to offer to pay and avoid prosecution?

What we know is, that the owner claims there was a theft and the (lets call him) contractor offered to reimburse the owner. This does not mean that there was a theft. If I should speculate, it is rather likely that the contractor did loose a laptop, and at this point the relationship was already poisonous enough that the owner either assumes that there was a theft or tries to exploit the missing laptop.

> For the rest of it, the author doesn't have a leg to stand on. [...]

I think this strongly depends (IANAL) and the contractor should get the benefit of doubt. So for example if his .ssh/ directory is on that partition, then he may or may not have ample reason to keep the contents ( e.g. a private key for one of his servers) secret.

Re:Police Claim Encryption Use Is Illegal by furyg3 on Thursday October 03, 2013 @09:34AM (#6488746)
His timeline and story are all here: http://www.innocentbeyondareasonabledoubt.com/

Lesson: Do not ever cooperate with the police.

Bo should have just let the original issue (I'm not even sure what that issue was) between he and his employer go to a civil court.

Re:Police Claim Encryption Use Is Illegal by Toenex on Thursday October 03, 2013 @09:43AM (#6488797)
Lesson: Do not ever cooperate with the police.

Seriously? So if I get mugged in the street or if I have my home burgled I should do what?

Re:Police Claim Encryption Use Is Illegal by bcoates on Thursday October 03, 2013 @09:47AM (#6488817)
Call your insurance company, if you're insured, then get on with your life.

The cops don't have a time machine and they don't give a shit about you getting mugged or your stuff getting stolen. If you work hard enough you might get a police report out of them for insurance purposes.

I don't have a good text source lying around but here's a law professor and a cop explaining the downside: https://www.youtube.com/watch?v=6wXkI4t7nuc

Re:Police Claim Encryption Use Is Illegal by elliottcarlson on Thursday October 03, 2013 @10:16AM (#6489021)
Not all cops let things slide. Some see it as a job, some get a power trip, and others take pride in their work.

I've posted this before on HN, but will quickly cover it again; A few years ago, my wife was at school and (completely her own fault) left her purse in the class during lunch (this is a medical career school and the class had about 8 students). That night we received a call from Chase asking about a string of purchase attempts using one of her cards - which she then realized was missing. Based on the list of places the card was used, we went to the stores the following day explaining what happened. Once we had done the leg work, confirmed that they would have video surveillance during the time the card was used, we called the police. The officers that showed up went to great lengths to file the report, work with GameStop, Target and Stop&Shop security personnel to not only get us to identify the person, but get video evidence of the crimes at each location. In the end, the classmate who stole the card was prosecuted and served jail time in two separate counties as well as payment of damages (small, but still) for the attempted use of the card which got her nothing in the end. Coincidently, the detective on the case also saw that the girls mom had a warrant out for her arrest so they picked her up as well.

The experience was very positive from our side of things - and perhaps it's not the common experience people hear about, but these officers were very happy to help. As a side note, the county that these officers were in was not a small, nor "safe" county and it wasn't a matter of them not having anything else to do at the time.

All that being said, the original advice of not talking, and knowing your rights should definitely be adhered to if you are on the other side of things. The way everything was used to aide us, can also be used against you. Not all police will treat you the same.

Re:Police Claim Encryption Use Is Illegal by bougiefever on Thursday October 03, 2013 @10:37AM (#6489164)
This is a good example of how people should use police services. They were and prepared, and they did as much of the legwork as they could. The advice to stay away from the police and to not talk to them when they are soliciting you is also good advice, but maybe not when taken to the extreme. Imagine if the shop owners refused to cooperate? It would have been much harder to solve this crime.

There are some guidelines that I think can help. If you get stopped for a traffic stop and the cop says he wants to take a quick look through your car, you should (respectfully) decline. That can lead to nothing good for you. If you think you might be suspected of a crime (right or wrong), or you don't know why the police want to talk to you, do not go and meet with them. If you get arrested, get a lawyer and let him/her deal with talking to the police. You can talk to the judge if it comes to that.

If they explain that they are investigating a crime and you have some information or evidence they need, go ahead and help them if you are not a target.

Just remember, the police are not your friend. They do not care about your life. They will lie to you and manipulate you if it suits their purpose. However, they do in fact serve an important function, that you may need them someday. Use them for their intended purpose. The system is certainly imperfect, but does work much of the time. I believe the trend towards police wearing body cameras during every interaction can only lead to good things for everyone.

Re:Police Claim Encryption Use Is Illegal by rayiner on Thursday October 03, 2013 @03:26PM (#6491304)
I've also used this example before. When we lived in Bangladesh, we had a van full of robbers try to break down our gate. The cops took a long time to get there, but they drove away the robbers.

The only thing worse than cops is no cops.

Re:Police Claim Encryption Use Is Illegal by Amadou on Thursday October 03, 2013 @10:39AM (#6489187)
The experience was very positive from our side of things

Your experience is almost certainly the common experience for people in your socio-economic group. The common worst case being they do let it slide and you are just left with wasted effort on your part.

The problem is that you have no way of knowing ahead of time if you are going to get an outlier -- a cop who decides there is something hinky about you and focuses on that rather than whatever reason you solicited their help for. It is absolutely a rare event (somewhat less rare for other groups, but still rare). The problem is that the consequences of having one of those rare events happen to you can be life-ruining. It is a very real case of one bad apple spoiling the bunch.

In your example, you had nothing to gain from the culprit's arrest and prosecution. The chance of you ending up on the wrong side of the law was quite small, but not zero. Perhaps the purse was recovered and they found a joint in it - even if the drugs didn't belong to your wife, you risk becoming the target of an investigation.

Given that balance of low-chance, high-consequence risk with essentially zero upside it would make sense for most people in that situation to avoid it completely.

Re:Police Claim Encryption Use Is Illegal by knowaveragejoe on Thursday October 03, 2013 @09:46AM (#6488813)
I think it would be more appropriately phrased as "do not ever cooperate with the police if it is unsolicited interaction".
Re:Police Claim Encryption Use Is Illegal by Udo on Thursday October 03, 2013 @10:17AM (#6489022)
You shouldn't solicit interaction with the police either, unless it's an absolute emergency life-or-death situation. In all other cases, the best outcome of an interaction with the police is that nothing happens. There is a misconception that they're on your side as long as you've done nothing wrong, or as long as you have a reasonable complaint, but they are simply not.

Their job is to get people in front of a judge, to make them pay fines, or to get them into prison. All things being equal, they'll be working with the closest target they can see and that's you if you solicit them. They basically behave like predators.

Re:Police Claim Encryption Use Is Illegal by lotsofcows on Thursday October 03, 2013 @10:52AM (#6489281)
Hmmm, how bizarre. When we had trouble with a contractor, the police knocked on her door and told her a complaint had been filed. Nothing more was required to stop the trouble. When my kid was ill in the car and I stopped (illegally) on the hard shoulder, the police car that investigated pulled back a bit with it's lights flashing until we could continue. My kids have set in police cars many times when they've been monitoring events. I've worked with the police a number of time when organising events.

Where do you live? I want to make sure I never visit there.

Re:Police Claim Encryption Use Is Illegal by alan_cx on Thursday October 03, 2013 @11:32AM (#6489609)
Yes. Well, ish.

At most, do the minimal reporting you have to so. The problem is, as a human you might innocently give the officer some cause to suspect you in some way, or in some way mitigate the crime against you. I know people who have felt more anger after the police turn up to do their thing than they did on discovering the crime.

I would only involve the police in something I felt was very serious, which had to be solved, and could not be solved any other reasonable way. My definition of something very serious? Don't know till it happens, and frankly I'm sure we all have our own ideas of limits.

Burglary wise, don't know about other countries, but here in the UK the only real reason to report a normal burglary is to get a crime number for the insurance company. Mugging is pretty much the same, assuming you have something stolen which is insured. And luckily that can be very minimal, Im think, cant be sure, you can report crime online and get an instant crime number for insurance purposes. I think it probably only worth it is people get physically hurt or something vital is stolen and can't be replaced. Even then...

Re:Police Claim Encryption Use Is Illegal by mcv on Thursday October 03, 2013 @10:29AM (#6489116)
If you need them, by all means, talk to them. But if they need you, get a lawyer first.
Re:Police Claim Encryption Use Is Illegal by GFischer on Thursday October 03, 2013 @04:27PM (#6491786)
It's not the U.S., but I was robbed twice in the last few months.

I lived at the most populous neighbourhood in my city, and so I reported the theft to the police station, they made me enumerate my belongings and gave me some papers stating what I had lost.

A few weeks later, I called to inquire if some advance had been made, and the lady told me "no, we haven't recovered anything"... but I hadn't given her my case number ! So they hadn't recovered anything for anyone.. in a 100.000 people neighbourhood...

At least in my country, if there's no violence or some important reason to go after the criminal, police won't pursue. They don't care much about material losses (they do have a decent track record aprehending murderers and such).

Re:Police Claim Encryption Use Is Illegal by Spoom on Thursday October 03, 2013 @09:29AM (#6488718)
The police are allowed to lie. That's why you don't take legal advice from them.
Re:Police Claim Encryption Use Is Illegal by sokoloff on Thursday October 03, 2013 @10:32AM (#6489130)
The police aren't attorneys that you are paying for.

THAT is why you don't take legal advice from them.

Re:Police Claim Encryption Use Is Illegal by LanceH on Thursday October 03, 2013 @11:20AM (#6489499)
Yes, always hire your own professional liar first.
Re:Police Claim Encryption Use Is Illegal by MayankGoyal on Friday October 04, 2013 @12:23AM (#6493699)
Right. Because "Lawyer" is synonymous to "Liar" and the justice system totally isn't based on provable facts, but how well you can lie.
Re:Police Claim Encryption Use Is Illegal by rmrfrmrf on Thursday October 03, 2013 @10:38AM (#6489179)
Something is not right about this story. I can't put my finger on it, but the holes in Bo's story make me suspicious. What items were lost originally? What were the circumstances surrounding the lost items? Why wasn't Bo fired immediately after these items were reported missing? Why is Bo offering to pay for any lost items, and why does he seem so eager to do so?

Then, as it pertains to the laptop, what the FRICK is Bo doing installing single user pre-boot authentication on a work computer? That is totally out of line, and I wouldn't blame the employer for feeling like his computer was being held hostage by an ex-contractor.

I could see the theft charge in that case. If someone installed password-protected full disk encryption on my computer and refused to give me the password, yes, nothing was physically "stolen", but the fact that I'm being denied access to my own data is more-or-less equivalent.

The fact that Bo then cuts a check to a detective again makes no sense to me. Why are you paying off law enforcement instead of going through the judicial system? Don't forget, going to court is also there to protect you.

Re:Police Claim Encryption Use Is Illegal by justanother on Thursday October 03, 2013 @09:13AM (#6488624)
The website isn't exactly presented in a linear fashion, but I gather the issue is the subject's use of Truecrypt to contain his personal files, whereas on a company-owned computer, all data therein is company property.

This certainly seems like it should be a civil matter, not something to involve the guys with guns and blue suits. But more to the point, $21.50 an hour for a 1099 job for a huge bag-of-dicks of a boss who pirates all his desktop software? Is that BSA hotline still around, or do they even care about small fries?

Re:Police Claim Encryption Use Is Illegal by tomp on Thursday October 03, 2013 @09:18AM (#6488654)
> whereas on a company-owned computer, all data therein is company property.

Are you sure? AFAIK, without signing any contracts, all work I produced is mine, regardless of where it resides. By inference, is all data in my computer mine as well?

Re:Police Claim Encryption Use Is Illegal by rayiner on Thursday October 03, 2013 @09:26AM (#6488703)
Work created within the scope of your employment automatically belongs to the company: https://news.ycombinator.com/reply?id=6488654&whence=item%3f....
Re:Police Claim Encryption Use Is Illegal by delinka on Thursday October 03, 2013 @09:53AM (#6488866)
"Employment" yes. But how about as an outside contractor and not an employee. Unless you, the business hiring the contractor, specify that the contractor is performing a work for hire and that all intellectual property rights associated with said work shall be transferred to you, the copyright law says the creator of the work holds the copyright on the work. Under the law, and with an agreement to receive payment but without stipulations regarding ownership, I'd say it's fair to assume you (again, the one hiring the contractor) are obtaining a license to the work, but not to assume that you will own the work.
Re:Police Claim Encryption Use Is Illegal by rayiner on Thursday October 03, 2013 @09:59AM (#6488905)
Right, if you're a contractor it doesn't automatically belong to your employer. I think the issue here is an evidentiary problem: we have nothing other than the author's word that nothing in the encrypted partition belongs to the business.
Re:Police Claim Encryption Use Is Illegal by Nimi on Thursday October 03, 2013 @10:47AM (#6489238)
Why is that a problem? Wouldn't the burden of proof fall on the employer to give evidence that something in the encrypted partition belongs to the business?
Re:Police Claim Encryption Use Is Illegal by rayiner on Thursday October 03, 2013 @10:58AM (#6489331)
First, burden of proof is not a concept that's relevant before criminal charges or a civil complaint have been filed. You don't need to prove that there is something in the encrypted partition to bring charges. Circumstantial evidence is enough.

Second, in an actual trial the author would have to unlock the encrypted partition. There is no right of privacy against a court. If there is disagreement about what's in a box, people aren't going to sit around arguing about burdens of proof and burdens of production. The court is going to order the box be opened and the issue resolved definitively.

Re:Police Claim Encryption Use Is Illegal by lightbritefight on Thursday October 03, 2013 @11:22AM (#6489520)
Therein is the current question. This is not a box. It is a metaphorical box, that can only be opened by information. This information is only contained in the head of the defendant. Say there is something incriminating in the box. The 5th amendment protects you from being compelled to self incriminate. So, the court could not legally order the box opened, without providing immunity to the defendant.

Your reasoning and my reasoning are the current modes of thought about encryption in a legal context. Neither has been proved correct in that context.

Re:Police Claim Encryption Use Is Illegal by rayiner on Thursday October 03, 2013 @11:25AM (#6489539)
Right, 5th amendment is an issue on the criminal side (not the civil side), and the case law is mixed on whether giving up a decryption password is more like giving up a key to a box (which the court can order you to do), or giving testimony protected by the 5th.
Re:Police Claim Encryption Use Is Illegal by Nimi on Thursday October 03, 2013 @01:09PM (#6490336)
So, if I'm getting this straight: if I'm an employer who's curious to know what's inside an encrypted partition on one of my contractors' laptops, I can simply call the police, say I suspect there's company data there, the police and prosecution don't need any more evidence to bring this to trial, and then the judge will likely order said contractor to decrypt the partition? Then if it's just his personal porn collection, everyone shrugs and life goes on?
Re:Police Claim Encryption Use Is Illegal by rayiner on Thursday October 03, 2013 @03:23PM (#6491289)
You're throwing out all of the context. If you call the police out of the blue like that, they'll ignore you. If you call them with respect to an employee who was fired and "lost" certain property, that's enough to at least investigate.
Re:Police Claim Encryption Use Is Illegal by Nimi on Thursday October 03, 2013 @03:37PM (#6491391)
I see. Thanks for the clarification.

I still find it troubling that there's no burden of proof to violating someone's privacy before the court (there also doesn't seem to be any guarantee that decrypting the partition before the court would be done behind closed doors). But I guess there are many privacy issues not currently well addressed by U.S. laws...

Re:Police Claim Encryption Use Is Illegal by jimktrains2 on Thursday October 03, 2013 @09:20AM (#6488667)
When you start with a company you sign over the rights to the work you do with their time, equipment, and resources (most of the time, and exact conditions vary, but that's a very common LCD)
Re:Police Claim Encryption Use Is Illegal by tehwalrus on Thursday October 03, 2013 @09:25AM (#6488699)
He says in the linked website[1] that he signed no such agreement.

[1] http://www.innocentbeyondareasonabledoubt.com/

Re:Police Claim Encryption Use Is Illegal by jimktrains2 on Thursday October 03, 2013 @11:41AM (#6489699)
I was under the impression that GP was talking about the general case. Specifics are always, well, specific to that case:)
Re:Police Claim Encryption Use Is Illegal by stuaxo on Thursday October 03, 2013 @09:49AM (#6488832)
The letter of complaint is a lot easier to digest than going through the site

http://s3.amazonaws.com/InnocentBeyondAReasonableDoubt/PDF/C...

Re:Police Claim Encryption Use Is Illegal by grannyg00se on Thursday October 03, 2013 @09:50AM (#6488839)
Putting personal files on an employer's computer is a bad idea. Why do such a thing?
Re:Police Claim Encryption Use Is Illegal by jlebrech on Thursday October 03, 2013 @10:39AM (#6489189)
Isn't an exchange of funds admission of guilt?
Re:Police Claim Encryption Use Is Illegal by R_Edward on Thursday October 03, 2013 @10:48AM (#6489243)
No. In a civil case, often a defendant will compare the cost to defend themselves to the cost of settling, and will opt for the latter, including in the settlement documentation that the settlement is not an admission of wrongdoing.
Re:Police Claim Encryption Use Is Illegal by JimmaDaRustla on Thursday October 03, 2013 @08:57AM (#6488533)
Silly Police!

Next lock boxes and safes!

Re:Police Claim Encryption Use Is Illegal by fexl on Thursday October 03, 2013 @09:16AM (#6488644)
They do hire some ignorant yahoos from time to time.
Re:Police Claim Encryption Use Is Illegal by wslh on Thursday October 03, 2013 @09:46AM (#6488811)
We are moving back to square one.