POISON PILL

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  SANDY SANDFORT               Reply to:  ssandfort@attmail.com
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Punksters,

Here is probably one of those dumb questions we non-technical
types ask from time to time on this list.  Please indulge me
though, in case there is something to it.

In today's America, we live under the constant threat of police
seizure of our computer equipment and other assets.  Of course,
we can encrypt the information our files, but this is, at best, a
passive solution.  Are there any positive actions we can take?

POISON PILL--What, if anything, can be done to booby-trap a
computer?  Once the cops have a machine, one would expect that
they will paw through everything in it.  In addition, they will
probably use the stolen computer for their own data processing
needs.  What could be done have the computer screw up the cop's
data days, weeks or months after the seizure?  Of course, I would
never do such a thing myself, nor would I advise anyone else to
do so.  I do, however, have a passing academic interest in the
subject.  Same for you folks too, right?

 S a n d y

>>>>>>    Please send e-mail to:  ssandfort@attmail.com    <<<<<<
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sandy says:
> POISON PILL--What, if anything, can be done to booby-trap a
> computer?  Once the cops have a machine, one would expect that
> they will paw through everything in it.  In addition, they will
> probably use the stolen computer for their own data processing
> needs.  What could be done have the computer screw up the cop's
> data days, weeks or months after the seizure?  Of course, I would
> never do such a thing myself, nor would I advise anyone else to
> do so.

Why wouldn't you? Its your machine, so what you do to it is perfectly
legal. You are under no obligation to make your equipment suitable for
people who wish to steal it.

Nothing you can do in software will actually work, because people can
always boot off a fresh disk and start from scratch.

I suggest that the best way, which is not easy, is to alter the roms
on the disk controllers so they will only work properly with a special
version of the operating system. Then, run the special version of the
operating system, which should require that you do something
periodically or it will self destruct. Even if they reformat the disk,
they still won't have the proper information to feed the controller so
that it doesn't do unfortunate things.

Perry

> From: "Perry E. Metzger" <pmetzger@lehman.com>
> 
> Sandy says:
> > POISON PILL--What, if anything, can be done to booby-trap a
> > computer?  Once the cops have a machine, one would expect that
> > they will paw through everything in it. [...]
> 
> Why wouldn't you? Its your machine, so what you do to it is perfectly
> legal. You are under no obligation to make your equipment suitable for
> people who wish to steal it.

Well, you can do this, but you are taking your liberty into your own hands
by doing so.  Once your computer is siezed as part of a valid search
warrant it is no longer "your computer" but is evidence in an ongoing
investigation.  If you were to booby trap your system so that there was
actual descruction of components or data you would do two things:

	-1 Really, really piss off those investigating you.  Nothing like
	   giving people who can make your life a living hell a reason to
	   want to make your life hell...

	-2 Opening yourself up for destruction of evidence and obstruction
	   of justice charges in addition to whatever else they may have
	   had on you.

If you want to protect your data is such situations you need to set up your
system so that even if they have the data it does them nothing (e.g.
encryptiong), not so that it will destroy the data.


jim

In reply to (Sandy):

| POISON PILL--What, if anything, can be done to booby-trap a
| computer?  Once the cops have a machine, one would expect that
| they will paw through everything in it.  In addition, they will
| probably use the stolen computer for their own data processing
| needs.  What could be done have the computer screw up the cop's
| data days, weeks or months after the seizure?  Of course, I would
| never do such a thing myself, nor would I advise anyone else to
| do so.  I do, however, have a passing academic interest in the
| subject.  Same for you folks too, right?

How about this:

Encrypted disk controller that uses 3DES (at a minimum) where the keys
are modified by a low power localised RF transmission. Quite simply one
could use a DDS receiver which looks at any one of X locations for a 
signal strength above some threshold (ie, say 2^16 frequency slots and
only 3 * 56 of these are transmitting), this provides the XOR for the
DES key. In fact, one could almost patch this into an existing DES
controller given some assumptions about the onboard logic.

Your transmitter should be like somewhere else in your flat, preferably
hidden. Of course, once the feds get your computer and it doesn't work,
they will ask you why, and you need some way here to keep them off.

Actually, another idea, how about if the DES key(s) for your controller
are hardwired onto it, an RF detector monitors a carrier on some specific
frequency, if the carrier is not present at bootup, you could leak a high
voltage into the 'key holder' and blow all the connected links.

Once this is gone, there is no way to get back the data, and the feds
can't force you, because 1) you can show how the key was random in the 
first place 2) you can show how the device blew it all (and that there was
no return), and your justification can be for 'data security' reasons
(ie, if theives get your system, they couldn't have extracted anything).

They could probably example the chip substrate itself and see what was
blown recently, so this needs work I guess. Another problem is that
the above assumes they don't examine the disk, realise it is encrypted,
realise the controller is custom, and then work back to figure out
what is going on, and then question you before they do anything.

Disclaimer: the above represents unsubstantiated theorising.

Matthew.

ps; when the feds take your computer (at least here in Australia) they
    take lots of nice pictures of it and take all the cables and 
    stuff. Of course, half of them don't know the fucking difference
    between msdos and unix.

-- 
Matthew Gream, M.Gream@uts.edu.au. "... encryption is the ultimate means of
Consent Technologies, 02-821-2043.  protection against an Orwellian state."