Re: LITTLE BROTHER INSIDE

> C'punks,

> On Tue, 26 Jul 1994, Jim choate wrote:

> > . . .
> > This would of course assume that the police were silly enough to
> > use the disk and such from your machine in your machine. From my 
> > experience w/ Mentor and Erik Blookaxe during Operation Sun Devil this
> > is not very realistic....Also it would only work
> > once. Thereafter they would either examine the equipment in a Farady Cage
> > or else start doing pager rental scans prior to seizure.

Why not just use an encrypted partition. I guess then it is a problem of
not being persuaded to reveal the key. What laws/rights does the user have 
as to revealing the key ? And if the user says "I forget"  what would be 
likely response ? 

How many users would hold tight, from cases I have heard they usually give
in when the stakes are raised.

> I'm not so sure.  Operation Sun Devil was a more sophisticated operation 
> than the average cops run.  Cops, for the most part, are incredibly lazy 
> and stupid.  I think you could count on lots of them not doing it right.

A while back a local BBS system was investigated, it was amazing to find
that the police had little knowledge of the software (MSDOS and OS/2 - Remote
Acess RA and Front Door) and hardware being used. Apparently the sysop had
the system setup so that he could quickly delete the drives FAT and do random
zeroing of the drives. Although it wasn't performed as they weren't even 
familar with hidden (attrib) directories or using non-printable dir names.
Essentially they relied on information from the sysop to carry out the 
investigation.

-- 
+---------------------+--------------------------------------------------+
|  ____       ___     | Justin Lister                 ruf@cs.uow.edu.au  |
| |    \\   /\ __\    |     Center for Computer Security Research        |
| | |) / \_/ / |_     | Dept. Computer Science      voice: 61-42-835-114 |
| |  _ \\   /| _/     | University of Wollongong      fax: 61-42-214-329 |
| |_/ \/ \_/ |_| (tm) |     Computer Security a utopian dream...         |
|                     |  LiNuX - the only justification for using iNTeL  |
+---------------------+--------------------------------------------------+

Why not just use an encrypted partition. I guess then it is a problem of
   not being persuaded to reveal the key. What laws/rights does the user have 
   as to revealing the key ? 

If the court order you to produce something, you have to or be in
comptempt.  The court will not order you to testify against yourself.
The court can make you show up with the electronic storage that holds
your keys, for example, because this is a physical device.  So the
issue hinges upon the question of whether uttering a passphrase which
makes the device usable counts as giving testimony.  

Is explaining how something works (aka giving a passphrase) testimony?
Quite possibly not.  The explanation or passphrase is not
incriminating by itself; it says nothing and claims nothing.

One solution to this is to give the passphrase (or other access
information) to someone who won't give it back to you if you are under
duress, investigation, court order, etc.  One would desire that this
entity be in a jurisdiction other than where an investigation might
happen.

Eric

On Tue, 26 Jul 1994, Eric Hughes wrote:

> Is explaining how something works (aka giving a passphrase) testimony?
> Quite possibly not.  The explanation or passphrase is not
> incriminating by itself; it says nothing and claims nothing.

What if the passphrase was something like "I do not pay income taxes"?
(half-joking, half-serious)

____        Robert A. Hayden       <=> hayden@vorlon.mankato.msus.edu
\  /__          -=-=-=-=-          <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info  <=> I do not necessarily speak for the
   \/   Finger for PGP Public Key  <=> City of Mankato or anyone else, dammit
-=-=-=-=-=-=-=-
(GEEK CODE 2.1) GJ/CM d- H-- s-:++>s-:+ g+ p? au+ a- w++ v* C++(++++) UL++++$ 
		P+>++ L++$ 3- E---- N+++ K+++ W M+ V-- -po+(---)>$ Y++ t+ 5+++
		j R+++$ G- tv+ b+ D+ B--- e+>++(*) u** h* f r-->+++ !n y++**

On Tue, 26 Jul 1994, Robert A. Hayden wrote:

> > Is explaining how something works (aka giving a passphrase) testimony?
> > Quite possibly not.  The explanation or passphrase is not
> > incriminating by itself; it says nothing and claims nothing.
> 
> What if the passphrase was something like "I do not pay income taxes"?
> (half-joking, half-serious)
> 

Apparently the only way you would not get contempt of court is if
it were against the law for you to be in possetion of the password

say for example a friend of yours works for NASA and happens to give you 
the password. you store drug shipment info/kiddy porn (whatever)

and they want it (what they want to do with it after the investigation is
beside the point)

the phrase isn't incriminating, it could be "The judge is a bed-wetter"

what we NEED is a 2 passphrase program,
1 password decrypts your infor for you, the other formats your hard drive
or prinst out a fake diary or something.

the best defense is to say you forgot it, it was some program you didn't 
want your children editing at the time,

then again whats a year in jail for contempt of court compared to 
20-30 (or whatever) years for child pornography

--
Finger yusuf921@raven.csrv.uidaho.edu for PGP public key 2.6ui

"When I was crossing the border into Canada, they asked if I had any
firearms with me.  I said, `Well, what do you need?'"
		-- Steven Wright

What if the passphrase was something like "I do not pay income taxes"?
   (half-joking, half-serious)

Since this comes up frequently, I'll comment.

When, under oath, you utter the words "I do not pay income taxes", you
are less abbreviatedly say "I testify under oath that I do not pay
income taxes".

When, under oath, you tell the judge that the passphrase is "I do not
pay income taxes", the less abbreviated version is "I testify under
oath that the passphrase is 'I do not pay income taxes'."

The second statement is not testimony that you do not pay income
taxes.

This distinction between the performative and the descriptive was used
by one of the video game companies to try to prevent compatible
cartridges from being manufactured.  Part of the protocol required
that the cartridge send back the string "(c) Slimy Video Games, Inc.".
The company then argued an unfair trade practice, claiming that a
compatible cartridge written by another party was asserting a false
designation of origin.

In fact, the sending of the string as part of the protocol is a merely
syntactic use of these characters for purposes of interoperation.  In
the same way that the meaning of a passphrase is immaterial as a
passphrase, so the transmission of the (c) copyright sign is not a
claim of copyright nor a designation of origin.

Eric

C'punks,

On Tue, 26 Jul 1994, Eric Hughes wrote:

> . . .
> When, under oath, you tell the judge that the passphrase is "I do not
> pay income taxes", the less abbreviated version is "I testify under
> oath that the passphrase is 'I do not pay income taxes'."
> 
> The second statement is not testimony that you do not pay income
> taxes.

Just to play Devil's Advocate, here is another twist to this "passphrase
as self-incrimination" thread.  Let us say you have, in fact, committed a
more serious offense about which the government knows nothing.  If your
passphrase not only admitted the crime, but gave information which could
lead to corroboration of the admission, you could arguably withhold the
passphrase. 

As an example, your passphrase could be:

	I shot a cop in the back and buried his body under
	the porch at 123 Main St., anywhere USA.  The gun is
	wrapped in an oily cloth in my mother's attic.

"I decline to answer on the grounds that my passphrase is a statement 
which may tend to incriminate me.  I will only give my passphrase if I am 
given immunity from prosecution for the actions to which it alludes."

Too cute, I know, but who knows, it might work.


 S a n d y

Let us say you have, in fact, committed a
   more serious offense about which the government knows nothing.  If your
   passphrase not only admitted the crime, but gave information which could
   lead to corroboration of the admission, [...]

Well, I'd call that situation stupidity rather than cleverness.

Eric

C'punks,

On Tue, 26 Jul 1994, Eric Hughes wrote:

> . . .
> One solution to this is to give the passphrase (or other access
> information) to someone who won't give it back to you if you are under
> duress, investigation, court order, etc.  One would desire that this
> entity be in a jurisdiction other than where an investigation might
> happen.

And one way to do this that fits in with my original post is via a 
pager-delivered instruction.  Prior to seizure/theft, you would make an 
arrangement with an offshore "escrow agent."  After seizure you would 
send your computer the instruction that says, "encrypt my disk with the 
escrow agents public key."  After that, only the escrow agent could 
decrypt your disk.  Of course, the escrow agent would only do that when 
conditions you had stipulated were in effect.


 S a n d y

Prior to seizure/theft, you would make an 
   arrangement with an offshore "escrow agent."  After seizure you would 
   send your computer the instruction that says, "encrypt my disk with the 
   escrow agents public key."

You don't even need public key.  Just place a secret key in the hands
of your if-duress-no-release agent and put the same key in the right
place in nonvolatile, but erasable, storage inside the computer.  In a
standard PC, there's room for this in the battery-backed configuration
RAM, which has lots of extra space on many newer models.

The use of public key would still require that a session key for a
(fast) symmetric cipher be generated and then destroyed, so you're not
that much better off.  The advantage is that you don't have to destroy
the public key.  Since destruction is pretty easy for information, I
don't consider it much of an advantage.

And, lastly, if you were to use public key, you'd want the agent to
generate a key pair for your use only.  This avoids linkage with other
information.

Eric