appearances matter move to switzerland [LWN.net]

appearances matter move to switzerland

Posted Feb 4, 2025 2:57 UTC (Tue) by linuxrocks123 (subscriber, #34648)
In reply to: appearances matter move to switzerland by NYKevin
Parent article: The Linux Foundation on global regulations and sanctions

Well, let's see how many times experienced software engineers have successfully hacked the legal system using that attitude. With just a little thought, here's what I've got:
- Freeing PGP by printing it out as a book
- Freeing the Internet by developing Tor
- Freeing video playback by first putting DeCSS on T-Shirts and then developing libdvdcss which, due to the MPAA's fatigue from unsuccessfully trying to stamp out DeCSS, was never attacked.
- Ensuring that the Fifth Amendment protects disk encryption keys by developing TrueCrypt hidden volumes
- Freeing financial transactions by developing BitCoin (I don't like that they did this, but they did.)

I'd say we have a pretty good track record, wouldn't you? Perhaps the condescension is unwarranted?

to post comments

appearances matter move to switzerland

Posted Feb 4, 2025 9:22 UTC (Tue) by bluca (subscriber, #118303) [Link] (13 responses)

Just do it then. Move to the US, and start a business or project or whatever taking contributions, requrests and whatnot with sanctioned entities, and provide them services and whatnot. Do it yourself, and show everyone just how wrong they are.

appearances matter move to switzerland

Posted Feb 5, 2025 23:17 UTC (Wed) by linuxrocks123 (subscriber, #34648) [Link] (12 responses)

I don't have to, and I am in the US. Millions of US persons, every day, interact with other people on GitHub issues and PRs, and all they know about those people is a string of letters like "technobeaver7914".

Is "technobeaver7914" on the SDN list? They don't know. Neither does GitHub.

If people actually acted like they could be fined megabucks if they interacted with technobeaver7914 on GitHub, would that basically destroy GitHub as a platform for engaging in protected speech about software? Yes? Okay, there you go then.

And it's not just software. Take a look at https://lwn.net/Articles/1007807/ where franz talks about advice he received to a random guy named "linuxrocks123". franz has no idea who I am, and he's exporting expert advice which he received from a legal consultation to me. For all he knows, linuxrocks123 is actually some Iranian on the SDN list. I'm _NOT_, but he doesn't know that. If I were, would franz be fined megabucks?

Again, there you go. A "yes" answer to that question would completely eviscerate my right to anonymous speech and franz's right to speak at all. It would make everyone in the US too terrified to participate in GitHub, too terrified to help people on reddit.com/r/tax, too terrified to answer questions on StackOverflow, and too terrified to participate in any other online forums of any kind focused on any topic, technical or nontechnical, whether software, cars, crochet, boating, whatever.

A "yes" answer to that question would, in short, entirely destroy the Internet as a platform for speech for all US persons. Now, knowing _THAT_, do you _REALLY_ think the US court system would let the answer to that question be "yes"?

appearances matter move to switzerland

Posted Feb 5, 2025 23:41 UTC (Wed) by bluca (subscriber, #118303) [Link] (7 responses)

Except of course the people removed from the kernel _were_ on the sanctions list, as they were employed by sanctioned companies, so nothing that you just wrote has anything to do with the matter at hand. Given you are in the US, then go ahead and set up a project and provide services to Baikal Electronics, which is on the sanctions list and is one of the affected companies, and let us know how well that goes for you.

appearances matter move to switzerland

Posted Feb 6, 2025 1:54 UTC (Thu) by linuxrocks123 (subscriber, #34648) [Link] (5 responses)

If you know you're collaborating with someone on the list, then you might have a problem. That is the situation the Linux Foundation was in. But the article makes the much stronger claim that you might have a problem if you don't verify that every single person you talk to on the Internet is not on the list, or even if you do verify that and are defrauded by a sanctioned entity.

That claim is alarmist and ridiculous.

appearances matter move to switzerland

Posted Feb 6, 2025 2:09 UTC (Thu) by linuxrocks123 (subscriber, #34648) [Link]

Actually, you're probably fine knowingly collaborating with a SDN as long as you're not trying to sell anything. But I guess the Linux Foundation didn't want to fight about that since they are kind of commercial.

If you're knowingly collaborating with a _LISTED_ _TERRORIST_, _THEN_ you are probably in trouble.

appearances matter move to switzerland

Posted Feb 6, 2025 10:14 UTC (Thu) by bluca (subscriber, #118303) [Link] (1 responses)

No, it doesn't. It's about sanctions and sanctioned entities. Once again, if you think it's "alarmist and ridicolous", just go provide services to Baikal Electronics or their employees and pretend you didn't know they are sanctioned, and let us know how that works out for you.

appearances matter move to switzerland

Posted Feb 7, 2025 0:50 UTC (Fri) by linuxrocks123 (subscriber, #34648) [Link]

No, how about you close your GitHub account and not talk to anyone without having proof of their real-world identity and checking that identity against the SDN list?

appearances matter move to switzerland

Posted Feb 6, 2025 11:48 UTC (Thu) by lunaryorn (guest, #111088) [Link] (1 responses)

The article does not claim it's about "every single person you talk to on the Internet".

The article is about a a very specific kind of talk, namely collaboration on and contribution to an open source project with significant impact. And from that angle the claim in the article is neither alarmist nor ridiculous but describes the very reality of everyone working in areas routinely impacted by US export control laws and sanctions.

That's just a fact, whether you like it or not, and from the point of view of someone who's working in such an area I sorry to have to admit that I find it increasingly hard to take your somewhat unsubstantiated comments serious.

appearances matter move to switzerland

Posted Feb 7, 2025 0:58 UTC (Fri) by linuxrocks123 (subscriber, #34648) [Link]

That's okay. You can just never send a patch over email or collaborate on a GitHub pull request without first knowing your counterparty's real name and meeting with them in person to check their passport and verify they're not actually a SDN pretending to be someone else.

You can certainly believe that the law requires that, and you won't get in trouble for believing that. You won't be _DOING_ much, but you won't get in trouble.

appearances matter move to switzerland

Posted Feb 6, 2025 11:29 UTC (Thu) by paulj (subscriber, #341) [Link]

I thought it was that (in at least some cases) they /may/ at one time have worked for a sanctioned entity, and (in at least some cases) they were simply removed on that basis - but without specific and current knowledge of their employment status.

appearances matter move to switzerland

Posted Feb 6, 2025 11:39 UTC (Thu) by lunaryorn (guest, #111088) [Link] (3 responses)

Github itself implements sanctions, see https://docs.github.com/en/site-policy/other-site-policie...

Specifically, it explicitly states to restrict availability to sanctioned entities and to use various sources to determine whether a user or organisation could possibly be subject to sanctions. Github generally knows a lot more than just the user name (such as mail addresses, payment history, commit, push, and interaction history, remote IP addresses, etc), and it does not need to come to a definite conclusion; it can already limit accounts on mere suspicion and require proof of identification (such as a valid credit card). Github also summarily blocks entire geographic regions. It used to block all of Iran, until it obtained a special license from the US government to restore services to Iran.

As such, Github exists as some kind of a walled garden where sanctioned entities are not present, and within with users can reasonably assume that other users legitimate or they'd not be on the platform in the first place. But the Linux Foundation runs its own infrastructure, and thus needs to care for this itself.

All of what you're describing in your comment literally exists in the more or less the very form; you were just lucky enough not to notice so far, because frankly, reddit discussions are not usually not a place where serious business is done, and neither are LWN comments.

But organisations doing serious business, especially in sensitive fields, will likely do their own checks for significant Github contributions or prolonged collaboration with external Github users. I know that my organisation would. It has a whole policy document about doing open source which includes regulations for accepting significant contributions which include concerns of export control and sanctions, and it's not even a US-based organisation.

And I'd like to remind you that under many jurisdiction export control and sanctions laws come with specific personal liability. Contrary to, say, financial regulations or product liability or customer safety you cannot routinely disclaim personal responsibility for violations done on behalf of your employer. Breaching sanctions or export control regulations is routinely a personal criminal offence, for which you're immediately liable, even if you did so on behalf of your employer, which is why no one is particularly keen to test the limits of these regulations in court.

appearances matter move to switzerland

Posted Feb 6, 2025 12:06 UTC (Thu) by intelfx (subscriber, #130118) [Link] (2 responses)

> [...] and it does not need to come to a definite conclusion; it can already limit accounts on mere suspicion and require proof of identification (such as a valid credit card). Github also summarily blocks entire geographic regions.

Is that supposed to be a good thing?

> As such, Github exists as some kind of a walled garden where sanctioned entities are not present, and within with users can reasonably assume that other users legitimate or they'd not be on the platform in the first place.

GitHub does this to protect its own ass, not the one of other users. If what you (and others in this thread) say about strict personal liability for breach of sanctions is true, then it's very obvious that you cannot rely on GitHub's "walled gardenness" to make any decisions in this space, so you didn't really refute what GP was saying.

GitHub and sanctions

Posted Feb 6, 2025 12:52 UTC (Thu) by farnz (subscriber, #17727) [Link]

Using GitHub provides you with a degree of protection, AIUI. You're safe if you genuinely believed that you weren't breaching sanctions - and you could argue that you believed that GitHub would be applying sanctions, therefore you assumed that you were not breaching sanctions by using GitHub.

Now, once the authorities have notified you, you'd have to stop working with sanctioned entities - but as a practical matter, the authorities get much more bang for their buck if they get the sanctioned entities blocked from all of GitHub than if they simply get your project to stop interacting with them.

appearances matter move to switzerland

Posted Feb 6, 2025 14:44 UTC (Thu) by lunaryorn (guest, #111088) [Link]

I didn't say anything about whether this was good or bad. I do have an opinion about the whole export control and sanctions thing, which - reading between the lines - probably isn't that far from yours, but I don't think my opinion is relevant. It is what it is, whether I like it or not.

Github certainly protects itself first and foremost, but in doing so, also provides reasonable protection to most individuals who casually contribute to open source projects. I for my part am quite sure that my personal activity on Github does not bear much of a risk, simply because none of my projects have any particular impact or reach, so I'm effectively off the grid: In the exceedingly unlikely case a sanctioned top terrorist used Github to contribute to one of my repositories there's a long long chain of people to be in trouble before anyone would come after me.

However, that's not the case for my employer, which would be held to a much much higher standard. If said top terrorist contributed to one of my employer's repositories my employer would definitely be in trouble, and if the repository was under my responsibility, so would I, unless I could meticulously prove that I followed my employer's regulations for export control and open source work to the very letter, and thus did all I could possibly to do avoid this situation. And as said in my previous comment, my employer does maintain quite extensive regulations around all this.

appearances matter move to switzerland

Posted Feb 4, 2025 14:17 UTC (Tue) by nix (subscriber, #2304) [Link]

Of course the guy who quite possibly developed TrueCrypt (as in, he's basically the only name I've ever heard tied to it) seems to have gone on to have, ah, interesting ideas about how to hack the legal system and make a living, culminating in what seems to be quite a lot of murders, and is as a result now quite a bit less free: https://en.wikipedia.org/wiki/Paul_Le_Roux

I think I'd rather try to hack the system in ways that do not involve harming people. (I expect everyone here feels the same way.)

appearances matter move to switzerland

Posted Feb 4, 2025 22:14 UTC (Tue) by NYKevin (subscriber, #129325) [Link] (10 responses)

I'll give you PGP, but most of the others are not actually examples of the pattern I was describing:

* Tor is solving a technical problem, not a legal problem. If you get caught using it in a jurisdiction that bans it, you get penalized.
* DRM has always been doomed from the start at a technical level, but section 1201 is still regularly used against random FOSS projects that do things big companies don't like (most recently the Yuzu emulator). The programmers did not win the war, they merely won one relatively inconsequential battle.
* I don't know of any examples of TrueCrypt hidden volumes actually being litigated w.r.t. the Fifth Amendment. Frankly, the whole thing has always struck me as ridiculous. First of all, any drive with a hidden volume will appear to have a large, unallocated space filled with random noise. Then, the particulars of the case may provide circumstantial evidence that you stored specific data somewhere on the drive. When those factors are combined with expert testimony about how TrueCrypt works, a jury could plausibly decide that a hidden volume exists beyond a reasonable doubt (see [1] for what juries are told about the meaning of "reasonable doubt," especially this line: "It is not required that the government prove guilt beyond all possible doubt.").
* Sanctions are applicable to BTC. It is sometimes difficult to apply them in practice, but transacting with a sanctioned entity in BTC is just as illegal as transacting with them in any fiat currency. The goal of sanctions is not necessarily to completely eliminate transactions involving sanctioned entities, but to make them risky and unpleasant enough that large portions of the market refuse to engage. BTC has not meaningfully challenged that effect, it just lowered some of the costs for the gray-market and black-market actors who were already going to breach sanctions anyway.

[1]: https://www.ce9.uscourts.gov/jury-instructions/node/338

appearances matter move to switzerland

Posted Feb 5, 2025 17:04 UTC (Wed) by Lennie (subscriber, #49641) [Link]

My guess is hidden volumes was developed with small amounts of data in mind.

Ever noticed how when making partitions there is often a little bit of space left on the end ?

Wouldn't be surprised that was the intention.

The other option is to have a second storage device which seemed empty and sitting on a shelf (not attached to the computer).

appearances matter move to switzerland

Posted Feb 5, 2025 23:39 UTC (Wed) by linuxrocks123 (subscriber, #34648) [Link] (8 responses)

> *Tor is solving a technical problem, not a legal problem. If you get caught using it in a jurisdiction that bans it, you get penalized.
> * DRM has always been doomed from the start at a technical level,

Yuzu was forked and is now on Tor :) Not that it needed to be since another fork is self-hosted on the open net: https://suyu.dev/

> I don't know of any examples of TrueCrypt hidden volumes actually being litigated w.r.t. the Fifth Amendment. Frankly, the whole thing has always struck me as ridiculous.

TrueCrypt hidden volumes have been litigated: https://storage.courtlistener.com/pdf/2012/02/23/In_Re_Gr...

There are actually a fairly large number of cases about forced decryption in the US. This opinion set a strong precedent in the Eleventh Circuit and involves TrueCrypt specifically. Its hidden volume functionality is discussed in the opinion.

appearances matter move to switzerland

Posted Feb 6, 2025 3:29 UTC (Thu) by NYKevin (subscriber, #129325) [Link] (7 responses)

That is not what I was talking about. That case stands for the relatively unremarkable proposition that you can't be compelled to decrypt data when the government has no idea what it is going to get out of that decryption. As the opinion says in a footnote:

> That said, if the Government is unaware of a particular file name, it still must show
> with some reasonable particularity that it seeks a certain file and is aware, based on other
> information, that (1) the file exists in some specified location, (2) the file is possessed by the
> target of the subpoena, and (3) the file is authentic.

But that is defeated just by regular full device encryption. You don't need hidden volumes to get there. Granted, the court did talk about hidden volumes, because that was the particular technology that this defendant chose to use, but in my reading, full device encryption would have done just as well.

The original use case for hidden volumes was altogether more bizarre. The idea was, roughly speaking, that you might end up in a situation where some authority (legitimate or otherwise) is threatening you (with rubber-hose cryptography, criminal charges, or whatever) if you don't decrypt your hard drive, and you "comply" by decrypting the innocuous non-hidden volume. But that has never made any logical sense, because you have to leave a large hole that never gets decrypted, which will make it hard to plausibly deny the hidden volume's existence. Moreover, if the authority is legitimate, lying about the hidden volume is not only a crime, but it may constitute a waiver of any Fifth Amendment rights (or the local equivalent) you might otherwise have had. It's actively making your situation worse, for no upside.

appearances matter move to switzerland

Posted Feb 6, 2025 7:30 UTC (Thu) by linuxrocks123 (subscriber, #34648) [Link] (6 responses)

> But that has never made any logical sense, because you have to leave a large hole that never gets decrypted, which will make it hard to plausibly deny the hidden volume's existence. Moreover, if the authority is legitimate, lying about the hidden volume is not only a crime, but it may constitute a waiver of any Fifth Amendment rights (or the local equivalent) you might otherwise have had. It's actively making your situation worse, for no upside.

You're not getting it. TrueCrypt will, if you CLICK THROUGH THE WIZARD AND ACCEPT THE DEFAULTS, fill half of the drive with random junk data, not make it part of the primary volume, and not make it a hidden volume. TrueCrypt will, BY DEFAULT, just waste half your space. So, if you CHOOSE THE DEFAULT OPTIONS, half of your space will look exactly like a hidden volume would, even though it isn't.

So, how is anyone ever going to prove there's a hidden volume there? It's entirely plausible that you just clicked Next a bunch of times in the wizard and didn't make a hidden volume. Most people would do that.

TrueCrypt's hidden volume behavior is an extremely clever technique for ensuring no one can be legally compelled to provide encryption keys they don't want to provide, because it makes it impossible for the government to know whether those keys even exist.

appearances matter move to switzerland

Posted Feb 6, 2025 9:54 UTC (Thu) by lunaryorn (guest, #111088) [Link] (5 responses)

What difference would that make? The Fifth Amendment grants a general right to refuse testimony as a defendant in a criminal case. A defendant cannot be forced to surrender keys to an encrypted volume, whether hidden or not, and this has been litigated a lot already. Similar provisions exist in the constitutions of most liberal states.

The technical minutiae of hidden volumes would only matter if law enforcement and courts solely focused on the actual contents of storage devices and ignored all other evidence prosecution has already gathered to obtain a warrant to seize the defendants hardware in the first place. But a court would obviously consider all circumstantial evidence as well, and - upon hearing expert testimony about how Truecrypt can trivially create hidden volumes - would likely not find mere denial plausible anymore. The Fifth Amendment protects the defendant in this case, but it would do so too if the volume wasn't hidden.

If the Fifth Amendment didn't exist then law could just be written such that circumstantial evidence alone was already be sufficient to penalize the defendant for failing to surrender keys; the court would just be required to directly prove the existence of the volume in this case.

The whole idea of hidden volumes seems to rest on the idea that the law allows prosecution to legally force the defendant to surrender encryption keys, but then does not allow any evidence other than specifically proving that the encrypted data exists in the device contents. As a basic premise, that's rather absurd, in my opinion.

appearances matter move to switzerland

Posted Feb 6, 2025 11:09 UTC (Thu) by mb (subscriber, #50428) [Link] (2 responses)

It protects against
https://xkcd.com/538/

appearances matter move to switzerland

Posted Feb 6, 2025 11:33 UTC (Thu) by farnz (subscriber, #17727) [Link]

The challenge is that where XKCD 538 applies, hidden volumes don't protect you. Indeed, not actually having the data won't protect you - you're going to get assaulted because there's a belief you have the data, and no amount of technical evidence that you don't have it will help.

Indeed, you're better off being able to give them the password and the data they want, because they "know" you have it, and will continue to beat you until they get it from you. If you claim you don't have it, then it's "obvious" that you're lying, you've done something to keep it from them (whether they're organised crime or a legitimate government body), and you deserve the beating until you give them the data they want.

appearances matter move to switzerland

Posted Feb 6, 2025 11:55 UTC (Thu) by lunaryorn (guest, #111088) [Link]

I find it quite hard to believe that a security agency in a regime which has so little respect for civil rights as to explicitly tolerate or even legally sanction outright torture would pay any respect to a defence relying on the technical minutiae of a particular encryption software.

appearances matter move to switzerland

Posted Feb 6, 2025 11:58 UTC (Thu) by lunaryorn (guest, #111088) [Link]

...the court would just *not* be required to directly prove the existence of the volume in this case.

I just noticed that this particular typo is somewhat crucial.

appearances matter move to switzerland

Posted Feb 7, 2025 0:49 UTC (Fri) by linuxrocks123 (subscriber, #34648) [Link]

The majority view, followed by multiple federal circuits, is that the prosecution can't make you decrypt things using a password you know but can make you decrypt things using your fingerprint or other biometrics.

The minority view, followed by some state supreme courts, is that the prosecution can make you decrypt things using a password you know and also can make you decrypt using biometrics.

People have been in prison for contempt of court for years before legal aid organizations appealed their cases high enough to get the contempt order overturned and thereby to establish the majority view. And, the majority view is still not universal, especially at the state level.

Using a TrueCrypt hidden volume would definitely make someone's contempt case more clear-cut: you are holding me in contempt for not producing something that there is a very good chance may not even exist.

appearances matter move to switzerland

Posted Feb 14, 2025 0:26 UTC (Fri) by ghodgkins (subscriber, #157257) [Link]

Development of Tor was funded by the US government to protect its covert operations abroad.

https://en.wikipedia.org/wiki/Tor_(network)#History