appearances matter move to switzerland [LWN.net]

appearances matter move to switzerland

Posted Feb 4, 2025 22:14 UTC (Tue) by NYKevin (subscriber, #129325)
In reply to: appearances matter move to switzerland by linuxrocks123
Parent article: The Linux Foundation on global regulations and sanctions

I'll give you PGP, but most of the others are not actually examples of the pattern I was describing:

* Tor is solving a technical problem, not a legal problem. If you get caught using it in a jurisdiction that bans it, you get penalized.
* DRM has always been doomed from the start at a technical level, but section 1201 is still regularly used against random FOSS projects that do things big companies don't like (most recently the Yuzu emulator). The programmers did not win the war, they merely won one relatively inconsequential battle.
* I don't know of any examples of TrueCrypt hidden volumes actually being litigated w.r.t. the Fifth Amendment. Frankly, the whole thing has always struck me as ridiculous. First of all, any drive with a hidden volume will appear to have a large, unallocated space filled with random noise. Then, the particulars of the case may provide circumstantial evidence that you stored specific data somewhere on the drive. When those factors are combined with expert testimony about how TrueCrypt works, a jury could plausibly decide that a hidden volume exists beyond a reasonable doubt (see [1] for what juries are told about the meaning of "reasonable doubt," especially this line: "It is not required that the government prove guilt beyond all possible doubt.").
* Sanctions are applicable to BTC. It is sometimes difficult to apply them in practice, but transacting with a sanctioned entity in BTC is just as illegal as transacting with them in any fiat currency. The goal of sanctions is not necessarily to completely eliminate transactions involving sanctioned entities, but to make them risky and unpleasant enough that large portions of the market refuse to engage. BTC has not meaningfully challenged that effect, it just lowered some of the costs for the gray-market and black-market actors who were already going to breach sanctions anyway.

[1]: https://www.ce9.uscourts.gov/jury-instructions/node/338

appearances matter move to switzerland

Posted Feb 5, 2025 23:39 UTC (Wed) by linuxrocks123 (subscriber, #34648) [Link] (8 responses)

> *Tor is solving a technical problem, not a legal problem. If you get caught using it in a jurisdiction that bans it, you get penalized.
> * DRM has always been doomed from the start at a technical level,

Yuzu was forked and is now on Tor :) Not that it needed to be since another fork is self-hosted on the open net: https://suyu.dev/

> I don't know of any examples of TrueCrypt hidden volumes actually being litigated w.r.t. the Fifth Amendment. Frankly, the whole thing has always struck me as ridiculous.

TrueCrypt hidden volumes have been litigated: https://storage.courtlistener.com/pdf/2012/02/23/In_Re_Gr...

There are actually a fairly large number of cases about forced decryption in the US. This opinion set a strong precedent in the Eleventh Circuit and involves TrueCrypt specifically. Its hidden volume functionality is discussed in the opinion.

appearances matter move to switzerland

Posted Feb 6, 2025 3:29 UTC (Thu) by NYKevin (subscriber, #129325) [Link] (7 responses)

That is not what I was talking about. That case stands for the relatively unremarkable proposition that you can't be compelled to decrypt data when the government has no idea what it is going to get out of that decryption. As the opinion says in a footnote:

> That said, if the Government is unaware of a particular file name, it still must show
> with some reasonable particularity that it seeks a certain file and is aware, based on other
> information, that (1) the file exists in some specified location, (2) the file is possessed by the
> target of the subpoena, and (3) the file is authentic.

But that is defeated just by regular full device encryption. You don't need hidden volumes to get there. Granted, the court did talk about hidden volumes, because that was the particular technology that this defendant chose to use, but in my reading, full device encryption would have done just as well.

The original use case for hidden volumes was altogether more bizarre. The idea was, roughly speaking, that you might end up in a situation where some authority (legitimate or otherwise) is threatening you (with rubber-hose cryptography, criminal charges, or whatever) if you don't decrypt your hard drive, and you "comply" by decrypting the innocuous non-hidden volume. But that has never made any logical sense, because you have to leave a large hole that never gets decrypted, which will make it hard to plausibly deny the hidden volume's existence. Moreover, if the authority is legitimate, lying about the hidden volume is not only a crime, but it may constitute a waiver of any Fifth Amendment rights (or the local equivalent) you might otherwise have had. It's actively making your situation worse, for no upside.

appearances matter move to switzerland

Posted Feb 6, 2025 7:30 UTC (Thu) by linuxrocks123 (subscriber, #34648) [Link] (6 responses)

> But that has never made any logical sense, because you have to leave a large hole that never gets decrypted, which will make it hard to plausibly deny the hidden volume's existence. Moreover, if the authority is legitimate, lying about the hidden volume is not only a crime, but it may constitute a waiver of any Fifth Amendment rights (or the local equivalent) you might otherwise have had. It's actively making your situation worse, for no upside.

You're not getting it. TrueCrypt will, if you CLICK THROUGH THE WIZARD AND ACCEPT THE DEFAULTS, fill half of the drive with random junk data, not make it part of the primary volume, and not make it a hidden volume. TrueCrypt will, BY DEFAULT, just waste half your space. So, if you CHOOSE THE DEFAULT OPTIONS, half of your space will look exactly like a hidden volume would, even though it isn't.

So, how is anyone ever going to prove there's a hidden volume there? It's entirely plausible that you just clicked Next a bunch of times in the wizard and didn't make a hidden volume. Most people would do that.

TrueCrypt's hidden volume behavior is an extremely clever technique for ensuring no one can be legally compelled to provide encryption keys they don't want to provide, because it makes it impossible for the government to know whether those keys even exist.

appearances matter move to switzerland

Posted Feb 6, 2025 9:54 UTC (Thu) by lunaryorn (guest, #111088) [Link] (5 responses)

What difference would that make? The Fifth Amendment grants a general right to refuse testimony as a defendant in a criminal case. A defendant cannot be forced to surrender keys to an encrypted volume, whether hidden or not, and this has been litigated a lot already. Similar provisions exist in the constitutions of most liberal states.

The technical minutiae of hidden volumes would only matter if law enforcement and courts solely focused on the actual contents of storage devices and ignored all other evidence prosecution has already gathered to obtain a warrant to seize the defendants hardware in the first place. But a court would obviously consider all circumstantial evidence as well, and - upon hearing expert testimony about how Truecrypt can trivially create hidden volumes - would likely not find mere denial plausible anymore. The Fifth Amendment protects the defendant in this case, but it would do so too if the volume wasn't hidden.

If the Fifth Amendment didn't exist then law could just be written such that circumstantial evidence alone was already be sufficient to penalize the defendant for failing to surrender keys; the court would just be required to directly prove the existence of the volume in this case.

The whole idea of hidden volumes seems to rest on the idea that the law allows prosecution to legally force the defendant to surrender encryption keys, but then does not allow any evidence other than specifically proving that the encrypted data exists in the device contents. As a basic premise, that's rather absurd, in my opinion.

appearances matter move to switzerland

Posted Feb 6, 2025 11:09 UTC (Thu) by mb (subscriber, #50428) [Link] (2 responses)

It protects against
https://xkcd.com/538/

appearances matter move to switzerland

Posted Feb 6, 2025 11:33 UTC (Thu) by farnz (subscriber, #17727) [Link]

The challenge is that where XKCD 538 applies, hidden volumes don't protect you. Indeed, not actually having the data won't protect you - you're going to get assaulted because there's a belief you have the data, and no amount of technical evidence that you don't have it will help.

Indeed, you're better off being able to give them the password and the data they want, because they "know" you have it, and will continue to beat you until they get it from you. If you claim you don't have it, then it's "obvious" that you're lying, you've done something to keep it from them (whether they're organised crime or a legitimate government body), and you deserve the beating until you give them the data they want.

appearances matter move to switzerland

Posted Feb 6, 2025 11:55 UTC (Thu) by lunaryorn (guest, #111088) [Link]

I find it quite hard to believe that a security agency in a regime which has so little respect for civil rights as to explicitly tolerate or even legally sanction outright torture would pay any respect to a defence relying on the technical minutiae of a particular encryption software.

appearances matter move to switzerland

Posted Feb 6, 2025 11:58 UTC (Thu) by lunaryorn (guest, #111088) [Link]

...the court would just *not* be required to directly prove the existence of the volume in this case.

I just noticed that this particular typo is somewhat crucial.

appearances matter move to switzerland

Posted Feb 7, 2025 0:49 UTC (Fri) by linuxrocks123 (subscriber, #34648) [Link]

The majority view, followed by multiple federal circuits, is that the prosecution can't make you decrypt things using a password you know but can make you decrypt things using your fingerprint or other biometrics.

The minority view, followed by some state supreme courts, is that the prosecution can make you decrypt things using a password you know and also can make you decrypt using biometrics.

People have been in prison for contempt of court for years before legal aid organizations appealed their cases high enough to get the contempt order overturned and thereby to establish the majority view. And, the majority view is still not universal, especially at the state level.

Using a TrueCrypt hidden volume would definitely make someone's contempt case more clear-cut: you are holding me in contempt for not producing something that there is a very good chance may not even exist.