Irish Police To Be Given Powers Over Passwords (bbc.com) 164
Irish police will have the power to compel people to provide passwords for electronic devices when carrying out a search warrant under new legislation. From a report: The change is part of the Garda Siochana Bill published by Irish Justice Minister Heather Humphreys on Monday. Gardai will also be required to make a written record of a stop and search. This will enable data to be collected so the effectiveness and use of the powers can be assessed. Special measures will be introduced for suspects who are children and suspects who may have impaired capacity. The bill will bring in longer detention periods for the investigation of multiple offences being investigated together, for a maximum of up to 48 hours. It will also allow for a week's detention for suspects in human trafficking offences, which are currently subject to a maximum of 24 hours detention.
Since device backups are encrypted in the cloud (Score:5, Insightful)
Re:Since device backups are encrypted in the cloud (Score:5, Interesting)
Well, instead of a distress password per se that wipes the phone which would be obvious and potentially/likely illegal, perhaps one which unlocks the phone but to preestablished harmless state while letting the true encrypted phone hide inside (i.e., like a hidden OS in vera/truecrypt)
Re: (Score:3)
What happens if you just forgot your password?
Re:Since device backups are encrypted in the cloud (Score:4)
"What happens if you just forgot your password?"
You go directly to jail, do not collect $200 :-(
Re: (Score:2)
Unless you have a really, REALLY good argument that you actually did, you're going to go to jail for concealing evidence that court has ordered to be shown.
Re: Since device backups are encrypted in the clou (Score:2)
What would qualify as a really good argument? How do they prove that you couldn't have forgotten it?
Re: (Score:2)
Yep. Here in a mostly free first world country, (USA) you cannot be compelled to produce a password in case it is truly forgotten. (assuming its not a cell phone, but something possibly seldom used, but a daily use cell phone is still considered off limits due to the ruling) After all, we believe in "innocent until proven guilty".
But biometrics are another animal entirely. Here in the US you cannot be compelled to produce a password from memory, but you CAN be compelled to produce fingers for fingerprint re
Re: (Score:2)
Yep. Here in a mostly free first world country, (USA) you cannot be compelled to produce a password in case it is truly forgotten.
While it's true that you can't be compelled to produce a password in the USA, that's not why. It's Fifth Amendment that provides that protection: "nor shall be compelled in any criminal case to be a witness against himself, "
Re: (Score:2)
Yep - that's the whole point of the Miranda rights being read so that people are aware of that, and the first statement is "You have the right to remain silent".
You are not required to give up any information or answer any questions. Now that doesn't mean silence is always the best choice, just a legal option. If you're accused of killing someone last night and you know very well that you were elsewhere and have a witness, then by all means its in your best interest to answer "Where were you last night?".
Re: (Score:2)
Re: (Score:2)
While it's true that you can't be compelled to produce a password in the USA, that's not why. It's Fifth Amendment that provides that protection:
"nor shall be compelled in any criminal case to be a witness against himself, "
Yes, it is rooted in the 5th amendment. But courts have ruled that passwords are not always covered by that and have compelled defendants to disclose passwords because giving a password is considered an act, not testimony. (that idea is disputed) Which is troublesome because they cannot always guarantee you actually have the information. What if you set the password once and forgot it? I mean TRULY forgot it. Like the dude who lost the password for his encrypted bitcoin wallet drive? It would REALLY suck t
Re: (Score:2)
If discovered, this would basically send perpetrator to jail for a long time. This would be concealing/destroying evidence with bonus points added in court for "he prepared for this event to such a degree, can you imagine what he must've had on that phone?"
There's a reason why even massive corporations like Google and Apple don't fuck around with evidence that court subpoenaed by a Western court with jurisdiction to do so, even when it's very harmful to their case.
Re: (Score:2)
None of these work against reasonable forensic procedures. They are obvious though and hence a really bad idea.
Re: (Score:2)
Re: (Score:2)
Well, instead of a distress password per se that wipes the phone which would be obvious and potentially/likely illegal, perhaps one which unlocks the phone but to preestablished harmless state while letting the true encrypted phone hide inside (i.e., like a hidden OS in vera/truecrypt)
If you're worried about data security, the easiest solution is simply not to keep the data on a device that can be compromised. Nor allow that device to store the credentials of any server that stores sensitive data.
I do admire how imaginative some slashdotters are when coming up with these solutions but the problems have been largely solved. Never store sensitive (or incriminating) data on a device that could be stolen (or confiscated/seized by the authorities). I've worked with a few industries that re
Re: (Score:2)
The Irish bill appears to allow Guardi to compel you to give up passwords used to access remotely stored information also. Storing remotely doesn't help you. You could be compelled to turn over VPN passwords and remote logins.
Re: (Score:3)
It was illegal to "protect privacy" that is subpoenaed by a court with jurisdiction to do so for at least a century in most civilized nations. Probably longer.
Re: (Score:2)
Re: (Score:3, Interesting)
In the US it's still up in the air whether compelling you to say your password implicates your 5th Amendment right against self-incrimination.
It is looking favorable so far on that, but it hasn't been to the SC.
The arguments presented to "work around the 5th" (what a shitty statement for officials to make) is a thing called "foregone conclusion", where the government claims it knows what's on there, so compelling you to provide the password has no implication as to your guilt.
Which is odd, since they need t
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
VeraCrypt (drive/container encryption) has another option. You can select two passwords for your container. One is a standard password which unlocks the container as normal. The second is a "hidden" partition which is stored encrypted in the empty space of the encrypted container. If you just open the standard container you'd have no idea it was there, and could even accidentally overwrite it with enough data written to the standard container. But enter the "hidden" password and the inner container is mount
Re: (Score:2)
It would look very suspicious if the partition didn't use all available space, or if unallocated space was not all zeroes. This is the era of the TRIM command, and unallocated space is zeroes.
Re: (Score:2)
By default, VeraCrypt uses all available space for a volume when formatting it. Inside the volume, it doesn't use TRIM, so all free space is random. Of course, one could use a quick format command, which some filesystems accept, that creates a volume with holes in it, but that isn't a default.
Re: (Score:2)
The police takes a forensic image first and then they do not suspect, they know what you did after looking what is the the outer container.
Re: (Score:3)
Re: (Score:2)
Ultimately it's a jury that you have to convince. Or rather you have to cast doubt on it, the standard of proof for the police is "beyond reasonable doubt" in most places. At least in theory, most juries in the UK take the police's word for any old nonsense.
Re: (Score:2)
Re: (Score:2)
Concealing evidence is the same crime as destroying evidence in many jurisdictions. Both are equally obstructive to investigation. Unless you are really in deep criminal waters if you unlock the phone, anything that you do to obstruct just makes your eventual punishment way worse, as far as I can tell. YMMV by jurisdiction, obviously.
Re: (Score:2)
Here in the states, the 5th amendment can be invoked, and invoking it can't be used as evidence against you. Personally, if the police ever took my phone and told me to unlock it, I'd give them the finger whether I had anything incriminating on it or not, and I'm within my rights to do so. If they want to spend the effort to brute force decrypt it, be my guest, my phone is bootloader unlocked and rooted so they're free to lift the image off and do an offline attack, though joke's on them as I tend to treat
Re: (Score:2)
ere in the states, the 5th amendment can be invoked, and invoking it can't be used as evidence against you. Personally, if the police ever took my phone and told me to unlock it, I'd give them the finger whether I had anything incriminating on it or not, and I'm within my rights to do so.
An this should be exactly what you do. Never do the polices job for them. They want it, make them get a warrant. Make them argue why they need that information.
Re: (Score:2)
Straight from the story:
>when carrying out a search warrant under new legislation
They already have a warrant. You're tampering with evidence that has already been subpoenaed by a court with jurisdiction over your case.
Re: (Score:2)
Whether its a password, searching your car, or any other interaction with law enforcement; if the police have it in for you, "there's nothing to stop them from introducing you to Bruno."
Re: (Score:2)
Re: (Score:2)
Do the Irish police care about USA breach? And why do you have such a phone while traveling overseas?
Re: (Score:2)
Exactly. That seems about as inappropriate as carrying a briefcase full of top secret info to another nation, unless you are there as a diplomat (which would have immunity from such searches).
Re: (Score:2)
Here in the states, the 5th amendment can be invoked, and invoking it can't be used as evidence against you. Personally, if the police ever took my phone and told me to unlock it, I'd give them the finger
What good is a phone call, Mr. Anderson, if you are unable to speak?
Re: (Score:2)
it's obviously a strong reason not to go to ireland. sad, a beautiful country indeed but if this is their respect for citizen privacy then i haven't lost anything there.
ironically, there are very similar reasons to never put a foot on us soil either.
i guess the moral of the story is that the free world is getting smaller and smaller if we ever had one.
Re: (Score:2)
oh, and the funniest thing about this is that i don't even have a lock on my phone. i treat it as expendable, as should anyone. it's just that my phone is nobody else's business but mine, period.
Re: (Score:2)
it's obviously a strong reason not to go to ireland. sad, a beautiful country indeed but if this is their respect for citizen privacy then i haven't lost anything there.
That's a pretty laughable statement. If you travel from The USA to Ireland, the Irish police need a search warrant to demand you unlock yuour phone. ICE merely require you to step off the plane when you return.
Re: (Score:2)
i fail to see how that relates to anything i said, but ... cool story.
Re: (Score:2)
If you move to the States, you have to pass through US Customs where evidence laws do not apply (so says SCOTUS), and they can freely demand any information you have and seize it for any purpose they desire. So you don't want to move to the USA... you want to just already be in the USA. How you pull that trick off is left as an exercise to the time traveler. :-)
Re: (Score:2)
Or...
Don't bring devices into the US that have incrementing evidence. You're not going to get arrested for having Minecraft installed. This isn't rocket surgery. The US and every other country don't want criminals entering their borders. While they all define what a criminal is, most people aren't. If you're that worried and you have't done anything wrong, save your data somewhere and wipe your computer/phone before you enter the US. Then retrieve it once you're in.
Re: (Score:2)
Re: (Score:2)
Re: Since device backups are encrypted in the cl (Score:2)
Re: (Score:3)
Petty crime that could make it easy to hold me for a long time if falsely accused of a bigger crime.
Like I'd hate to get held because they have evidence of minor drug use if accused for a crime I didn't commit.
I'm sure there's other things people are concerned about too, like if one is having an affair they don't want that all put out in the open just because they've been falsely accused.
There's nothing good and some bad that can come from the police going through all of your private communications, it seem
Re: (Score:2)
Re: (Score:2)
They can't ask one's spouse if they're aware of such and such is a mistress or down low lover in the course of an investigation?
Seems to really hobble police work.
Re: (Score:2)
What exactly are you so interested in hiding from a legally authorized warrant?
Spells. I wouldn't want them to know of my conversations with the Ascended Masters. Just imagine what a government would do if they found my grimoire with detailed instructions for functional kill-at-a-distance, brain-wash, fall-in-love, change-memory, and teleportation spells? Better to be on the safe side and have it on a hidden second partition.
Re: (Score:3)
Re: (Score:2)
The Bill of Rights of 1688 did have protections for the people, the right to be armed for self defence for example.
Besides, considering how the US Bill of Rights is ignored, it just makes the Supreme Court all powerful, leading to a politicized court and lots of laws that fly in the face of the Bill of Rights. How many laws has Congress passed removing some rights to speech? How many laws abridge the right of the people to bear arms? It seems to be reasonable to search peoples phones at the border, which ex
Re: (Score:2)
Armed with what? Foam pool noodles?
Re: (Score:2)
When you say things like "That's why the UK violates human rights, early and often, as it does with this Irish law", it suggests that you don't know what's happening here. Eire is not part of the UK. You seem to be confusing Northern Ireland, which is part of the UK, with Eire (aka Southern Ireland), which is not.
And as someone else noted Just because the UK doesn't have a single document that you would consider a constitution doesn't mean they don't have one. Our constitution is comprised of numerous la
Re: (Score:3)
Re: (Score:2)
It just means an election so the people can decide who they want governing them. If things get so dysfunctional in Parliament, well perhaps an election or the chance for the other team is the correct call.
Here, we had the opposite, after an election with 44-42-3 results, the Premier asked to dissolve the legislature and the Lieutenant-Governor refused, letting the 42+3 govern instead. Most thought it was the right call. And if the Premier had refused to resign after the Legislature rejected the Throne speec
Re: (Score:2)
Re: (Score:2)
What should happen if the government can't pass a supply bill? Parliamentary systems basically means the government is whoever can govern by passing supply bills to pay the bills.
I see Wiki says the government was going to call an election for half the Senate, which seems weird to this Canadian who doesn't know enough.
Re: (Score:2)
What's the alternative - give this power to the PM/President instead - why is that fairer ...
Congrats (Score:2)
Now you have a charge of destruction of evidence.
Re: (Score:2)
Destruction of evidence when evidence is subpoenaed under court order is a serious crime pretty much everywhere.
Re: (Score:2)
you could always "oops butterfingers" drop it and stomp it by accident
Everyone is a privacy tough guy, until the jail cell door closes on your destruction of evidence/obstruction of justice charge.
(Not You) "You're allowed one phone call."
(You) "Great! I need to call my attor..."
(Not You) "From your phone."
(You) "Fuck me sideways."
Re: (Score:2)
Re: (Score:2)
Well not owning a phone in this case means you likely wouldn't be detained.
And while "I want my lawyer" works 98% of the time in the US, it may not be quite as strong as you assume outside of the country. Sure. You may wait for your lawyer. I'm certain they have "accommodations" prepared. Not like you wanted to go on vacation anyway..
Re: (Score:2)
Due process doesn't work the same way in other countries. In many countries, not only are you not required to have a lawyer for questioning by the police even if you request one, but the lawyer may be severely limited in what he can advise you to do during questioning if he/she is allowed to be present.
There are also fun parts, like if you are in fact a witness rather than suspect (for example, you took pictures that police suspect show someone else commit another crime), "no self incrimination" clauses suc
Re: (Score:2)
When is that ever allowed? The police are allowed to lie to you, at least in the US, but the farthest normal people are allowed to go is to refuse to speak to the police. (One may have to identify oneself, or respond to a subpoena, and so forth.)
Re: (Score:2)
In many countries, if you are a suspect, you do not have a requirement to tell police the truth. Some countries have a blanket allowance on this like mine, some limit it to items that are self-incriminating.
Re: (Score:2)
When is that ever allowed?
Here in Brazil there's no crime of perjury, so one may lie to police and even to the judge. It's understood it's the police, and the prosecution's, job to find incrimination evidence against you, not your duty to offer it, and that it's also natural for someone to seek their freedom by all means possible, which includes lying. That said, even you can lie to try protecting your own freedom, you cannot do so in a way that would redirect blame to an innocent party, as falsely incriminating another is a crime,
Re: (Score:2)
That's entirely too civilized. We'd never allow such things here.
Re: (Score:3)
"many countries will just remove a digit from a hand"
What countries have done this (in the past decade) while asking for a password (since that's what this discussion is about)?
"in England, they ask the password, and every time you refuse, they give you two years more in their prison system"
How may people are actually in English prison NOW due to refusal to provide a password?
Does This Include The Rubber Hose (Score:2)
treatment? Maybe some other mild torture to extract the passwords? Asking for a friend.
Re: (Score:3)
treatment? Maybe some other mild torture to extract the passwords? Asking for a friend.
Well, the rest of us, call it "waterboarding".
Not sure if that counts though, since they call that a "drinking game".
"for a maximum of up to 48 hours" (Score:2)
An empty phone holds no secrets (Score:2)
The fascination with storing their lives on a portable device is what makes phones tempting targets, so I don't. It really is that easy.
Re: (Score:3)
Works even better when one doesn't have a life to store.
Re: (Score:3)
I think his username summarizes the situation succinctly.
Meanwhile the rest of us have to text wife and kids, have email for work and personal, have multifactor auth app, chat/workgroup thing for work and etc.
Re: An empty phone holds no secrets (Score:2)
If you're an employee, there is zero valid reason to have anything work related on your phone, beside maybe the phone numbers of colleagues. If your employer needs to you to work on a phone, he can give you one. Even if you are self employed, it would be better to have a dedicated work phone.
There is no email urgent enough that it can't wait until the evening to be read on my pc. If something is that urgent, people can call me.
Photos and videos should be backed up and erased from the phone regularly, same f
Re: (Score:2)
Your phone still contains the VPN app and the remote access app for these things. Those passwords are covered by the warrant as well. Storing remotely doesn't help you. If the phone can access the information, then the information is compromised by the warrant. Local/remote storage is irrelevant.
How does this effect 'Irish' entities (Score:4, Interesting)
that run cloud services and are 'Irish' for tax purposes and have encryption keys to all their customer data?
Vacation Elsewhere (Score:3)
Re: (Score:2)
I'd take my chances with the Gardai in Ireland then the police in the USA any day of the week, USA has far more powers to retain and make your life hell.
Re: (Score:2)
I'd be more worried about the Department of Homeland (in)Security when travelling to and from America, than either american Police or the irish Garda.
Re: (Score:2)
Nice punctuation, mouth-breather. Your television is THAT way.
(I'd go easy on you if you were a foreigner but with ignorance that extreme, I know you don't speak more than one language - a third of one is more like it.)
Re: (Score:2)
I should think that tourism is a major industry, that matters, just as much as values.
To be fair, this is going to be like the US where it's not a law to target tourists, rather a law to be used against citizens. If Ireland or the US suspects you enough to want to prevent you from visiting, you'll be denied an ESTA or whatever the European one being introduced in 2022 is called. If that fails you'll be turned away at the border.
Still not a good law, but ultimately not one that will affect tourists.
Problematic. (Score:5, Insightful)
The problem with being able to compel someone to reveal highly specific information is that they may not know the information even if they knew it at some point in the past. If you have an old device you don't use anymore and no longer are able to recall the password, can they just throw you in jail for years for being unable to remember? If not then it seems obvious that people who do remember will claim to not which brings you to the point of trying to discern if they really know the password or not.
This path is fraught with danger.
Re: (Score:2)
This path is fraught with danger.
It is. But this slide deeper into removing individual protections is part of a general trend.
Re: (Score:2)
For an old device, you should be able to argue that you forgot, especially if there are no recent telco records of it being used. For a phone in your possession, with an active sim card and telco records showing that you were using it recently, not so much.
You are right that it is a slippery slope.
Re: (Score:3)
1) I use long passwords. For my phone, my computers, my password manager, or anything else that I have to type in from memory. Even though most of them haven’t changed in years, I’ll occasionally forget them. I’ll just blank. They always come back to me later, or else muscle memory kicks in and I can type them when I can’t recite them, but I could easily imagine a scenario where I wasn’t able to provide my password upon request, particularly so if it was a stressful situation o
Re: (Score:2)
To avoid these problems when dealing with the police, I recommend using the same password for all accounts on all devices. Then get that password tattooed on your arm. :-)
Re:Problematic. (Score:4, Interesting)
At my last job, there was a mission critical server belonging to our clients, to which I had remote access. I set my admin account up with a 128-character, randomly generated password because it didn't make a difference to me how long it was, given that they all copy/paste the same way from my password manager.
Well, to make a long story short circumstances conspired against me and the very next month I found myself in a position where I had to type that password in manually, not once, not twice, but five times, each of which was while on a series of calls with the client as they patiently waited for me to finish typing. Thankfully, I got to be the hero in the story who saved the day after the client locked themselves out of a mission critical machine.
FYI, it takes me about three minutes to type a 128-character randomly-generated password. Talk about some awkward silence on conference calls as no one wants to cause you to lose your place because everything is riding on you.
All of which is to say, depending on your workplace's rules about tattoos, you may not be able to fit your password on your arm while wearing long sleeves.
Re: (Score:2, Informative)
The law in the UK is similar, you can be forced to divulge passwords. To prosecute you for failing to do so they have to prove that you know the password, which usually just means showing that you recently used it.
As you say, there is a very great danger that someone may legitimately have forgotten it. When forced to change passwords by work I always write them down because otherwise I'll usually forget them by the day after.
Re: (Score:2)
Since the police have a warrant in this case, giving them a false password -- or failing to give them *all* the passwords -- is obstruction of justice and is a crime in and of itself, even if you were innocent of the original charges. So, no, that isn't the best way to deal with this, at least not from a personal standpoint. Because even if the laws are changed in the future, you're still going to be sitting in jail for obstructing a warrant.
You keep using that word ("compel") ... (Score:2)
I do not think it means what you think it means.
I mean, they can punish you for not revealing your password, but that's all. It's not the same as how they can compel you to come to the police station. It would be more accurate to say that they have the power to coerce people to hand over their passwords.
Re: (Score:2)
The legal definition of "compel" is different from the common vernacular. In this context, compel means to apply coercive pressure and to levy fines/prison/other punishment if not obeyed. The legal assumption is that you are compelled to obey because the punishments are stiff enough to deter disobedience, even if those punishments are not sufficient in practice.
Safe (Score:3)
If you refused, a judge would order you to do, and if you refused the judge's order you'd be locked up for contempt.
So it's not really a stretch to argue here that a password to a file container is not a lot different from the safe in your office.
Bad idea (Score:2)
That will compromise the workplace, and might be the end of hybrid work/private devices. Police should not have this possibility to ask for private and secret information.
This is why neuralink will be awesome... (Score:2)
Because eventually, you can tie your password to what you are thinking. Laws can at best only compel you what to *DO*, they have absolutely no ability to compel you what to think. Any express or implied threats of any negative consequences if you were to not comply would themselves alter what you were thinking about in trying to use the password, because you are cognizant of them. This might in turn impede even your own ability to unlock any such protected device under duress, making any efforts they mi
Right to silence (Score:3)
It will be interesting to see how this is compatible with the right to silence:
https://www.whitecase.com/publ... [whitecase.com]
Re: (Score:3)
Proper encryption does not tell you if it's a wrong password or you just correctly decrypted corrupted data.
I challenge you to point to a published user-targetted cryptographic app that does what you suggest, let alone a mobile OS.
You're saying "proper encryption" doesn't exist.
Re: (Score:2)
Lots of "what ifs" in your post.
All that would boil down to you and the police arguing each side in front of a judge. The police would likely need to show evidence that you didn't provide the "correct" password, and your actions were concealing and/or destroying evidence.
Realistically, if you have an app on your phone that allows for "regular" access and "a sanitized clone"; that would be suspicious since 99.999% of the population doesn't. It doesn't mean you broke the law or did anything wrong, but it woul