1

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an encryption algorithm that may be uncommon. They would have these problems, no?

1.They can't guarantee it's what it's said to be if they can't retain the original binary data that makes up the evidence of the accusation. In such a case, they could never charge anyone without proof, and if they can't decrypt it, they can't prove anything.

2.Even if they, by some miracle, found a key and or decrypted it, the file could be an executable wrapped around the actual data; be self-modifiable; and it could attempt to use a host software program or OS library to delete itself if opened from a modern desktop, or re-arrange its own data to make it unidentified without a key/passcode.

On top of that, encryption could be done on a computer with no internet connection, leaving it virtually impossible to figure out who encrypted it if it's uploaded from an IP randomly used (public Wi-Fi, different location, protocol, secured proxies, no agent info, etc.). In that case, wouldn't piracy and other stuff illegal be easy to transfer without getting caught?

One could provide the keys to open the decryption and data scrambled within it over a throw away phone number, Skype, proxy, or unidentifiable remote locations. In short, can't decryption prevent authority from charging anyone in the legal system?

  • 1
    Instead of using uncommon encryption it is better to use common encryption, because the less known an encryption algorithm is the more likely does it have flaws unknown to you. – Philipp Apr 4 '14 at 22:30
2

1.They can't guarantee it's what it's said to be if they can't retain the original binary data that makes up the evidence of the accusation. In such a case, they could never charge anyone without proof, and if they can't decrypt it, they can't prove anything.

Assuming that any confiscated or eavesdropped data is encrypted in a secure way, there is no technical way for law enforcement to decrypt it. Most legal systems in the world allow a suspect to refuse to incriminate them self. But whether or not the disclosure of passwords or passphrases is protected by these statutes is a topic of debate which is currently handled differently by different jurisdictions. There are places in the world were refusing to provide decryption keys when under suspicion is a criminal act itself and can be punished on its own independently from what a person is actually accused of. Refer to the Wikipedia article on Key Disclosure Law for more information.

But depending on the circumstances, decrypting the data might not even be necessary. When there is other strong evidence that you are involved in the exchange of illegal material, that alone might be enough to convict you in some courts around the world.

2.Even if they, by some miracle, found a key and or decrypted it, the file could be an executable wrapped around the actual data; be self-modifiable; and it could attempt to use a host software program or OS library to delete itself if opened from a modern desktop, or re-arrange its own data to make it unidentified without a key/passcode.

That's really not an issue when investigators follow common forensic practices. Usually all data is backed up to read-only media in every stage of the forensic analysis. This is required to prevent any suspicion that the evidence got tampered with.

Also, there is no reason to execute anything you find during a forensic analysis, except in a properly secured sandbox. When you are collecting evidence for trials, the last thing you want is to give attorneys a reason to claim that all your work is meaningless because your digital forensics lab got a virus during a different case.

One could provide the keys to open the decryption and data scrambled within it over a throw away phone number, Skype, proxy, or unidentifiable remote locations. In short, can't decryption prevent authority from charging anyone in the legal system?

The problem with the scenario you described is that it is inconvenient. The moment you invest more work into providing someone with an illegal copy of a media than one would have to invest to earn the money to get a legal copy, it becomes pointless. The reason why movie- and software piracy is so prevalent is not just because it is cheaper than buying but also because it's often more convenient.

There are systems like TOR hidden services, Freenet or I2P which allow people to publish and download files anonymously and encrypted. Some people use them for piracy. But unfortunately these systems do not provide the performance necessary for exchanging large files quickly and do not provide a powerful search. That makes them very inconvenient to use, which drives people to less secure but much more convenient systems like BitTorrent or one-click filehosters.

The only people who really have a reason to use encrypted and anonymous filesharing in its current state are those who want to exchange material which can not possibly be obtained legally. Not people who want to avoid paying for media but people who want to avoid going to jail because of it (or worse).

Interestingly, there were various sting operations in the past were people who were doing this did get caught even thought they did use encryption technology which was not broken in a technical way. Usually the evidence against these people is collected in much more old-fashioned ways: Infiltration, detective work and of course following the money streams.

0

In the UK the police can force you to reveal encryption keys. There have been a handful of cases of people jailed purely for refusing to reveal their key. I think the UK is somewhat unusual in this regard, but you would have to check your local laws.

Of course, if revealing your key implicated you in something serious (like mass murder) you would do best to not reveal it. But if it's just piracy, you'd get in less trouble by revealing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.