Top Ten Legal Questions (merged)

[granick]

My talk this year at Defcon will answer the top ten questions defcon attendees have about the law. My non-scientific means of getting the top ten questions is to post here in the forums and ask people with questions to email me at bhdefcon2005talk@hotmail.com with those questions. I'll then pick the most interesting and frequent ones to discuss in my talk. So if there's something about the law you want to know, send an email.

Thanks,

Jennifer Granick

[TheCotMan]

My talk this year at Defcon will answer the top ten questions defcon attendees have about the law. My non-scientific means of getting the top ten questions is to post here in the forums and ask people with questions to email me at bhdefcon2005talk@hotmail.com with those questions. I'll then pick the most interesting and frequent ones to discuss in my talk. So if there's something about the law you want to know, send an email.

Good to hear you are coming back for another year. :-)
Writing an e-mail now.

[AlxRogan]

Merged the two identical threads to keep the content together.

[Deviant Ollam]

i know i've been wondering a great deal about a legal tech question recently. i even emailed the EFF but never got back a response. ah well, guess they're badly overworked lately.

here's the question i shot off to Jennifer just now...

i have a question about the secure storage of passwords and/or encryption keys with a lawyer so that loved ones or associates could be able to access data and administrate networks over which i currently have control should an unforseen tragedy ever befall me. simply put... i built my home network with significant encryption of user accounts and home directory data. while some of the users of the network have a modicum of understanding of how all this works, many of the root passwords and file system decryption passphrases are mine alone.

should i meet an untimely demise or be subjected to prolonged absence from my house (like for medical reasons or if i'm being held incommunicado in guantanamo bay) what avenues are available for a third party to securely have copies of the relevant authentication information?

can a lawyer hold backups of someone's passwords and keys with the instruction that they only be divulged with the express permission of that individual or be divulged to specific parties upon the owner's death/incapacitation? how immune to subpeaonas would such data be? could governments and prosecutorial parties ever demand that a lawyer turnover those keys if an investigation were being conducted against the owner?

if i get hit by a bus, i'd like to think that my girlfriend wouldn't forever lose access to her files and that my assocaites would be able to continue on with work that i've left unfinished.

[theCount]

The following is what I sent:

When computer crime crosses national boundaries, which national law
applies? I mean, is the location of the compromised or the
compromising computer that is viewed as locus delicti? I'm curious
as to the answer of this question in both theory and practice.

If there is an international instrument governing cross-border
computer crimes (I actually don't know if there is), surely the
enforcement will be just as dodgy as other international
instruments. With that in mind, has there/is there any case of
someone being extradited from a country with no or lax computer
laws to a stricter regime?

[TheCotMan]

Merged the two identical threads to keep the content together.

Very nice of you.

Since Including questions e-mailed to her seems to be the trend, I've included some of mine too:

Can lack of memory be a point to hold someone in contempt of court? (In cases where data is encrypted and claims are made that the passphrase was forgotten.) What about perjury?

If evidence exists in a file that may or may not implicate you in a crime, and a passphrase is required, is the 5th amendment (right not to testify against yourself) applicable as a defense in not providing the passphrase?

How have the patriot act and other recent federal laws changed the way that alleged violations state laws on computer crime can be investigated?

How has the issue of "intent" changed in the past 8 years with respect to federal laws on computer crimes? Are students who have applied to grad schools, and later checked their acceptance status through a reformatted URL at risk for any new laws? How easy would it be fore these colleges to compute price tags to make them meet the minimum monetary damages
required for federal laws on computer crime? (No, this is not about me; it is an example of a trivial security break with seemingly small costs and a recent event.)

Several years ago, there were attempts to classify all dial-up connections to ISP to be considered out-of-state calls to allow for extra taxes. Assuming this passes/passed, how does it impact jurisdiction and enforcement of computer crimes? Does this make all dialup-originated attacks fall under the umbrella of "The Feds"? If not, can it be effectively argued to make all computer crimes over dial-up-ISP federal instead of state?

If a crime is federal, and feds choose not to prosecute, may states prosecute under their own laws that are related? Is there a risk for double-jeopardy for being prosecuted for technically different crimes
(federal and state) because of the same events/actions? How much risk?

[ndex]

My talk this year at Defcon will answer the top ten questions defcon attendees have about the law. My non-scientific means of getting the top ten questions is to post here in the forums and ask people with questions to email me at bhdefcon2005talk@hotmail.com with those questions. I'll then pick the most interesting and frequent ones to discuss in my talk. So if there's something about the law you want to know, send an email.

Thanks,

Jennifer Granick

Thank you Ms. Granick,
Here are some questions I have:

1. With the DMCA/Patriot Act in effect what is the current statute of limitations for alleged crimes committed before these acts were put in effect?

2. We've heard of numerous examples where, having a committed a crime, a person brags about it in an internet chat room. Does this constitute grounds for a warrant?

3. Barring self-incrimination (above); what is considered admissable evidence for the purposes of getting a warrant, indictment and conviction?

[renderman]

I put in my $0.02 in:

Greets from Canada,

A couple questions, mostly related to the wireless community and involvement in it.

The staggering amount of openly acessable wireless networks shows that there is an avenue for bad people to do bad things online in a virtually untraceable manner. Buy a Wifi NIC with Cash, drive to another town/city, do the dirty deed then toss the card in the river. Provided there was nothing in the attack that was traceable to an individual, it's seemingly impossible to figure out 'whodunnit'.

Questions are:

1. If someone is running an open access point (either through ignorance or intent), are they responsible for anything anymore that happens on thier net or originates from there? I foresee a situation of someone intentionally leaving an access point open in order to create doubt about who did what from a particular source (The "It was'nt me, it was someone on my wifi" defense)

2. Are there possibilities for criminal prosecution of people running open access points (either through stupidity or design) under various 'material support' laws for terrorism or crime?

3. For wardrivers who collect information about names, location, settings, etc of wireless networks and post them to public sites like www.wigle.net, could there be criminal repurcussions if someone used that information to commit a crime? Something under the 'aiding and abeting' area?

The community is very sure of the legality of wardriving and the sharing of our data, but the above are some grey area's that seem to come up often and given some law enforcements interest in streching thier reach, it would be nice to know if our butts are collectivly covered.

Render

[allentrace]

i know i've been wondering a great deal about a legal tech question recently. i even emailed the EFF but never got back a response. ah well, guess they're badly overworked lately.

here's the question i shot off to Jennifer just now...

Lawyers act as Third Parties so the simple answer to your question would be have a good "self-proving" will that has been witnessed and signed with all the formalities required by state law. In that will, include documentation and the passwords you have kept safe (to a bank account?) securely locked in a deposit box or some such. At the either untimely or timely arrival of your death the Lawyer will execute your last will and testament to the letter. It is important to note you must stipulate who has access to that safe box in the event of your death whether it be the lawyer or the wife make sure you put it in. Also to your question f whether you are incapacitated in some way and are not able to translate your wishes I would recommend a good "Living Will" that tells the manner in which your estate is to be divided to your heirs. These have become popular ever since the Schiavo case came to media attention.
Hope you enjoyed my knowledge on the subject as I have been a legal typist as well as a lawyers aid and will be attending Chase Law School within the next two semesters unless my trip too Japan gets in the way.