Hacker News Reader

Comment by julianj | Hacker News Reader

How is chain of custody maintained if the process is a secret? Couldn't a person argue that the data obtained was planted?

View on HN

Even if you can't authenticate evidence (chain of custody, disclosure of technical process, etc), you can still use the fruits of the analysis as long as acquisition of the phone wasn't illegal and the fruits can be proven independently after the fact. I imagine that in most situations law enforcement can make their case once information on the phone points them in the right direction, especially in high-profile cases where the government would spend a lot of money on a secret process.

Authentication is necessary because the prosecutor has the burden of proof, and part of meeting that burden of proof is making a facially sound case about the authenticity and reliability of each piece of evidence. But unlike, say, an illegal search, failure to meet that burden doesn't poison derivative evidence as long as that evidence is independently submissible.

Importantly, you don't need to authenticate evidence _before_ getting a warrant to take possession of the phone; at least not to the extent required at trial. And as far as I know there are no laws limiting how the government can extract information from a phone it legally possesses for investigatory purposes, which means any technical process would be entirely irrelevant to the legality of the search. So there's no way to force the government to divulge the process as long as they don't try to submit the information gained by that process directly as evidence.

But maybe I'm missing something.

They'll probably drop the case if the defense points this out (seriously, look at Stingrays).

But not so much for breathalyzers...

Breathalyzers will tell you what's up right on the spot, unless you've come across some that require the cops to collect a jar of your breath for processing at some remote discrete location?

Breathalyzers are easily tampered with by police to provide false readings. One case of this in New Jersey could have potentially thrown out 20,000 DWI cases. But breathalyzer results in cases today are not thrown out after pointing this out.

> after pointing this out.

What would you say, exactly?

If you said:

"your honor, breathalyzers can be tampered with to provide false readings"

It seems quite easy for anyone to respond with "how so?". Do you refer to "this one time in New Jersey"?

Are you asking me to explain how trial law works?

i have an expert that can explain various methods. Also, please release the device for the defenses inspection.

The prosecution will present calibration logs and security tampering prevention information to show that the device was independently verified as working correctly and demonstrably unchanged from that inspection date. A lot of people's careers rely on those records being correct, up to including a perjury charge if they're falsified.

IANAL. I had this talk with a lawyer friend a few weeks ago. I thought there was a way to show the design of the device is faulty - for example a speed gun at sunset reports inaccurate times. But it's a very high standard to get a court to allow that.

It's irrelevant that breathalyzers in New Jersey were tampered with. You would need to show evidence that the breathalyzer in your specific case was tampered with. It's a basic rule of evidence...

In this case, a few breathalyzers were not calibrated correctly, but the officer responsible for testing them claimed to have done so. Now every device and calibration procedure is called into question, as their results may not be as verifiably precise as required by law. The device itself is not claimed to have been tampered with.

http://www.nj.com/politics/index.ssf/2017/10/20k_dwi_cases_c...

That why where I live if you trigger the drink driving limit on a breathalyzer you're driven to the station where a medical professional will take your blood and send it to an independent lab.

Or they just do parallel construction.

They gather the evidence illegally, and the conjure up a legal means to re-find the evidence they already know exists.

What here is illegally gathered?

let's say you need a warrant to get X.

you use illegal methods to get X without a warrant. but you can't use that information legally. so you use your knowledge of X to find a legal way of learning X, after the fact.

then you go to the courts saying you found X the legal way.

but you didn't.

I understand the theory thanks, I'm just disputing that this scenario is anything other than exceptionally rare. Parallel construction is used to protect sensitive sources, not cover up illegality.

Nothing, if they have a warrant (or equivalent legal authorization).

But the reason most of us care about having our data encrypted is not actually because we are committing heinous felonies, and want our phones to hide the evidence from legitimate cops (though of course sometimes that’s the case).

It’s because we don’t trust the authorities to follow the law. If they can crack your phone legally, they can also crack it illegally. (Say, after seizing it within 100 miles of the border, which they can do any time they please for whatever reason (including no real reason)).

So even though this ability isn’t necessarily illegal in and of itself, it’s certainly of interest to those of us who are concerned about the threat vectors that are presented by government forces that do engage in illegal practices.

It's my personal belief that this line of thinking, which is common among "geeky" types but not among the general population, is a form of slight delusion or power fantasy.

Is there anything you can provide to convince me it's remotely possible?

>How is chain of custody maintained if the process is a secret? Couldn't a person argue that the data obtained was planted?

Well this is a more general issue (I mean not limited to this case or to sending a device to Cellebrite or to another external laboratory) once a chain of custody is formally valid, it has as much integrity as the integrity of the people that had physical access to or worked on the device.

Still - thankfully - "planting" evidence on a modern file system and OS (provided that the end result is an actual physical extraction) is not as easy as it may seem.

Definitely possible, but extremely difficult to achieve without leaving any trace behind.

Other articles stated the unlock could also be performed on premises for a hefty sum.

by the time anyone would challenge in court how an iOS 11 was broken, Apple would have released iOS 15, and the iOS 11 exploit would be public knowledge.

Reply on news.ycombinator.com