Hacker News Reader

Comment by INTPenis | Hacker News Reader

Why use email? I know some drug dealers who are pretty IT savvy and they simply setup Pidgin with OTR on their computers. Some had Macs with Adium.

Then they would message each other to go on OTR.

That's all you should send in an e-mail or text message, "go on OTR".

View on HN

If I understand correctly, the key feature of OTR is its plausible deniability; the messages you send do not have a digital signature that a third party can use to verify their integrity, but the other party in the conversation is able to verify them.

Is that really going to hold up in court? Surely by the same token I could dismiss absolutely everything there is any record of me sending or receiving over HTTP because it could theoretically have been forged or tampered with in transit.

The most useful feature (of course, not a unique feature) of OTR is perfect forward secrecy. This means that, unlike GPG, you can lose your private key and not give up everything you have ever encrypted.

The plausible deniability stuff is probably not that useful in court, as you note.

If the 'plausible deniability' is not that useful in court, that means it isn't plausible deniability. It's better to say that OTR doesn't provide plausible deniability, even though it claims to, if that's what you believe. (I don't have an opinion either way.)

It's plausible deniability, but that alone isn't sufficient to avoid prosecution in most jurisdictions.

The standard in most jurisdictions is proof beyond reasonable doubt. I don't think the OTR plausible deniability would be considered reasonable doubt, especially if the content of the messages is corroborated by other evidence.

I always thought the term plausible deniability implied reasonable doubt, and that if it didn't, it wasn't plausible deniability. I mean, there's not much point in claiming something offers plausible deniability if it isn't a valid defense in court. Or is there?

Do you have an example from actual case law? All I have is Wikipedia:

"Plausible deniability is also a legal concept. It refers to lack of evidence proving an allegation. Standards of proof vary in civil and criminal cases. In civil cases, the standard of proof is "preponderance of the evidence" whereas in a criminal matter, the standard is "beyond a reasonable doubt." If an opponent lacks incontrovertible proof (evidence) of their allegation, one can "plausibly deny" the allegation even though it may be true."

However, deniability becomes less plausible when there's other evidence that makes deniability harder... i.e. Someone claims to have had a conversation with you, the logs of the conversation exists and that person can corroborate that the person on one end was them. Of course you can claim that someone was impersonating you, but what if later you had a recorded phone conversation referencing the OTR conversation, etc.

In and of itself, a piece of evidence is plausibly deniable. In the face or corroborating evidence, it may not be.

Alas, however, I do not have an example from actual case law.

EDIT: I knew I had seen some case law sort of related to this before and it was in re Boucher and US v. Fricosu. They are not directly related to "Plausible Deniability", rather they compelled defendents to decrypt their hard drives. Certainly in the Boucher case there was reason to believe that the contents of the drive were incriminating (the file names were the giveaway, I believe) so perhaps this does not fit in to the exact facts we are trying to recreate, but those are the only two cases that relate that I can recall.

Thanks for elaborating, I better understand the claim that OTR plausible deniability is not that useful in court now.

Is plausible deniability an actual legal concept at all?

I see it used here and on other technical forums in topics like this, but aside from that I've only ever heard of it in political, not legal, contexts.

Any lawyers able to shed light?

Of course, if you use Adium with OTR, absolutely remember to disable logging which is on by default (http://trac.adium.im/ticket/15722).

While OTR might encrypt contents, isn't there still an IP trail at either end plus all the providers in between? A list of associates of a drug dealer is probably more harmful than what was said.

Yes, but the IP trail is from dealer A to gmail.com and dealer B to gmail.com. Along with non-dealer C through everyone else in the world.

Reply on news.ycombinator.com