Questions tagged [encryption]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
53
votes
3answers
36k views

Would open source programs that use encryption be illegal under this draft of the “Compliance with Court Orders Act of 2016”

The U.S. congress has a draft for a bill that would require companies to fetch information from a device when requested by a court. A consequence of this is that many types of security technology ...
9
votes
1answer
350 views

Can law enforcement legally force someone to unlock a device themselves in the US?

We're all likely aware of the big Apple vs FBI case where the FBI wants to force Apple to open a back door in its encryption on iPhones, and we'll soon discover what the law will decide on that, but ...
8
votes
2answers
2k views

If police get a search warrant, does it have any limitations? Must the person turn over all passwords?

I'm not sure how to phrase this question and I guess it depends on circumstances. Say the police suspect you of building a bomb and a judge issues a warrant. To what extent can they search you and ...
8
votes
2answers
315 views

Does an Internet Service Provider rewriting TCP traffic to prevent SSL/TLS constitute wiretap?

Context: I rent two dedicated servers from a hosting provider, one on a yearly basisis, the other monthly. The Terms of Service and AUP state clearly that they are not to access the server or data ...
6
votes
1answer
536 views

Is throw-away-the-key-encryption allowed under GDPR?

Article 15 of the GDPR says: The data subject shall have the right to obtain [...] personal data [if it is being "processed"] Article 4 says that "processing" includes storage. Therefore, all ...
6
votes
1answer
1k views

Can you be legally compelled to disclose your password in a criminal investigation? [duplicate]

Let's say you use encryption on your computer, and you've been arrested. The police believe there is evidence on your computer, and have seized the computer via a warrant. The police cannot extract ...
6
votes
1answer
149 views

Can tech companies wishing to prevent secret backdoors discriminate in hiring against Australians?

Australia has passed a law which apparently requires tech workers to develop backdoors which can defeat a company's encryption and security features, without informing their employer, if ordered to do ...
4
votes
1answer
513 views

Can I be compelled by law to decrypt information in UK?

Is there any law currently in place within the UK that can force someone to decrypt information? Either by forcing them to supply the password/key or forcing them to provide the information in an ...
4
votes
2answers
3k views

Can a company be sued for storing plain-text passwords?

Even if most of the developers nowadays understand the necessity of encryption, a consequent amount of websites still store the user's password as plain-text. It can be easy to spot : just asking for ...
3
votes
2answers
171 views

Is brute forcing the password of an encrypted file legal?

A person I know sent me an encrypted .zip archive and I do not know what data is inside. Is it legal to break the password and open the archive, for example, by using a brute force algorithm? The ...
3
votes
3answers
9k views

Are encryption apps (iOS) exempt from US Export Regulations if released to the US App Store only?

Note: The original question in iTunes Connect regarding exemptions has since been changed to reflect recent changes made to their FAQ as follows: Does your app meet any of the following: (a) ...
3
votes
1answer
101 views

Laws surrounding publicly (ish) displaying decoded messages received over radio

POCSAG512, POCSAG1200 and POCSAG2400 is the protocol used by pagers to transmit information to one another. The problem I'm seeing here is that it is not encrypted, only encoded, as any broadcast has ...
3
votes
1answer
116 views

EU regulation for medical device communication encryption

In the US, HIPAA mandates that data communication with patient or healthcare data must be done according to FIPS 140-2 (pdf). E.g. use AES encryption with 128 bit keys or greater to encrypt. Are ...
3
votes
3answers
177 views

What does U.S. law expect developers to do to prevent access to web apps with encryption where export control applies?

What would be considered due diligence (or whatever the proper term is) in preventing users in export-control blacklisted countries from accessing a web application that features strong encryption ...
2
votes
2answers
433 views

How will credit card purchases NOT fall under the guidlines of the new Supreme Court ruling?

The intent of this new ruling by the Supreme Court is for anonymous networks but, when doing forensics on a wire in such a manner as to present to a judge, you can't tell what's inside those packets. ...
2
votes
1answer
162 views

Am I required to hand out my private encryption key by german law?

I have posted a question over at academia.stackexchange.com (see [1]) which involves a legal question that may better fit here. Context: I am a PhD student of a german university. Due to illness a ...
2
votes
2answers
205 views

Can this scheme be used to avoid forced disclosure?

Summary: Possible way to avoid the requirements of giving away the decryption key. Will this work? Many countries have laws forcing citizens to decrypt their private data if they are being suspected ...
2
votes
0answers
120 views

Open source encryption library pose export compliance

I am developing an app which will encrypt users files , photos etc. I use the open source library RNCryptor to do the operation . Does this make my app require export compliance ? . Does the export ...
1
vote
4answers
297 views

Can a one-time-pad provide legal immunity - (make data inadmissible) -?

IMPORTANT NOTE: This question is quite niche, I am not sure if this stack is the most relevant place, please inform me if there is a better place for it. To explain the question: I am asking if, a ...
1
vote
3answers
70 views

Does GDPR apply to personal information entered in a password-field?

If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply? For example if someone enters their email, phone number or name in a password-field? If so, ...
1
vote
1answer
167 views

Does encrypting Internet traffic (possibly) create a reasonable expectation of privacy?

The fourth amendment to the US constitution protects people from seizures and searches in certain situations for reasons of privacy. In Katz v United States, the US Supreme Court has defined a two-...
1
vote
1answer
276 views

What does the law say about the cloning of RFID tags?

In the UK, what does the law say regarding the legality of cloning RFID tags that you own, but did not generate? I'm particularly interested in cases like the Mifare Classic tags, where you may need ...
1
vote
2answers
105 views

What bodies of laws protect against the disclosure of private encryption keys?

I am interested in US law as well as European law, and curious about international/other countries law, if applicable. It is generally accepted that if you somehow find a private key (let's assume by ...
1
vote
2answers
139 views

Copyright and Encrypted Backups

A person's computer stores a variety of copyrighted files which they have a license to use and store (such as video games, operating system files, and purchased or freely available media). However, ...
1
vote
1answer
126 views

How commonly is PGP used by lawyers?

Lawyers have to constantly keep, send and receive confidential documents. What is be the most common encryption method used by lawyers today? PGP (Pretty Good Privacy) sounds to me to be the ...
1
vote
1answer
71 views

Is it ok to prevent users from exporting their data

Am I allowed to encrypt customers data residing on their servers, preventing them from exporting the data to a competition without my help. I need it to make sure the customer doesn't change ...
1
vote
1answer
230 views

Encrypted emails sent by employee under FOIA

Under the Freedom of Information Act, messages sent by government employees and officials can be disclosed in response to a FOIA request. If an individual whose communications were covered by FOIA ...
1
vote
1answer
73 views

Use of encryption and storage of personal information on website based in India

I want to launch a website that stores users' personal information, encrypts user passwords, and uses SSL for secure transmission. Do I require an license to launch the website? If yes, how do I ...
1
vote
0answers
63 views

Asking for the unencrypted version of a file in an open-source project?

Let's say that an open-source project, such as a GNU GPL one, uses git-crypt and has added private, encrypted files, such as ssh private keys to the committed git repository. Wouldn't John Doe be in ...
1
vote
0answers
188 views

Encryption key disclosure laws?

The UK's Investigatory Powers Act 2000 can force suspects to decrypt encrypted data or face two years in prison. What happens if an individual's private encryption key is managed by someone else ...
1
vote
0answers
106 views

Is it legal to send encrypted messages via a post card?

In German law, is it legal to send an encrypted message via a post card? E.g. encrypt a message text on a computer with RSA and print the Base64 hash on the post card and send it. Or is it a ...
1
vote
0answers
301 views

US export compliance document for ios

We are planning to update our app in App Store with some cryptographic implementations included in the next release. Reading about the App Store procedures for apps with any cryptography, it requires ...
1
vote
0answers
271 views

Encryption export compliance document in iOS app store

I am using encrypted core data (a wrapper of sqlcipher for core data) in my application in order to encrypt the database, and later before submitting the app to the appstore, I happened to notice that ...
0
votes
1answer
133 views

Dealing With A Private Institution Policy To Inspect All Encryption-capable Devices Leaving The Country

I am a student recently admitted to the University of Cincinnati, and I noticed something very peculiar and frightening in section 3.11 of their technology code of conduct. In light of clause 3.1, "...
0
votes
2answers
200 views

Is it illegal to keep an encrypted version of illegal data?

If I encrypt copyrighted data to which I have no right with a private key known only to me, am I infringing the copyright by holding only the encrypted version?
0
votes
2answers
379 views

Does selling certificates from Let's Encrypt violate their ToS?

A company I (unfortunately) worked for in the past is selling Let's Encrypt certificates for about 10€/month. I don't need to tell you that these certificates are free for everyone. The customers are ...
0
votes
1answer
96 views

Legal jurisdiction over cloud storage

I work on software that is a project of an encrypted cloud, created to protect users privacy. We use a javascript crypto library called SJCL. Only the user has the decryption key. That means only ...
0
votes
2answers
106 views

Does travelling through the US border with encrypted files break the law?

If I have encrypted files and I'm going to US, do I break any encryption import laws? Likewise, if I go out of US with those files, do I break any encryption export laws?
0
votes
2answers
3k views

Is a teacher/school administrator allowed to force me to decrypt my phone?

As in: My phone was just confiscated, but not before I shut it off. If they wanted to look through it without a warrent, can they force me to decrypt it? EDIT: USA is country-of-residency
0
votes
2answers
185 views

Is it illegal in the US to release software containing cryptography if there is no master key or backdoor or data retention?

If I made a proprietary piece of software that provided AES-256 encryption for IM, voice chat, and file transfer would this itself be illegal? The way it'd be set up is people would run the service ...
0
votes
1answer
166 views

Would the government have to prove that the information was unintelligible for them to use the “Compliance with Court Orders Act of 2016”?

The U.S. congress has a draft for a bill that would require companies to fetch information from a device when requested by a court. A consequence of this is that many types of security technology ...
0
votes
0answers
13 views

How will credit card purchases NOT fall under the guidlines of the new Supreme Court ruling? [duplicate]

The intent of this new ruling by the Supreme Court is for anonymous networks but, when doing forensics on a wire in such a manner as to present to a judge, you can't tell what's inside those packets. ...
-1
votes
1answer
59 views

Is encryption required by law? What are the legalities behind accessing user's data in firebase?

I am building a mobile messaging application. I am using Firebase to store and collect user's data including their name, email, as well as their contacts and messages. At the moment, since I am the ...