33 votes
Accepted

Am I obligated to decrypt lots of data for GDPR requests?

It is the data controller's responsibility to respond to data subject requests. If you provide a B2B service, you are most likely a data processor who only acts on the controller's behalf, on the ...
user avatar
  • 17.1k
17 votes

Would open source programs that use encryption be illegal under this draft of the "Compliance with Court Orders Act of 2016"

Section 4, Definition 4 Covered Entity, emphasis added: The term "covered entity" means a device manufacturer, a software manufacturer, an electronic communication service, a remote computing ...
user avatar
  • 4,509
17 votes
Accepted

Does GDPR apply if my web app stores personal data on the user's phone only?

Does GDPR apply if my web app stores personal data on the user's phone only? No. If you are not processing Personally Identifiable Information (PII) then the GDPR does not apply to you. This is ...
user avatar
  • 1,281
12 votes

Does GDPR apply if my web app stores personal data on the user's phone only?

You're probably a data controller, but you have taken pretty good steps to limit your compliance obligations. Personal data is any information relating to an identifiable person. You are a data ...
user avatar
  • 17.1k
11 votes
Accepted

If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?

The GDPR does not have specific rules on passwords. Instead, the GDPR imposes a more general requirement to ensure data protection by implementing “appropriate” technical and organizational measures, “...
user avatar
  • 17.1k
7 votes

If police get a search warrant, does it have any limitations? Must the person turn over all passwords?

In the United States . . . Scope of Search Warrant: To what extent can they search you and your belongings? The scope of a search is limited by what is stated in the warrant. Not only must a ...
user avatar
  • 1,671
7 votes

Can a one-time-pad provide legal immunity - (make data inadmissible) -?

If it was for a criminal case, the jury would have to decide if they believed the person who claimed he/she cracked the code. Really, any evidence is interpreted by the jury if it is regarding facts....
user avatar
  • 3,840
6 votes

Can I be compelled by law to decrypt information in UK?

There is RIPA which allows a court to force you to divulge a decryption key. The penalty for not doing so is up to two years in prison, five if terrorism is involved. The Regulation of Investigatory ...
user avatar
6 votes
Accepted

Is throw-away-the-key-encryption allowed under GDPR?

TL;DR In theory there's nothing wrong with your method, it's just a way to authenticate the user, and without authentication a user has no right to request anything anyway. But in practice it looks ...
user avatar
  • 1,778
5 votes

How will credit card purchases NOT fall under the guidlines of the new Supreme Court ruling?

This question, along with a number of articles on the Internet, misconstrues what the rule change is about. The rule change does not say that you can get a search warrant, that is to enter premises ...
user avatar
5 votes
Accepted

Can a one-time-pad provide legal immunity - (make data inadmissible) -?

As the question mentions, and as the answer by leaustinwile explains in some detail, it is impossible to prove by cryptanalysis that a given decoding of a communication encrypted via a one-time-pad (...
user avatar
  • 89.6k
5 votes

Can a one-time-pad provide legal immunity - (make data inadmissible) -?

Well, in this case, it is interesting to note one fact about the one-time pad. The key and the ciphertext are interchangable and indistinguishable. So rather then thinking about it as encryption, it ...
user avatar
4 votes

Legal jurisdiction over cloud storage

The law in every country where your service is available prevails. That means that if your servers are in Estonia, your file storage is in Lithuania, your company is in Switzerland, you are in France, ...
user avatar
  • 148k
4 votes

Can you be legally compelled to disclose your password in a criminal investigation?

This is a super complex question and no one really knows the answer yet. Orin Kerr is probably the leading scholar on this question, and he generally argues that forced decryption of one's own device ...
user avatar
  • 43.4k
4 votes
Accepted

Is a teacher/school administrator allowed to force me to decrypt my phone?

Public schools are on a shorter legal leash than private schools are, because they must behave like proper governments do and respect the constitutional rights of their charges. (First Amendment ...
user avatar
  • 157k
4 votes

Is brute forcing the password of an encrypted file legal?

If you aren’t the intended recipient of the password-protected file: StGB § 202a makes it illegal to access this file StGB § 202c makes it illegal to obtain (e.g., by brute forcing) the password for ...
user avatar
  • 1,138
4 votes
Accepted

Dealing With A Private Institution Policy To Inspect All Encryption-capable Devices Leaving The Country

You're completely misreading the goals and purpose of the Export Controls Office - Overview. They regulate the transfer of US regulated information and technology, commodities, and software in ...
user avatar
  • 17.5k
3 votes

Does selling certificates from Let's Encrypt violate their ToS?

According to Josh Aas, Internet Security Research Group (ISRG) Executive Director, (the umbrella 501(c)(3) for Let's Encrypt): "It is not against our terms to charge for services using our ...
user avatar
  • 17.5k
3 votes

Is it illegal to keep an encrypted version of illegal data?

Mere possession of copyrighted material does not infringe any of the copyright holder's exclusive rights.1 This conclusion is echoed by Jay Dratler: Nothing in copyright law prohibits the mere ...
user avatar
  • 3,874
3 votes

Would open source programs that use encryption be illegal under this draft of the "Compliance with Court Orders Act of 2016"

There is good hope that this draft will never be turned into a law, if you read headlines like on theregister: "Read America's insane draft crypto- Understandable – it's more stupid than expected" ...
user avatar
  • 24.6k
3 votes

Does travelling through the US border with encrypted files break the law?

The Electronic Frontier Foundation, a San Francisco-based digital rights non-profit, specifically advises to use encryption when crossing the US borders. Read more at https://www.eff.org/wp/digital-...
user avatar
  • 163
3 votes
Accepted

Are encryption apps (iOS) exempt from US Export Regulations if released to the US App Store only?

Update (12/2/16) - Just received the following confirmation from Apple Export Compliance: The [redacted] app presently uploaded into your account CAN BE legally released to US and Canada only, it ...
user avatar
3 votes
Accepted

Can a company be sued for storing plain-text passwords?

Yes a company can be sued (since anyone can sue anyone). But in order to win a lawsuit, you have to have damages as a result of some action, AND you must prove that the action was done with intent to ...
user avatar
  • 331
3 votes

Is it legal to send encrypted messages via a post card?

Article 10 (1) Basic Law / Art. 10 Abs. 1 Grundgesetz: The privacy of correspondence, posts, and telecommunications shall be inviolable. You can send whatever you want via postcard (as long as it ...
user avatar
  • 516
3 votes

If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?

GDPR regulations on the whole do not actually mention passwords (source: Information Commissioner's Office UK, this may vary in other country's implementation of GDPR) and providing that the data is ...
user avatar
3 votes
Accepted

Is it legal to make encryption breaking technology public?

There are two processes that go on all the time, and are generally considered legal: Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a ...
user avatar
2 votes

How will credit card purchases NOT fall under the guidlines of the new Supreme Court ruling?

The language includes changes like inserting the underlined text in "A summons is served on an organization in a judicial district of the United States by delivering a copy to an office...", ...
user avatar
  • 157k

Only top scored, non community-wiki answers of a minimum length are eligible