15

Section 4, Definition 4 Covered Entity, emphasis added: The term "covered entity" means a device manufacturer, a software manufacturer, an electronic communication service, a remote computing service, a provider of wire or electronic communication service, a provider of a remote computing service, or any person who provides a product or method to ...


7

In the United States . . . Scope of Search Warrant: To what extent can they search you and your belongings? The scope of a search is limited by what is stated in the warrant. Not only must a warrant be supported by probably cause, it must also describe with particularity, "the place to be searched, and the persons or things to be seized." See U.S. ...


7

If it was for a criminal case, the jury would have to decide if they believed the person who claimed he/she cracked the code. Really, any evidence is interpreted by the jury if it is regarding facts. 1) An issue of fact, not law. A question of fact is resolved by a trier of fact, i.e. a jury or, at a bench trial, a judge, weighing the strength of ...


5

There is RIPA which allows a court to force you to divulge a decryption key. The penalty for not doing so is up to two years in prison, five if terrorism is involved. The Regulation of Investigatory Powers Act 2000 (RIPA), Part III, activated by ministerial order in October 2007,[20] requires persons to supply decrypted information and/or keys to ...


5

As the question mentions, and as the answer by leaustinwile explains in some detail, it is impossible to prove by cryptanalysis that a given decoding of a communication encrypted via a one-time-pad (OTP or pad) is correct. That does not mean that there is no way to prove such a decryption accurate to the satisfaction of a court of law. If the storage or ...


4

If you aren’t the intended recipient of the password-protected file: StGB § 202a makes it illegal to access this file StGB § 202c makes it illegal to obtain (e.g., by brute forcing) the password for this file, if you intend to access the file that way (in the sense of § 202a) (this is the so-called hacker paragraph) If you are the intended recipient, this ...


4

Well, in this case, it is interesting to note one fact about the one-time pad. The key and the ciphertext are interchangable and indistinguishable. So rather then thinking about it as encryption, it is better to think of it as spliting in two. If the prosecution finds both pieces and can tie them to you, then they have a good evidence against you. Both parts ...


3

This is a super complex question and no one really knows the answer yet. Orin Kerr is probably the leading scholar on this question, and he generally argues that forced decryption of one's own device is not a Fifth Amendment violation. As I understand it (and oversimplifying by a lot), one key piece of his position is that requiring you to put in your ...


3

The law in every country where your service is available prevails. That means that if your servers are in Estonia, your file storage is in Lithuania, your company is in Switzerland, you are in France, you hold Thai citizenship, your users are in the USA and the signal transits through the U.K., Belgium, Germany, Canada and Poland then you are subject to the ...


3

Update (12/2/16) - Just received the following confirmation from Apple Export Compliance: The [redacted] app presently uploaded into your account CAN BE legally released to US and Canada only, it will not be necessary to go through Export Regulations. They have also rephrased the question "Does your app qualify for any of the exemptions...?" to the ...


3

The Electronic Frontier Foundation, a San Francisco-based digital rights non-profit, specifically advises to use encryption when crossing the US borders. Read more at https://www.eff.org/wp/digital-privacy-us-border-2017. While the EFF doesn't say that using encryption would be illegal, keep in mind that the US borders are a gray area, legally-speaking, and ...


3

TL;DR In theory there's nothing wrong with your method, it's just a way to authenticate the user, and without authentication a user has no right to request anything anyway. But in practice it looks like your method doesn't have a way to deal with situations where users lose or forget their authentication data and want to be able to recover their account. ...


2

There is good hope that this draft will never be turned into a law, if you read headlines like on theregister: "Read America's insane draft crypto- Understandable – it's more stupid than expected" Creating the encryption is perfectly legal. You might be asked to help recover encrypted data. There is no mention of cost; I doubt that you could be asked to ...


2

This question, along with a number of articles on the Internet, misconstrues what the rule change is about. The rule change does not say that you can get a search warrant, that is to enter premises with/without machineguns etc, solely on the basis that someone is running Tor on that premises. The rule changes actually has nothing to do with search warrants. ...


2

Unfortunately I believe that this is legal in most places, provided your agreements don't say anything to the contrary, and provided that the users can still view the information.


2

Yes a company can be sued (since anyone can sue anyone). But in order to win a lawsuit, you have to have damages as a result of some action, AND you must prove that the action was done with intent to harm or was otherwise negligent. So following your website example, a lot of things would have to happen: The website would have to be hacked. If the ...


2

According to Josh Aas, Internet Security Research Group (ISRG) Executive Director, (the umbrella 501(c)(3) for Let's Encrypt): "It is not against our terms to charge for services using our certificates, though we'd strongly prefer that HTTPS just be part of every offering as a default with no additional fees." My host sells SSL letsencrypt ...


2

Lawyers use the same kinds of encryption found in any other corporate environment: TLS for secure web browsing, private messaging and virtual private networking, and FileVault or BitLocker for full-disk encryption. While lawyers often deal with confidential documents, most lawyers (and clients) lack the technical skills to manually encrypt documents using ...


2

Public schools are on a shorter legal leash than private schools are, because they must behave like proper governments do and respect the constitutional rights of their charges. (First Amendment rights are much broader in public schools than they are in private schools). Assuming that we're in a public school, a search of your phone is governed by a watered-...


2

Mere possession of copyrighted material does not infringe any of the copyright holder's exclusive rights.1 This conclusion is echoed by Jay Dratler: Nothing in copyright law prohibits the mere possession of an unauthorized copy of a copyrighted work.2 From the Fifth Circuit: The copyright owners not only had no interest in the tangible video ...


2

The hosting provider could indeed argue that disabling encryption of your SMTP to protect their network does fall under the category of "being used...in the ordinary course of its business". They are also "the provider of electronic communication", both of which give them a huge argument of immunity granted by section 5(a)(2). other than— (a)(ii) ...


2

I'm going to go with yes, it's legal but it's not advised. But first, allow me to explain: I believe the contents of the file will be what determines whether or not you break the law. Whilst you may be the intended recipient of this encrypted file, the subject of "how" you access it will not the issue. Yes, you could crack the password on it but if you are ...


2

The problem is going to be the "need to perform an exploit to find encryption keys." I'm sure you agreed to a software/hardware license with the purchase of the tags, and the license and/or TOS probably forbids reverse engineering or the use of an exploit to be able to do anything with the tags other than use them in the manner that Mifare clearly dictates, ...


2

Your question is based on a false premise Part 15 of the Telecommunications Act 1997 does not apply to Australian citizens - it applies to Designated Communications Providers as defined in s317C. There are 15 ways a person or corporation can be a Designated Communications Provider so I'm not going to list them. However, none of them have anything to do with ...


1

I know of no law that bans disclosure of private encryption keys. This news article: Lawsuit Dropped Against DVD Copy-Protection Hack deals with acquittals both in Europa (Norway) and the USA in high profile cases where people were charged with distributing such keys. (I most jurisdictions, using such keys to gain unlawful access to secret or copyrighted ...


1

You shouldn't redistribute the key if you know a person will use it to crack the software. These are a few subsections from the law in the UK. This section applies where— (a)effective technological measures have been applied to a copyright work other than a computer program; and (b)a person (B) does anything which circumvents those measures knowing, ...


1

I believe DMCA settled this question once and for all, in favor of broad permission to replicate copyrighted software for the purpose of making backups. The government basically doesn't want to be in the business of regulating or litigating legitimate backups. However, these backups cannot be sold or shared.


1

Copyright law allows making backups for personal use.


Only top voted, non community-wiki answers of a minimum length are eligible