17

Section 4, Definition 4 Covered Entity, emphasis added: The term "covered entity" means a device manufacturer, a software manufacturer, an electronic communication service, a remote computing service, a provider of wire or electronic communication service, a provider of a remote computing service, or any person who provides a product or method to ...


7

In the United States . . . Scope of Search Warrant: To what extent can they search you and your belongings? The scope of a search is limited by what is stated in the warrant. Not only must a warrant be supported by probably cause, it must also describe with particularity, "the place to be searched, and the persons or things to be seized." See U.S. ...


6

There is RIPA which allows a court to force you to divulge a decryption key. The penalty for not doing so is up to two years in prison, five if terrorism is involved. The Regulation of Investigatory Powers Act 2000 (RIPA), Part III, activated by ministerial order in October 2007,[20] requires persons to supply decrypted information and/or keys to government ...


5

As the question mentions, and as the answer by leaustinwile explains in some detail, it is impossible to prove by cryptanalysis that a given decoding of a communication encrypted via a one-time-pad (OTP or pad) is correct. That does not mean that there is no way to prove such a decryption accurate to the satisfaction of a court of law. If the storage or ...


5

Well, in this case, it is interesting to note one fact about the one-time pad. The key and the ciphertext are interchangable and indistinguishable. So rather then thinking about it as encryption, it is better to think of it as spliting in two. If the prosecution finds both pieces and can tie them to you, then they have a good evidence against you. Both parts ...


4

This is a super complex question and no one really knows the answer yet. Orin Kerr is probably the leading scholar on this question, and he generally argues that forced decryption of one's own device is not a Fifth Amendment violation. As I understand it (and oversimplifying by a lot), one key piece of his position is that requiring you to put in your ...


4

TL;DR In theory there's nothing wrong with your method, it's just a way to authenticate the user, and without authentication a user has no right to request anything anyway. But in practice it looks like your method doesn't have a way to deal with situations where users lose or forget their authentication data and want to be able to recover their account. ...


4

If you aren’t the intended recipient of the password-protected file: StGB § 202a makes it illegal to access this file StGB § 202c makes it illegal to obtain (e.g., by brute forcing) the password for this file, if you intend to access the file that way (in the sense of § 202a) (this is the so-called hacker paragraph) If you are the intended recipient, this ...


4

You're completely misreading the goals and purpose of the Export Controls Office - Overview. They regulate the transfer of US regulated information and technology, commodities, and software in the interest of national security and economic growth. Transfer and export are not the same as the use of technology that personal devices contain. The simplest ...


3

Mere possession of copyrighted material does not infringe any of the copyright holder's exclusive rights.1 This conclusion is echoed by Jay Dratler: Nothing in copyright law prohibits the mere possession of an unauthorized copy of a copyrighted work.2 From the Fifth Circuit: The copyright owners not only had no interest in the tangible video ...


3

There is good hope that this draft will never be turned into a law, if you read headlines like on theregister: "Read America's insane draft crypto- Understandable – it's more stupid than expected" Creating the encryption is perfectly legal. You might be asked to help recover encrypted data. There is no mention of cost; I doubt that you could be asked to ...


3

The Electronic Frontier Foundation, a San Francisco-based digital rights non-profit, specifically advises to use encryption when crossing the US borders. Read more at https://www.eff.org/wp/digital-privacy-us-border-2017. While the EFF doesn't say that using encryption would be illegal, keep in mind that the US borders are a gray area, legally-speaking, and ...


3

The law in every country where your service is available prevails. That means that if your servers are in Estonia, your file storage is in Lithuania, your company is in Switzerland, you are in France, you hold Thai citizenship, your users are in the USA and the signal transits through the U.K., Belgium, Germany, Canada and Poland then you are subject to the ...


3

Update (12/2/16) - Just received the following confirmation from Apple Export Compliance: The [redacted] app presently uploaded into your account CAN BE legally released to US and Canada only, it will not be necessary to go through Export Regulations. They have also rephrased the question "Does your app qualify for any of the exemptions...?" to the ...


2

This question, along with a number of articles on the Internet, misconstrues what the rule change is about. The rule change does not say that you can get a search warrant, that is to enter premises with/without machineguns etc, solely on the basis that someone is running Tor on that premises. The rule changes actually has nothing to do with search warrants. ...


2

Unfortunately I believe that this is legal in most places, provided your agreements don't say anything to the contrary, and provided that the users can still view the information.


2

Yes a company can be sued (since anyone can sue anyone). But in order to win a lawsuit, you have to have damages as a result of some action, AND you must prove that the action was done with intent to harm or was otherwise negligent. So following your website example, a lot of things would have to happen: The website would have to be hacked. If the ...


2

According to Josh Aas, Internet Security Research Group (ISRG) Executive Director, (the umbrella 501(c)(3) for Let's Encrypt): "It is not against our terms to charge for services using our certificates, though we'd strongly prefer that HTTPS just be part of every offering as a default with no additional fees." My host sells SSL letsencrypt ...


2

Lawyers use the same kinds of encryption found in any other corporate environment: TLS for secure web browsing, private messaging and virtual private networking, and FileVault or BitLocker for full-disk encryption. While lawyers often deal with confidential documents, most lawyers (and clients) lack the technical skills to manually encrypt documents using ...


2

Public schools are on a shorter legal leash than private schools are, because they must behave like proper governments do and respect the constitutional rights of their charges. (First Amendment rights are much broader in public schools than they are in private schools). Assuming that we're in a public school, a search of your phone is governed by a watered-...


2

The hosting provider could indeed argue that disabling encryption of your SMTP to protect their network does fall under the category of "being used...in the ordinary course of its business". They are also "the provider of electronic communication", both of which give them a huge argument of immunity granted by section 5(a)(2). other than— (a)(ii) ...


2

I'm going to go with yes, it's legal but it's not advised. But first, allow me to explain: I believe the contents of the file will be what determines whether or not you break the law. Whilst you may be the intended recipient of this encrypted file, the subject of "how" you access it will not the issue. Yes, you could crack the password on it but if you are ...


2

The problem is going to be the "need to perform an exploit to find encryption keys." I'm sure you agreed to a software/hardware license with the purchase of the tags, and the license and/or TOS probably forbids reverse engineering or the use of an exploit to be able to do anything with the tags other than use them in the manner that Mifare clearly dictates, ...


2

Your question is based on a false premise Part 15 of the Telecommunications Act 1997 does not apply to Australian citizens - it applies to Designated Communications Providers as defined in s317C. There are 15 ways a person or corporation can be a Designated Communications Provider so I'm not going to list them. However, none of them have anything to do with ...


2

This might be an unnecessary subtle point, but the goal of the GDPR isn't to protect personal data as some abstract concept – it regulates how personal data can be processed. For an organisation's compliance obligations, it matters for what purposes they collect and process personal data. You can't shove sensitive personal data on an unsuspecting recipient ...


2

It is Illegal Specifically, it is in breach of s7 of the TELECOMMUNICATIONS (INTERCEPTION AND ACCESS) ACT 1979: (1) A person shall not: (a) intercept; (b) authorize, suffer or permit another person to intercept; or (c) do any act or thing that will enable him or her or another person to intercept; a communication passing over a telecommunications system....


2

This is a very difficult matter, as it touches different parts of laws. IANAL, but I have been trained on several parts of labour law so I can point out some aspects. What can you do with the computer at work? If not declared by some agreement otherwise, a computer at work can only be used for work purposes. Your employer supplies you with tools (in this ...


Only top voted, non community-wiki answers of a minimum length are eligible