Run a script when police raid your house

by lpman • 12 years ago

106 132 12 years ago

kefka• 12 years ago

Or well known as a dead man's switch.

Speaking tangentially, what is the current state of the art of homomorphic encryption? I found this: https://hcrypt.com/ - Anyone try it yet?

Practicality• 12 years ago

It's difficult to think of things you could watch that would only occur during a raid. The examples given: ethernet and wi-fi, both go down much more often than you would like to think. Usually it's only for microseconds, but if you have a program that happens to check right then, there goes your encryption keys.

A tweak to the code would be to make sure that the sensor stays in the fail state for a particular duration. Even a few seconds would get rid of a lot of the false positives.

ipsin• 12 years ago

I really like his sort of thing, but realize that, like anti-forensics tools, there is a risk to having and using destructive anti-tamper triggers.

If the police actually think you're up to something, raid you, and your "cybernetic boobytrap" destroys your hundreds of GB of actual random data, they may still try and prove that you're a terrible person and destroyed evidence in court. Then it's up to a jury, and a prosecutor bent on making you look guilty as hell.

I'm not trying to dissuade exploration, but understand what can happen if you actually deploy this sort of system.

nateberkopec• 12 years ago

IANAL: what could actually happen to you, legally, if your hard-drive self-destructs after being tampered with?

Is that really "destroying evidence?" What if you just shut down the computer, rendering the hard drive unusable, its contents completely encrypted (a la TrueCrypt). The evidence isn't destroyed, it's just inaccessible.

wyldfire• 12 years ago

What if you just shut down the computer

Good idea. It's probably the safest/most paranoid to trigger an NMI or bus reset. Should be extremely low latency.

tomtoise• 12 years ago

Not sure which country you hail from, but I know that there are laws compelling you to hand over keys generally worldwide[1]. So I guess it depends if the crime you're guilty of (Otherwise why would you even need to hide everything) outweighs the punishment for withholding keys.

[1]http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingd...

detaro• 12 years ago

IANAL as well, and obviously depends on the jurisdiction, but as far as I understand previous discussions: using a tamperproof or encrypted disk is mostly fine. Actively triggering anything that destroys data after you've been become aware of the fact that law enforcement has a warrant is not.

Dead-man switch kind of things are harder to categorize, e.g. having a daemon format the disk if GPS reports locations outside a certain area, or if you don't press a key kombination every 2 minutes (is one allowed to lie about them if asked?)

if you just use encryption you might be forced to turn over the keys.

maxlybbert5• 12 years ago

In the US, it's generally a crime to destroy evidence if you believe there's an investigation. So setting something up to respond to evidence of an investigation seems like a bad idea to me.

In the US, it's also possible to be held in contempt of court for failing to hand over evidence in some cases. There's the Fifth Amendment, but there are enough exceptions to the Fifth Amendment (e.g., I'm not actually charged with a crime, and instead I'm facing fines for not having the right licenses; or the evidence on my computers is meant to be used in proving somebody else committed a crime) that I would want to talk to a lawyer before telling a judge that "the evidence isn't destroyed, it's just inaccessible."

danielweber• 12 years ago

The evidence isn't destroyed, it's just inaccessible.

This isn't Star Trek. You don't win by outsmarting the computer like Captain Kirk does.

The courts have dealt with these "I'm so clever" tricks thousands of times. They have little patience for them.

gpcz• 12 years ago

This program makes me nervous because its primary use case is to obstruct justice, which the author tries to get away from with a thinly-veiled excuse that it could also be used to defend against criminals. I understand that technology is ethically neutral (for example, this program could be used to hinder reverse-engineering of a sealed computing appliance), but the fact that they're basically advertising this thing to obstruct police investigations puts me off.

skrebbel• 12 years ago

Offtopic nitpick: technology is not ethically neutral but simply amoral. The lawnmower that cuts of your foot doesn't have issues with your foot. It's just rotating blades.

iak8god• 12 years ago

This program makes me nervous because its primary use case is to obstruct justice, which the author tries to get away from with a thinly-veiled excuse that it could also be used to defend against criminals

I agree that there's a problem with the author's messaging, but I think the problem is with this first as a tool for "when your house gets raided by the police..."

There are all kinds of reasons to encrypt your data. Some of them involve obstructing justice, some involve protecting oneself from "justice," but there are many others. If you have a good reason to encrypt, then you probably have good reasons to protect your system using a program like this.

Leaving aside the State, and more mundane robberies, some people have good reasons to be concerned about industrial espionage[1]. Tools like this seem like a good way to counter that.

[1] http://www.infoworld.com/article/2615610/data-security/when-...

NoMoreNicksLeft2• 12 years ago

This program makes me nervous because its primary use case is to obstruct justice

Given the number of raids that happen based on false CI information, typoed street addresses, or government overreach... it's not clear that the program is meant to be used primarily for that.

The police aren't our friends. They don't protect us individually or collectively. Often we need to be protected from them. Any tool that can help with that is a good thing.

hkhkhhjhnbv• 12 years ago

advertising this thing to obstruct police investigations

You mean, like a lawyer?

a3n4• 12 years ago

If I were using it, its primary use case would be to prevent my personal or business data from falling into the hands of criminals.

Read into that any double meaning you like.

earthrise2• 12 years ago

Yeah, when I made this program two years ago I never intended it to be taken this seriously. I added a big disclaimer to the readme.

stronglikedan• 12 years ago

I'd probably rather them have no evidence and accuse me of destroying it, than for them to have evidence.

Kequc• 12 years ago

Digital laws are so barbaric and unbalanced today. I'd be worried they'd find a copy of an xfiles episode in some subfolder somewhere or god knows what. All of a sudden I'm facing federal prison and fines sizeable enough to ruin my entire life just because I was being 'accused' of xyz?

I'll take the contempt of court conviction.

kbart• 12 years ago

Not to be picky, just interested. What's the reason behind using a daemon instead of simply running sensor check scripts in Cron? Or even better, raise interrupt when sensor fails, so you don't have to wait 30s (in worst case).

cryoshon• 12 years ago

Wouldn't it be more practical to change things so that the cops aren't raiding houses all the time?

justizin3• 12 years ago

More effective, yes, but more practical, not so much IMO.

I'm eager to see your github repository for fixing the police. :)

towelguy• 12 years ago

It would be more practical to go live where cops aren't raiding houses all the time.

I wonder why DPR wasn't living in some tropical riviera instead of the US.

pluma3• 12 years ago

But no other country has as many freedoms as the US. Everybody knows the world envies Americans for their freedoms and democracy, don't they?

e40• 12 years ago

The interesting part would be information about available sensors, and I see none of that at the link provided. Too bad.

the8472• 12 years ago

You basically have to script your own, depending on your system.

Case instrusion sensor, availability of your network, inertial sensors.

Hotplug events are especially interesting. There are Firewire memory dumpers or attempts to reboot from an USB stick. And they simply might have to unplug things if they want to physically move the machine, even if they have spliced the power source.

Not everyone has the same hardware.

mathetic• 12 years ago

SWATd is a daemon for running scripts when your house gets raided by the police (or broken into by criminals).

It's funny how the distinction seems blurry at times.

malka2• 12 years ago

Especially with this no knock raid trend.

NoMoreNicksLeft2• 12 years ago

It's not blurry at all. The police get to decide what is criminal and what isn't... so they're always the good guys.

pluma3• 12 years ago

It's not blurry. It's occasionally non-existant, that's all.

smoyer• 12 years ago

I think you could accomplish a similar function using the proximity of a cell phone to a laptop (like this: http://www.novell.com/coolsolutions/feature/18684.html). If the script shuts the laptop down when it's too far from the phone, that's perfect for me.

acveilleux• 12 years ago

Well, for non-destructive actions that's probably good enough.

For destructive actions (say zeroing an RSA private key or some sort of master key, wiping an HSM, etc.) than you would want a system where the likelihood of false negatives is minimized only so far as the likelihood of a false positive is very remote.

In the former case, you could be compelled to provide the password (or equivalent). In the later case, even if you do they have to brute force the crypto container (assuming no backup of the destroyed data can be found.)

HSMs generally behave destructively to tampering and normally are the exclusive holder of a specific key. They tend to have a metal casing that protects the tamper detection mechanisms from accidental triggering and redundant batteries to avoid running out of power (which is normally a trigger for self-erasure through de-powering SRAM or running off of a capacitor with an high-priority non-maskable power-loss interrupt to trigger zeroing.)

cmdkeen3• 12 years ago

This is where you need to separate the data from the encryption, and where external hardware based authentication becomes useful. If you have a hardware authentication you can destroy the device without losing data, and depending on the ease of getting a new device hold up the ability to access said data. There are all sorts of things you could look at wrt securing/destroying the device, GPS location etc.

If you were to have the devices be stored / issued from somewhere outwith the jurisdiction of your state you might even have something that could stand up to the law. But then you have to worry about someone tampering with the devices - but by that point you're up against intelligence agencies and realistically you can't do anything to stop them - after all your device is Tempest secured, air gapped from the internet etc etc.

SlipperySlope• 12 years ago

Thank you for sharing a clever script that has many uses!

However ...

Ideally, your computer should be secure against physical access and not need to run a script.

This is a solved problem in the intelligence and defense communities which have policies such as physical key storage, e.g. PIN enabled encrypted USBs, encrypted file systems, multifactor authentication and such to defeat forensic tools operated by an adversary.

Suppose you are a military or intelligence officer carrying around a laptop with secret stuff on it. How do you think that laptop is secured so that its safe even in the hands of an adversary.

Far more likely than a police raid, is the accidental trigger of the script, e.g. the house painter needs to move your server a bit to get to the wall behind it!

jordsmi• 12 years ago

This is a solved problem in the intelligence and defense communities which have policies such as physical key storage, e.g. PIN enabled encrypted USBs, encrypted file systems, multifactor authentication and such to defeat forensic tools operated by an adversary.

That doesn't really help if they grab your pc while you are in the middle of a session while your data is already decrypted.

nkw5• 12 years ago

IAALBIANYL, so I will leave whether or not this would be operationally useful to those smarter than me, but from a legal standpoint, one should be aware that operation of a system like this as far as the United States would likely result in additional charges for obstruction of justice[1].

It is by no means unusual for the government to fail in the prosecution of the original crime they investigated, but succeed in convicting a defendant for obstruction. (See, e.g. Martha Stewart[2]). In fact it is not at all impossible (though not likely) to imagine a scenario in which someone committed no crime, was running a utility like this, and was eventually charged with obstruction. Say I'm Brian Q. Krebs, some nice people on the Internet decide to swat[3] me confusing me with someone with a similar name[4], police enter my house, swatd deploys and ambitious and creative young prosecutor decides to charge me with a violation of 18 USC 1519. Might not succeed, but boy will he get some press.

As always, the best advice if you are going to engage in a wide-ranging criminal conspiracy is to make sure you have some goofy-reasoned memos from DOJ lawyers approving your activities[5] and Congress on call to provide you retroactive immunity[6].

[1] 18 U.S.C. 1519 (or 1001 or 1501, or 1510) - http://www.law.cornell.edu/uscode/text/18/1519

[2] http://en.wikipedia.org/wiki/Martha_Stewart#Stock_trading_ca...

[3] http://en.wikipedia.org/wiki/Swatting

[4] http://krebsonsecurity.com/tag/swatting/

[5] http://en.wikipedia.org/wiki/Torture_Memos#Letter_from_John_...

[6] http://en.wikipedia.org/wiki/Amnesty_law#United_States or http://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillan...

saganus2• 12 years ago

IAALBIANYL - I'm thinking this means "I Am A Lawyer But I Am Not Your Lawyer"? I haven't seen this before but it seems to make sense. Or does it mean something else?

nkw5• 12 years ago

You got it.

fencepost5• 12 years ago

Frankly, if I were in a place or doing activities where I thought a police raid was a significant possibility, I'd MUCH rather have something that would trigger video AND AUDIO recording from multiple cameras in the house, placed in locations where they wouldn't be "accidentally" knocked over or otherwise destroyed and with the data going offsite immediately via any of several channels (e.g. home network, home wifi, neighbor wifi, public/semipublic wifi (e.g. "xfinitywifi"), LTE phone).

Alternately, always have the recording going to something local, but trigger offsiting it with something like this and otherwise have a very limited timeframe for keeping it.

The other VERY VERY important piece of this I suspect would be notices posted at every possible entrance to the house, something like "Video and audio recording occur on these premises. By entering, you consent to this recording and to the use and public disclosure of these recordings. If you do not consent to these recording, use and disclosure policies, please call (xxx) xxx-xxxx and schedule an appointment." Perhaps I should call this a kick-through license - I'm not sure it'd stand up, but I suspect you'd have a pretty decent chance of that.

Of course, I'm boring, not inclined to activities likely to inspire either police interest or SWATing, and I live in a mostly-white townhouse community in the 'burbs. My most likely home invasion would be because "you are in a maze of twisty drives and townhouse units, all alike."

ryanmarsh15• 12 years ago

It's probably my PTSD but my biggest fear is getting raided by SWAT in a "wrong house" mixup or for some other stupid reason. In such an instance I would likely kill one or more of them. I have a family in my house that could be injured by them in the process. I've always wanted a camera system that had remote encrypted storage so I could prove the truth in court.

I just re-read this comment and I'm clearly nuts.

bithush• 12 years ago

If you live in a "no knock" state you are not nuts at all. I am from the UK and think the whole no knock thing is insane when everyone has easy access to guns (both legally and illegally). It is just asking for people to die.

JonFish85• 12 years ago

"In such an instance I would likely kill one or more of them"

You may want to consider how to react differently in such a situation. That's definitely a fight you can't win, and indeed would probably lead to causing your loved ones more pain than it's worth. It's probably best to comply with order in the heat of the moment and later fight it in court. The outcome will be much, much better, I promise.

Recoil42• 12 years ago

Just curious, what is the root event (events?) of your PTSD?

c22• 12 years ago

I somehow doubt proving your innocence will be your (or your surviving family's) primary concern if you kill one or more raiding swat members.

angersock2• 12 years ago

Had HPD stack up on an apartment I used to live at while I was gone...knocked once, roommate came out, and he managed to talk them out of raiding us. They really wanted the apartment down from us, which had been the alleged source of a bunch of burglaries in our complex.

If the roommate had had headphones on (was a metalhead and a gamer), things could've gone differently. We would've at least been out a door.

EDIT:

Fun fact--if I remember correctly, the first (maybe only?) confirmed kill with a P90 was by HPD SWAT.

sukilot4• 12 years ago

You do not possess enough legal firepower, and probably don't have enough practice wih your equipment, to likely kill a member of a SWAT team and "hurt" yourself.

pakled_engineer• 12 years ago

Just hope the police can't remotely access your cameras and film you hacking the gibson :X

I've yet to read of a raid where somebody successfully destroyed all forensic evidence off their systems instead they usually idle in chat rooms and wait for the suspect to write 'brb coffee' or kick down the door while they are passed out with everything powered on like Max Vision

mk4p• 12 years ago

It's crazy that the current environment is encouraging us to surveil ourselves.

CurtMonash• 12 years ago

Good post, but the real reason I upvoted was for the Zork reference. Well played!!!

fencepost5• 11 years ago

I actually liked the "kick-through license" better, but thanks.

Spooky23• 12 years ago

This is a really stupid thing to do.

Willful destruction of evidence is a criminal act in many cases, and even in cases where it isn't, judges can instruct juries to make adverse inferences.

If you're handling sensitive material, you should have a consistent policy/practice to periodically purge, destroy or deal with data. You're less likely to get into hot water over deleting data if its a long-standing process. If you are involved in a criminal scheme and the police are busting down the door, they have evidence already.

Previous jobs had me involved in alot of civil litigation from the IT side. Many really serious problems were avoided by having good deletion policy. The place that let employees squirrel away email for 20 years would either lose cases because of stupid employee chatter or win pyrrhic victories after spending thousands (or millions in one case) of dollars on discovery.

pluma3• 12 years ago

Or simply don't have your computer in the US.

But that might be easier said then done if you happen to actually live in the US, of course.

earthrise2• 12 years ago

Hi everyone, I'm the author of that software.

I really didn't want this to blow up. It's absolutely NOT a solution to getting raided by the police. While that was the original inspiration for writing the tool, I was half-joking when I wrote the README about it being a defense against law enforcement.

I've moved the code into a different branch and added a disclaimer to the README. The most important line of the disclaimer is: "If you need to rely on SWATd, you have already lost."

Run a script when police raid your house

Related Stories