Can a one-time-pad provide legal immunity - (make data inadmissible) -? IMPORTANT NOTE: This question is quite niche, I am not sure if this stack is the most relevant place, please inform me if there is a better place for it. To explain the question: I am asking if, a one-time-pad encryption system (brief explanation here: https://www.youtube.com/watch?v=2_w9l9visH8 ) can make any information encrypted with said system immune to prosecution – in the event that the prosecutors were to find, or believe to have*, the original key/one-time-pad that was actually used. *The point being, the one-time-pad is not only ‘unbreakable’ - provided the security procedures/rules are kept to (no key re-use, keep key private), but given the maths – given the nature of why it is unbreakable, it is also impossible to actually know/prove beyond all doubt that you ever have the right key. i.e: Given the nature of a one-time-pad system/its fundamental design, by itself it is impossible to determine whether or not the key is ‘correct/incorrect’. It is simply inputted and, implementing the algorithm/system, an output is given. Given this, that it is impossible to actually prove the key is ‘correct’, if the authorities/prosecution were to ‘find’ said ‘correct key’, they cannot actually prove that the key is the correct one, therefore they cannot actually prove that the output provided by using said key is actually the original plaintext that was encrypted. My point being: Though I assume, from previous legal cases around the world regarding infosec, that this would make any ‘evidence’ - obtained by ‘decrypting’ said data with this ‘correct key’ that any prosecution/authorities should obtain – inadmissible as they cannot actually prove said evidence ever existed, I am asking here if this is the case? Sorry for the lengthy explanation, it is a rather niche question, I shall clarify it with an example for what I intend to actually ask; example: Say the authorities/prosecution obtain what they say is the ‘one-time-pad’ (though of course, as we know there is no irrefutable way to actually prove said claim) Said one-time-pad is then used to produce plaintext which results in incriminating material being discovered. Is said material considered admissible evidence, given that: With some clever, (though not actually that difficult to perform) maths some geeks could quite happily engineer a ‘one-time-pad’ to produce an output of said incriminating plaintext. Regardless of this, there is no way to actually prove said key is the correct key, and so creates the situation which allows for above abuse. I realise this may seem a very strange, obscure, niche question, but I find it interesting &amp; I have not been able to find any real (public) history of any case where this has been so. Before you endeavour to answer, I must add some information: I realise that even if the material is inadmissible, as it may have been created by the prosecution/authorities or otherwise, they could use this material that they believe to be correct/accurate to find other evidence – I realise this and it is not the question. Further to the above, I realise that said material could be so circumstantual a prosecution may argue it evident, i.e. the plaintext produced (with the ‘correct’ key the prosecution provides) contains an image with metadata – nevertheless this is covered under the same circumstance as the above, as of course this could have been engineered. I believe this question to be ‘on-topic’ and important/relevant as I do not believe it has been asked before here on stack-exchange, nor adequately answered/explored elsewhere. I also realise that the likelihood of authorities performing said ‘exploit’ is less likely than other exploits being performed, nevertheless the overarching point is the plaintext cannot ever actually be proved to be the actual plaintext. Anyway, I have already said that – my point here was that regardless if the authorities do not perform such exploit, it is a very real possibility that should material claimed to be plaintext ever be considered evidence, that other parties such as the prosecution (who will most likely have had access to examine/read/copy the hard drive for their own independent examination) would be able to perform such attack. Such attack would not be necessarily complex, though I’m not saying it would be in any means easy (or computationally cheap), I am just saying it is entirely possible, and again the overarching point being it is impossible to prove the key is ever said key. And yes, I realise that a good prosecution could provide such circumstantual evidence, though in my belief circumstantual, such as: Data y was stored by/accessed by defendant, we can prove this (though not actually prove its the key), we believe this is the key (because of a,b,c,) and hence this is the plaintext of the defendants hard drive, which is therefore incriminating. MY PRIOR RESEARCH: Of course without the key it is impossible to actually ‘decrypt’ said data (provided no key reuse), I know that authorities/prosecution wouldn’t be able to ‘decrypt’ the hard drive if they didn’t have the key. The point is, again to reiterate, that the very mathematical nature of this predicament further creates/also is the predicament that it is impossible to prove the data produced is actually the ‘original’ plaintext. Hence, given that the authorities cannot actually ‘decrypt’ the data without the key that is used, I would like to know if it is legally valid for them to say that they have done so in any case? I am asking this as I have researched and have not found any cases that are public, neither in the scenario/principle described, nor have I even found any that actually involve unbreakable ‘one-time-pad’ encryption. I ask this as again, if it were to be legally valid then it would enable anybody to perform some clever calculations to effectively invent incriminating evidence. https://www.schneier.com/blog/archives/2007/10/uk_police_can_n.html The comments section of this page provides interesting discussion on the topic, of which is scarce generally. The comments seem to support the idea that any one-time-pad encryption scheme properly implemented makes all ‘evidence’ produced from said data inadmissable. https://ifca.ai/pub/fc97/r4.pdf “In 1995, it was finally divulged that the Rosenbergs, while attempting to use “one-time pad” encryption,infra, were careless in doing so, and didn’t really use a one-time pad after all. This enabled the government to develop evidence that assisted in their conviction.” The above quote from the linked paper also suggests that anything properly encrypted with a one-time-pad scheme is merely data, and that no admissible evidence can be produced. So yes, a long question, maybe repetitive &amp; lengthy, but I hope you can read through this as it is important to clarify. A further DISCLAIMER: Please focus on the question, it is already long enough, I don’t wish to write an entire text on the questions I am not asking. As a final clarification, the question above has been asked clearly, however niche you may think it there are valid concerns (as are shared by those in the comments linked). I realise that you could just have the key tortured out of you by a malicious entity, this is not the question nor it is relevant, this is long enough now so I conclude.
If it was for a criminal case, the jury would have to decide if they believed the person who claimed he/she cracked the code. Really, any evidence is interpreted by the jury if it is regarding facts. 1) An issue of fact, not law. A question of fact is resolved by a trier of fact, i.e. a jury or, at a bench trial, a judge, weighing the strength of evidence and credibility of witnesses. Conversely, a question of law is always resolved by a judge. https://www.law.cornell.edu/wex/question_of_fact
...many [countries] forbid even the possession of software for &quot;hacking&quot; despite intentions That is not the case in the united-kingdom where accessing a computer, and possessing the tools to do it, are only offences if the activity is unauthorised. In fact, private entities and government departments are encouraged to carry out authorised penetration tests to identify vulnerabilities in their systems. [by] using my computer to break into my old brick laptop... This is perfectly legal as you have authorised access to the brick. The relevant offences are at s.1 to s.3A of the Computer Misuse Act 1990, in particular: s.1 - Unauthorised access to computer material. (1) A person is guilty of an offence if— (a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured; (b) the access he intends to secure, or to enable to be secured, is unauthorised; and (c) he knows at the time when he causes the computer to perform the function that that is the case [...] Sections 2, 3 and 3ZA (not reproduced here to save space) follow similar wording for unauthorised access relating to such things as commiting other offences, impairing a computer's functionality, or creating serious damage to health, infrastructure etc. s.3A - Making, supplying or obtaining articles for use in offence under section 1, 3 or 3ZA [...] (3) A person is guilty of an offence if he obtains any article— (a) intending to use it to commit, or to assist in the commission of, an offence under section 1, 3 or 3ZA, or [...] (4) In this section &quot;article&quot; includes any program or data held in electronic form. [...] So, hacking is not always unlawful - all it needs is the right permission from someone who is authorised to give it. Edited To Add This is also the case in canada (the subject of the OP's first linked article) where s.342.2 of the Criminal Code makes an exception for having a lawful excuse to possess &quot;hacking tools&quot;: (1) Every person who, without lawful excuse, makes, possesses, sells, offers for sale, imports, obtains for use, distributes or makes available a device that is designed or adapted primarily to commit an offence under section 342.1 or 430, knowing that the device has been used or is intended to be used to commit such an offence, is (a) guilty of an indictable offence... (b) guilty of an offence punishable on summary conviction. [...] (4) In this section, device includes (a) a component of a device; and (b) a computer program within the meaning of subsection 342.1(2).
So, lets say for argument's sake the search is illegal (we'll discuss scenario later). Is the murder weapon inadmissible? No. Evidence seized in an illegal search is inadmissible for use in court, as to allow it would reward the state for breaking the law. At time of arrest it's still evidence and depending on what other evidence comes out might not be inadmissible (More on this later). If the knife is the only thing linking the driver to the murder, then it's inadmissible. What would happen to the driver, who was most likely the murderer? At this stage, the driver might be arrested and charged... inadmissibility is a matter for pre-trial motions, which takes place after the cop made the search. Whether the guy is a murder or not, he is a suspect who has been accused. Can the police arrest him, and investigate him with the hope of finding other evidence that would be enough to sentence him for the murder, despite the inadmissibility of the actual weapon? This all takes place before the inadmissibility of evidence is declared, so they certainly could investigate the guy, cuff him, read him his rights, book him, Danno, and put him in jail to help build their case. HOWEVER, if the knife is the only thing linking the man to the crime, then all of this becomes what's called &quot;Fruit of the Poisonous Tree&quot;. Because the knife was used as the sole evidence to secure search warrants against the suspect, and should the knife become inadmissible, anything that resulted from the execution of the warrants is itself inadmissible. is the murderer in practice immune from being charged for this case, since the weapon cannot be tied to him? Not entirely. Rarely is a murder weapon needed to secure a conviction. Not only that, but while the search is illegal, there is an exception called &quot;Inevitable Discovery&quot; which holds that evidence seized illegally initially may still be admissible if the cops can show that the legally obtained evidence would have led to the knife. Suppose they had CCTV footage and captured the man entering the area of the scene and found out he had a connection to the victim, and got a warrant that would have included his car... that would mean the knife is admissible even if the search was illegal. If the weapon is considered inadmissible, is it returned to the suspect? If yes, would it also be returned even if it is of a type that the suspect is not legally allowed to own? Yes to both, though when it would be returned is subject to possible use in other investigations. Additionally, while I don't know of any knife ban laws in the U.S., there are examples of contraband seized by arrest for a different offense was not returned when the initial offense was overturned on appeal, meaning the contraband evidence was no longer validly seized and thus that half of the case was overturned... but the defendant wasn't returned his drugs. Is the weapon permanently inadmissible for all future, or could it be used in a later court proceeding? No. I'm starting to suspect I know the TV show and episode that inspired this question, but the search violated suspect 1's rights and thus was inadmissible for his trial. However, if a second suspect was discovered as the evidence was developed, and the investigation lead to the knife (say... suspect 2 had access to suspect 1's car... like say... through his job at a car wash that suspect 1 was patronizing... and planted the knife in suspect 1's car to frame him) then the knife is admissible because of inevitable discovery rule. Now, the TV Show I alluded too, and you'll forgive me as it's been a while, the events were that the cop pulled over suspect 1 for a valid reason (busted tail light, intentionally done by suspect 2 to get attention) and saw the knife on the backseat of the car, which is not a violation of search and seizure rules. The bloody knife was in plain view and gave probable cause to arrest and search the entirety of the car. If you leave evidence in a place where the officer can see it, they can seize it in a car at least. Places like the glove box, under the seats, or the trunk would properly hide it and not allow the officer to search the car, but through the windows is just fine.
It depends on whether you can identify the person to whom a username hash belongs. If you store both username and its hash in the same database row then yes. If it is impracticable for you to identify the person by their hash only, then no. This comes from the definition of personal data — "any information relating to an identified or identifiable natural person", and Recital 26: Not applicable to anonymous data. The hash is essentially anonymous data when it does not on its own allow to identify the person (with reasonable efforts i.e. without spending $$$ on detectives or forensic science).
Yes. The same issue arose in ABRO Industries v. 1 New Trade, No. 3:14-cv-1984-TLS-CAN (N.D. Ind. 2017), where the defendant sought to compel the plaintiff to produce encrypted e-mails. The court granted the motion and ordered the production of both the requested e-mails and the &quot;necessary encryption key.&quot; Indeed, discovery orders in the federal courts routinely include language saying that “the Producing Party shall transmit the encryption key or password to the Requesting Party” See, e.g.: Smith &amp; Fong Co. v. idX Corp., 3:22-cv-00042-TMR-CHG, 8 (S.D. Ohio Jul. 8, 2022); Sandoval v. Uphold HQ Inc., 1:21-cv-07579 (VSB)(BCM), 9-10 (S.D.N.Y. May. 20, 2022); Rabin v. Pricewaterhousecoopers LLP, No. 16-cv-02276, 2016 U.S. Dist. LEXIS 142003, at *14 (N.D. Cal. Oct. 11, 2016); Chromadex, Inc. v. Elysium Health, Inc., No. SACV 16-02277-CJC(DFMx), 2017 U.S. Dist. LEXIS 224417, at *12 (C.D. Cal. Sep. 26, 2017); Martinelli v. Johnson &amp; Johnson, No. 2:15-cv-01733-MCE-EFB, 2016 U.S. Dist. LEXIS 53146, at *26 (E.D. Cal. Apr. 13, 2016); Montalvo-Ariri v. Ethicon, Inc., 5:14-cv-01421 VAP (SPx), (C.D. Cal. Aug. 14, 2015); Green v. Am. Modern Home Ins. Co., Case No. 1:14-cv-04074, 7 (W.D. Ark. Nov. 24, 2014);
In principle, the data subject's right to access involves a copy of all personal data the controller holds on them. There are no time limits by default. Of course, the controller can ask a data subject to clarify their request, e.g. to focus on a particular time frame. There is an implied time limit though: personal data may only be processed/stored for as long as the data is necessary to achieve the purposes for which it was collected. Afterwards, it must be deleted. A controller with good data management will be able to limit their effort by having as short retention periods as possible for their different records. Furthermore, a lot of data is not personal data, or falls out of scope of the GDPR because it is not processed with automated means or forms part of a filing system. For example, if thousands of old invoices were archived in paper form in boxes that are only sorted by year, there might be an argument that this isn't a filing system in the sense of the GDPR and that a DSAR would not have to involve looking through all the archived invoices (compare also Art 11). In your scenario, there is a clear retention period of six years. You are asking for records about how that data might have been used further in the past. To the degree that such data is actually available, that could reasonably be personal data and should be included in a response to a DSAR. E.g. they might have information like this: “File #1234 was included in a data set that was sold to EvilCorp in 2007. The entries in File #1234 that are older than 2014 have been purged, so we do not know which entries were included in the data set. The current name on File #1234 is Dave.” This information about the sale would be personal data because it relates to you, and you are identifiable. Of course, the controller might not be set up to perform this search unless specifically asked. However, more unspecific information might not be personal data. For example: “About 70% of our files were included in a data set that was sold to EvilCorp in 2007. We no longer have records indicating whether your file was included.” Since there is no link between the sale and your personal data, I don't think it would have to be included in a DSAR response. The primary reason why you should be told about sales of personal data is that per Art 15(1)(c), you should be informed about “the recipients or categories of recipient to whom the personal data have been or will be disclosed” in a DSAR response. So when making a data subject access request, it could make sense to explicitly referencing this paragraph. So you would be interested in receiving a copy of your personal data as per Art 15 GDPR, and in particular any available information per Art 15(1)(c) GDPR about the recipients or categories of recipients to whom your personal data has been or may have been disclosed in the past. Quite likely the response will be underwhelming, e.g. by just giving a broad category such as “potential creditors who are contractually obligated to use the data only in accordance with our policies”. Whether such responses are compliant (I don't necessarily think so) will not be clear until there's a good precedent, and that would require that someone sorts this out in court.
What you're talking about is called black-box reverse engineering. It can be done, and as long as you are meticulous in your record keeping the fact that it has been done should be an appropriate defence against copyright infringement. But that doesn't help against patent claims - while in copyright cases the fact that code has or has not been directly copied is critical, in patent cases it its irrelevant: if you use a patented method, it's a violation. You therefore will need to be careful about any patents that may have been issued to the original author, as well as avoiding copying.
Generally speaking, what isn't illegal by law is legal. It's possible for law enforcement agencies to share crime rates, maps, and their data, but within any laws regarding access and sharing of that data. Such crime data may be publicly available, but that depends on local and state laws. The local or state agency would have to enter into a legal licensing agreement - if local and state laws allow such sharing - with the GPS company to provide the data, update it, and reasonably assure that it is accurate. The more realistic reason GPS systems might choose to not show crime data may be public relations. If a GPS user lives in an area that has been objectively identified by data as having a higher than baseline crime rate, i.e. for carjackings, that user may not be very happy with that designation. Worse, what happens to public relations when data errors show an area is wrongfully identified as high crime? What kinds of lawsuits could result? Real estate agents suing since bad data from a GPS unit soured the sale of a house?