Plod wants your PC? Brick it with a USB stick BEFORE they probe it Criminals, activists, and whistle-blowers have a new tool to help foil police by shutting down laptops before they are examined. "USBKill" is a script that turns an innocent-looking thumb drive into a kill switch that, when unplugged, forces computers to shut down. Author "Hephaestos" (@h3phaestos) says their tool will …
"Further they should be prepared to dig themselves a potentially bigger hole if they refuse police requests to hand over passwords."
OK, what happens for example if instead of a password you use a key file (e.g. with TrueCrypt) and store that key file inside the encrypted volume. The only time it is temporarily copied to a USB stick is if the computer needs rebooting by the owner. If plod shuts down the machine or it is rigged to shutdown if tampered with, then the machine is unbootable (or encrypted volume effectively lost) and the user has no passwords to hand over. The temporary USB stick would be wiped (overwritten) between uses. What then Mr Plod?
You'd be well and truly shafted if there's a power failure or your system crashes etc. etc. You'd be taking a huge risk with your data.
I had a basic script setup in my less-than-legitimate-youth that wiped out the disk, firstly by destroying the superblocks followed by a full write of random data. Thankfully I grew up before I got into any serious trouble.
Either way this will help you little, destroying evidence is still perverting the course of justice, just the same as refusing to give up passwords.
"Would it still be perverting the course of justice if it was in effect Mr Plod who triggered the loss of data by their own actions with the computer?"
A good question, I don't know the answer, but would like to know. Still, this would likely only work once, after which they'll start asking if you have any security features that'll destroy data (if they don't already), placing the ball firmly back in your court: to lie, or incriminate yourself.
You can have the encrypted data syncing to the cloud via a VPN that goes to TOR back through another VPN and back through TOR. If the USB device tied to your wrist is removed the encryption key for the hard drive is dropped and the contents of the SSD are instantly erased. That will also save you if something happens to accidentally trigger it. They won't be able to find out about that encrypted copy on the cloud because the hard drive will be erased.
If you're clever you can resist arrest just enough that they tase you, and your lawyer can claim the Taser in close proximity to your laptop erased the SSD.
I don't know why you'd bother with a USB device. Can't you use have a program looking for a Bluetooth device? Lose communication with your FitBit or other pointless Bluetooth gadget/watch/key fob and it asks for a password. It shuts down and locks after five minutes. By the time they finished tazing you and dragging you away, they can't get in anymore.
Personally I'd run a custom solution than an off the shelf one as it would be more likely that the police won't be able to work out how to stop it before it's too late and can't prepare for it.
"If the USB device tied to your wrist is removed the encryption key for the hard drive is dropped"
You could probably tie <security action of your choice> to something more innocuous like when the system detects a device has been removed from the headphone jack. That way you could trip the switch by backing away from the computer with your hands up (assuming a reasonably sturdy set of phones round your neck.
"Still, this would likely only work once, after which they'll start asking if you have any security features that'll destroy data"
In principle, you could brick not only the computer but any number of encrypted external USB drives at the same time, even if they weren't connected to the computer. Just keep the key files for those drives inside the encrypted volume of the computer (along with the key file for the encrypted volume itself). So one "hit" could brick any number of devices.
You have a right to remain silent, aka you don't have to answer the Police's questions if you don't want to. It would also be in those sorts of scenarios unwise to answer any questions put to you buy the Police unless you where under arrest and had a solicitor present.
>You have a right to remain silent
You have the right to repeatedly fall down stairs, you have the right to have kiddie porn "found" on your home computers, you have the right to have a mix up in the DNA lab have you convicted of rape.
Or if you do cooperate you have the right to have every electronic device in your home confiscated for 18months and then returned broken - never under any circumstances cooperate with the police.
""You do not have to say anything, but it may harm your defence if you do not mention when questioned something which you later rely on in court. Anything you do say may be given in evidence."
Look familiar? If the plod asks you questions, you may refuse to answer. Note that your rights include mention that it may harm your defence if you do not mention when questioned.... nothing in there about you being required to answer or that it may harm your defence if you do not answer, only that your answers may be "used against you".
Don't answer. Get a lawyer.
I manage to corner a Queen's barrister a few years ago and asked about this change in the law. I will not say he convinced me, but he gave some clear examples of where it worked as intended.
In short we need to reduce the number of ways you can get your collar felt by the police for arbitrary reasons. This should lead to a reduction in the number of abuses...
It does look as if the only solution is to have a lawyer on speed dial....
Better call Saul?
P.
I'm not sure what we're talking about here is "destroying evidence". If the police haven't yet put it in one of their plastic bags, and haven't made a formal request for it to be provided, is it "evidence", or is it just data? If destroying data that the police might like to get their hands on were a crime then we'd all be criminals because we're all destroying data all the time; in many cases data protection law requires us to destroy that data.
On the downside to automatic bricking, I suspect that the "smarter" the approach to automatically destroy data, the more one's face will smart, as it repeatedly accidentally walks into doors at the police station. And as the police love smart-arses so much, they'd probably take great delight in trashing everything in your home while "looking for evidence" inside every breakable item they can find then progress to looking under the floorboard and inside the walls and ceilings.
"I'm not sure what we're talking about here is "destroying evidence". If the police haven't yet put it in one of their plastic bags, and haven't made a formal request for it to be provided, is it "evidence", or is it just data?"
It's evidence. Companies (for instance) have a legal requirement to hold data for as long as it could be used in a court case (and therefore becomes evidence). I believe (please do check) that this also applies to individuals (e.g. tax information etc.). This is why destroying emails (even before a police investigation) is considered destroying evidence, although they would need to prove it was deliberate rather than just incompetence.
The point here would be to make it something the police do that causes the destruction. You are under no obligation to help the police (as a potential suspect) in their enquiries and if something they do has a negative effect (e.g. wiping data), they can't claim you should have told them. If they don't take enough care when examining the PC, that's their problem...
"This is why destroying emails (even before a police investigation) is considered destroying evidence,"
Does that include all the virus-laden spam I delete on a daily basis which is,by definition attempted illegal access to my systems. Plod might "need" it for evidence sometime in the next 10 years or so.
This post has been deleted by its author
Doesn't truecrypt allow a second partition independent from the first based on the password?
Give them the second password which leads to your Justin Beiber fan page.
Any reasonable jury would believe you needed that security to stop people from finding out that you like him.
'TrueCrypt's "plausible deniability" setting, one of it's very best features. The only downside was constructing a truly plausible collection of files that didn't look like stand-in crap.'
The whole point of justice in this country is supposed to be (consider if you think it still is) innocent until proven guilty. Therefore, it shouldn't really matter what files are there. The fact you chose to protect them (for whatever reason) is your business. It is up to plod to demonstrate there is a secondary volume rather than for you to show there isn't.
@JetSetJim.
I agree totally. 'Unless proven guilty' is very true. Mind you, the way things are going, innocence and guilt are becoming rather irrelevant. If they want to get you, they will!! You can see this with all the far reaching and high interpretable laws being implemented.
'Semantically, that implies guilt. I prefer "innocent unless proven guilty".'
I disagree, because I think the time bound of 'until' is important is important in the framework of law. Even the guilty have the right to be treated innocent UNTIL PROVEN guilty. So e.g. if an offender is caught red handed on camera and some newspaper calls him 'the offender' instead of 'the alleged offender' before trial, and then the offender is found guilty, the paper can still be sued/fined/cautioned whatever for violating the principle of innocent UNTIL proven guilty.
If the wording is 'unless', you could make the argument that no-one can touch the paper after the guilty verdict comes down.
TL;DR: My opinion is that from a law standpoint 'innocent until proven guilty' offers more protection tha 'innocent unless proven guilty'.
That's easy, have a separate partition from which you run a VM where you do all your "day to day" stuff. A nice innocuous gmail account where you collect spam and get notifications for Amazon shipments, ordinary web browsing where you post stuff to the Reg and surf for a bit of porn, have a few apps installed like Turbotax and do your taxes there.
Since you'd be using it on a daily basis it would look 'fresh' but the other VM where you do Bad Things would disappear without a trace by the time police get their hands on it.
I use a collection of weird / extreme pornography for that purpose, since even the UK bans that stuff, it gives more than plausible deniability, it also gives a reason for acting nervous when the customs folk poke around my electronics. The most trouble I've gotten into by doing such stuff was that I was forced to delete the data before being able to proceed into the country.
Further they should be prepared to dig themselves a potentially bigger hole if they refuse police requests to hand over passwords.
I agree with Andy above (who posted while I was writing this) that it would indeed be better to destroy the contents of the drive. However, in the case of Ulbricht didn't they take a photo before he had time to react?
If I send you a file full of random numbers, and the police demand you decrypt it, you are going to prison for up to five years. The fact that you cannot 'decrypt' the random numbers does not matter. If you want to keep a secret, you have to destroy the _device_ before they can copy it.
I think most SSD support a "secure erase" instruction that wipes the device. They would have to prove you did it (harder to prove if the wipe software was on the SSD when it wiped) but that way there is nothing encrypted to be forced in to decrypting (or trying to prove that random data is in fact random data, for example, as I have from the Numerical Recipes CD). Might also be useful if your device is stolen/confiscated for espionage (industrial or nation state) reasons.
What is a bit sad is the fact this discussion is taking place. That people feel enough of a threat of 'data' being used/abused to convict them when in the past you generally had to be shown to have physically done something and/or have corroborating evidence from others.
We had a speaker from the police at a conference talking about this new law when it was first created.
We asked him how we would prove that the petabytes of essentially random data from LHC wasn't encrypted?
We didn't need to worry because the law was only for use against terrorists.
Nope its my test data file for my random number generator;
Just waiting to try all the tests of randomness & needed plod to arrive for the Gorilla test
"Big advantage for SSDs in that regard, erasing a hard drive partition requires actual writes"
Yes and no.
For traditional hard drives you are spot on, but Self-Encrypting Drives ("SED") encrypt everything. Some SSD and HDD models have SED capability but not all.
The drives have a default encryption key already set in the factory (and printed on the drive label). With the default key the drives are essentially unencrypted, but if the encryption key is set then the drive appears bricked unless the correct key is entered upon boot. The drive can be unbricked with a special software but that renders the previous contents unreadable and the drive appears afterwards as unpartitioned, clean drive.
"If the evidence is going to put you in a worse situation than not handing over the password then f#$k PC Plod."
Trouble is the law as it stands means they can MAKE non-compliance worse than compliance for anything bar something with a life sentence. Even after you serve a stint for failing to disclose your password or whatever, they can always ask again.
From personal experience, even if you get all of your kit back from the rozzers, none of it will work, and some of it will be beyond repair - fuckem.
(False rape claim that took a few hours to disprove, but didnt get my stuff back - including car keys - for 12 months).
Anon because in my job these days, you are always guilty, even if proven innocent.
If you're accused of something, then probably true. Depending on your force etc
I've given the cops kit when they where investigating some nasty stuff* done at my workplace that was easier to put on a portable hard drive. I covered in (and the powersupply) with "property of x" stickers, and they joked that I was worried I wouldn't get it back. They returned it within a week, when the forensics lot came back to finger- and palm-print us, and sample our DNA.
*food and drink being poisoned.
"Presumably someone was attempting to remove a hard disk?"
Setting the PC power supply switch from 220v to 110v is not something that is done by accident. The PC only blows up a few weeks later. One wonders at the vindictiveness of some people when they don't find what they want to advance their careers.
We can do the whole chain of if-I-do_this_and_they-do_that-... chains all we want, but at the end of the day, they'll crucify you no matter what and no defense will get you off. Even in the "Land of the Free" where they supposedly can't demand your encryption key, I wish you luck, cause you'll need it, when they come gunning for you. The resources of the State against those of the individual generally is a highly uneven contest, which is why we try to bind the power of the State. It sure ain't working well these days.
Me? I do use encryption, of all sorts, and challenging set-ups but sheerly for annoyance value, or gratification on their end that they succeeded after a bit of effort. I know they're systems. And another agency of government (prison system) will chain me to their computers, on the cheap, and aside from the poor decor and piss-poor food that I've become accustomed to, I won't notice much. Doing this stuff outside that context is what's different. But then again, I'm an outlier.
"Secure" SSDs with internal chemical (cough Thermite + intumescent graphite sheet /cough) that destroys the flash chips totally but doesen't set the whole machine on fire.
I also came up with phosphorescent memory a while back, has to stay spinning to store its <500MB of data but totally secure and because it is analogue stopping the motor even for a split second scrambles it beyond recovery.
Sort of like an optical Turing machine but using ZnS:Cu plated onto old hard drive platters and a UV LED stack + linear CCD for readback.
Also read that the latest anti-snoops technique is to cut open the laptop's battery and install inside two drilled out 18650's a WiFi module and multi-GB storage chip using a thin wire antenna soldered to the outer cell and interlaced with the existing wiring to make it very hard to detect.
Simple low frequency radio to enable/disable and if it doesen't detect the host machine within a certain time the drive eats itself and then bricks the host battery to make it look like a random failure.
There's not only a market, there's a company that is actually manufacturing storage devices with built-in hardware self-destruct. It was reported here in the Register some months back. Sorry, can't remember the details. ISTR they were rather picky about who they'd sell to, and the prices were eye-watering.
Suspect I could do much the same with an SSD, a large capacitor charged to 240V, and some homebrew electronics, if I had any reason to want to do so.
yes, there'd be a huge market for this. Once had the wonderful meeting where thermite was seriously being considered to destroy a large amount of harddrives to a secure standard. It was only because they couldn't get an environmental impact report/waiver in time that we went back to the usual boring linux boot/secure wipe 7 times random data.
But....
man, would have loved to have gone the thermite route.
But Secure ssd's with a secure method to nuke (the important part!) before shipping the now dead PC to a warehouse for decommissioning? Yeah, there's some people would go for that, might be cheaper for them to do it that way.
This post has been deleted by its author
... only way to be sure?
I deduce you've never seen electronics that's been the victim of a lightning strike. High voltage and current is faster and more effective than any sensible amount of thermite. It gets at the electronics from the *inside*.
A large HV capacitor deliberately connected to the LVDC would probably be an adequate substitute for lightning,
a few years ago, they had a secret (alleged) hacking den, KAPO police successfully broke in, handcuffed all the (alleged) hackers who were presumably up to no good, great job-done!. One of the hackers asked to use the bathroom, but stood up on the sofa, with handcuffs still in place behind his back he pulled the dangling light-switch cord, which erased everything in the apartment.
they went to prison for a short while for destroying the data, but allegedly it was never known just what bad things they were up to.
Of course, as this was a while ago as I suppose they would now all be shot as terrorists on sight, except...
...in 2015 around one percent of Estonian ICT experts have joined the Estonian sunday-data-soldiers after a more formal actual-join-the-army campaign failed, now the small Baltic state is state-sock-puppet enabled with hobbyist-reservists
On my machines, I only know half of the key for file server, the other half was set by my lawyer (He lives down the hall from me in my building). I also fix some of his systems, and as such, I have a couple disks with highly-sensitive information on them (I have all the proper NDAs and contracts set up to allow me to posses such things). So in order for the police to get at my data, they'll need to get a warrant for me and a subpoena for the lawyer, in addition, they'd have to get a third party involved to ensure that the evidence they are gathering doesn't violate the rights of my lawyer's other clients. Any wrong step by the police and the full weight of the ACLU and several other lawyers will come crashing down on them.
The volume locks on reboot and it just so happens that the power cord for the file server is under my desk, where it can 'accidentally' get tangled up around my foot and pulled out when I get up to go answer the door when the police come knocking...
I do have the advantage of not having done anything the police would want to come talk to me about, but I'm not going to give up my data without them going though the proper channels and making sure they've dotted every 'i' and crossed every 't'.
"I do have the advantage of not having done anything the police would want to come talk to me about, [..]"
You breathe and know other people - that is enough for the police's "guilty by association" justification. Even if they have to spread their net to six degrees of association to pick your name.
This has actually happened, the Police actually paid up to get the data back.
Also it would be considered by the Courts as a legitimate expense similar to forensic recovery of a smashed hard drive thrown out of a window by a crook which still resulted in convictions.
The virus defence only works if the ISP have records of an email with attachment and all suspicious activity happened shortly after, IIRC there have been maybe 3 cases of this in the UK in the last 10 years.
"The virus defence only works if the ISP have records of an email with attachment and all suspicious activity happened shortly after, IIRC there have been maybe 3 cases of this in the UK in the last 10 years."
Not with the USB stick approach since you can say it's from someone else. Perfectly plausible, also perfectly plausible the friend knew nothing about it being infected, thus impossible to go beyond this link in the chain.
I think that's a myth. A magnet powerful enough to wipe a drive from more than a few inches away (assuming it wasn't secured in a thick box as it's being carried out) would be more likely to tug at the cops' badges and sidearms as they were coming IN, alerting them to its presence.
One of the first thing the police do is plug in a USB device in that simulates the mouse moving to stop any inactivity password from activating.
I'd have a program that lock from inactivity plus locked from a change to usb devices. As soon as anything is plugged in or unplugged, it would lock and ask for a password.
How about a keyboard with a Sleep button? You can set that to send the computer into Standby in a stroke like a Panic button, and as long as your standard account has a password in it, this can also automatically lock the account to the point the plods would need to know the password to restore normal operation. That's why smart cops instead read off the memory in situ or use a cold-boot attack that doesn't rely on normal operation, bypassing that safeguard.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
