I have a habit that may upset some people: I overwrite new disks with a pseudorandom bitstream. Then, when I use a disk for data, I encrypt it in such a manner that there is no visible, unencrypted structure to the disk: No header, no unencrypted metadata. (How?
Magic—don’t ask!)
As a result, my house is filled with random-looking disks that may or may not contain decryptable data. Some are hooked up to machines, and
probably have data—if, that is, they are not hot spares. The ones not hooked up to machines may be backup disks, or decommissioned disks, or new disks that I have never used. All of these disks are indistinguishable from each other, to anybody who is not me. To me, the disks are identified by serial number in a file that is stored encrypted.
(Don’t ask. Security by obscurity is a part of defence-in-depth, except within the quite narrow purview of Kerckhoffs’ Principle.)Occasionally, it has happened that a disk was lost or stolen. I never worried too much about this.
The presence in my house of all these random-looking disks has oft tempted me with an interesting thought experiment: What would happen, if I were to attempt passing the United States border with one of my disks? A disk with encrypted data would be
interesting. A new, unused disk would be
more interesting.
Don’t Be StupidI generally contemn the concept of “civil disobedience”. That’s just a way for “TPTB” to induce
potential troublemakers to paint targets on their own backs. You don’t win by incurring to yourself avoidable trouble for nothing. You win by making “TPTB” powerless over you: By keeping your privacy, appearing
mostly harmless, and secretly doing whatever you wanted to do anyway. Open defiance gets you marked for life, when you are young and idealistic; and this limits your freedom of action in the future, when you otherwise may actually have become dangerous. The system works out neatly for itself. Make the system irrelevant.
That being said, for anyone who
already has trouble at the U.S. border and doesn’t mind a bit more of it, my aforestated “thought experiment” suggests some amusing hijinks.
Say you buy a 12 TB hard disk for about 300 units of depreciating funny-money (“United States Dollars”), and pack it in your bag looking random. Is it a new disk that you just freshened up with a pseudorandom bitstream? Or is it packed with juicy data that you so happen to have encrypted?
Have fun explaining to the border police that you don’t remember. But what if, seriously, you
don’t remember? I have lost data this way—long ago, before I devised better schemes for keeping my metadata straight. I have stared at a disk, trying to remember whether or not I ever wrote any actual data to it. Cypherpunks have a tough lot in life.
The scenario also presents some interesting philosophical questions. Say you have a disk written with juicy
unencrypted data: Julian Assange’s secret diaries, Satoshi Nakamoto’s private keys, and your multi-terabyte pr0n collection (which is what the border police are most personally interested in seeing). Now, you decide to destroy this disk with a
cryptographic erasure: You encrypt all the data in-place, then irretrievably destroy the key. At the U.S. border, what is the legally proper answer to the question of the disk’s contents?
- “Pseudorandom data.” This is strictly true. You are not lying to the American police, which would be a “crime”. But this introduces in turn another question: What if the program you used to irretrievably destroy the encryption key was buggy, and you later discover that you had inadvertently retained the key all along? Data remanence is a big problem, you know.
- “Encrypted data that I can’t decrypt.” This is also true. But you can be extraordinarily rendered and then beaten with a $5 wrench until They are satisfied that you are not lying—or until you’re dead.
- “Schrödinger’s Cat’s data.” Amusing—until my caricature of the secret police decides to amuse themselves by locking you in a box with a gun triggered by a Geiger counter, etc., such that they can write up your status as “unknown and unknowable”.
It would be fantastically stupid to test these answers empirically. At best, you would probably lose a disk worth 300 units of depreciating funny-money.
Supreme ConfusionModern (or postmodern) laws are a game, invented to amuse people who have sufficient firepower to enforce the rules of their game. Arbiters of those rules are called lawyers.
This question is for the lawyers:
What are the legalities attendant passing of the United States border with a disk full of pseudorandom data?
The problem with allowing passage of large amounts of pseudorandom data is that nobody can prove it isn’t
encrypted data. Note that there can here be no question of the burden of proof: The question cannot be proved at all. —Or rather, it could only be proved that the disk’s owner is lying,
if the disk’s owner is lying, by decrypting the data. If the disk’s owner is telling the truth, it cannot be proved that he is telling the truth.
And you know, national security would be totally destroyed by the Four Horsemen of the Cryptocalypse if you just let people walk across the border with 12TB of encrypted pr0n in a package the size of a small paperback book.
However, the government would look silly for prohibiting or harassing travellers who carry what are, in substantial essence, empty disks. Seriously. This is a real problem. Upon purchase, I immediately overwrite every new hard disk I buy with a pseudorandom bitstream, starting at sector 0 and ending at the final sector, inclusive. I have been doing this for about two decades. If I were to travel to the U.S. (LOL), I may want to take a new disk with me.
Someone terrifically stupid needs to be a guinea pig (“test case”) for this, such that the question may be properly decided by the United States Supreme Court.
