<story><title>Irish police to be given powers over passwords</title><url>https://www.bbc.com/news/world-europe-57468750</url></story><parent_chain><item><author>runarberg</author><text>Out of curiosity. Why do you mention the latter group (people with good information opsec) is tiny when the former group (criminals) is probably an order of magnitude smaller?</text></item><item><author>ska</author><text>&amp;gt;  such a law does nothing against proper criminals.&lt;p&gt;Doesn&amp;#x27;t sound right to me; The intersection between criminals and people with good information opsec is tiny(mostly because the latter category is tiny anyway).&lt;p&gt;I agree the law is problematic, but not for that reason.</text></item><item><author>choeger</author><text>Interestingly, such a law does nothing against proper criminals. People that know they have incriminating evidence will either not carry it on their phones or uses some form of steganography to hide it perfectly. In the worst case, they will have some form of wipe-me passphrase that cleans the device before unlocking.&lt;p&gt;Normal people, on the other hand, do not have these kind of (mental, time) resources. They will be forced to unlock their phones and &lt;i&gt;something&lt;/i&gt; incriminating (for instance regarding &amp;quot;hate speech&amp;quot; or &amp;quot;intellectual property rights&amp;quot; or just &amp;quot;traffic violations&amp;quot;) will be found. I consider this approach one step more in the direction of keeping every citizen an on-demand criminal. There are so many, sometimes incomprehensible, laws nowadays that pretty much everyone is not compliant.</text></item></parent_chain><comment><author>mLuby</author><text>Honestly I thought you were way off base and that the number of criminals would be orders of magnitude higher than infosec workers, but apparently I&amp;#x27;m wrong.&lt;p&gt;&amp;quot;in 2020, there were 1.8 million people in prison&amp;quot; [1]&lt;p&gt;&amp;quot;[in 2019,] the country’s total employed cybersecurity workforce is just 716,000&amp;quot; [2]&lt;p&gt;&amp;quot;There are about 465,000 open positions in cybersecurity nationwide as of May 2021&amp;quot; [3]&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;easyreadernews.com&amp;#x2F;why-are-so-many-americans-in-prison-in-2021&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;easyreadernews.com&amp;#x2F;why-are-so-many-americans-in-pris...&lt;/a&gt;
[2]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.csis.org&amp;#x2F;analysis&amp;#x2F;cybersecurity-workforce-gap&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.csis.org&amp;#x2F;analysis&amp;#x2F;cybersecurity-workforce-gap&lt;/a&gt;
[3]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.cbsnews.com&amp;#x2F;news&amp;#x2F;cybersecurity-job-openings-united-states&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.cbsnews.com&amp;#x2F;news&amp;#x2F;cybersecurity-job-openings-unit...&lt;/a&gt;</text></comment>
<story><title>Irish police to be given powers over passwords</title><url>https://www.bbc.com/news/world-europe-57468750</url></story><parent_chain><item><author>runarberg</author><text>Out of curiosity. Why do you mention the latter group (people with good information opsec) is tiny when the former group (criminals) is probably an order of magnitude smaller?</text></item><item><author>ska</author><text>&amp;gt;  such a law does nothing against proper criminals.&lt;p&gt;Doesn&amp;#x27;t sound right to me; The intersection between criminals and people with good information opsec is tiny(mostly because the latter category is tiny anyway).&lt;p&gt;I agree the law is problematic, but not for that reason.</text></item><item><author>choeger</author><text>Interestingly, such a law does nothing against proper criminals. People that know they have incriminating evidence will either not carry it on their phones or uses some form of steganography to hide it perfectly. In the worst case, they will have some form of wipe-me passphrase that cleans the device before unlocking.&lt;p&gt;Normal people, on the other hand, do not have these kind of (mental, time) resources. They will be forced to unlock their phones and &lt;i&gt;something&lt;/i&gt; incriminating (for instance regarding &amp;quot;hate speech&amp;quot; or &amp;quot;intellectual property rights&amp;quot; or just &amp;quot;traffic violations&amp;quot;) will be found. I consider this approach one step more in the direction of keeping every citizen an on-demand criminal. There are so many, sometimes incomprehensible, laws nowadays that pretty much everyone is not compliant.</text></item></parent_chain><comment><author>ska</author><text>&amp;gt;  is tiny when the former group (criminals) is probably an order of magnitude smaller?&lt;p&gt;How did you arrive at that?  Even a significant fraction of people I know who &lt;i&gt;do security work&lt;/i&gt; would agree they don&amp;#x27;t in general have good info opsec, because it&amp;#x27;s a pain in the ass.  Most of the technical people I know wouldn&amp;#x27;t even know how to do it properly.&lt;p&gt;&amp;quot;Criminals&amp;quot; is hard to define precisely, but some small integer percent is at least a reasonable lower bound.  Afaics people who are actually good at info opsec don&amp;#x27;t number in the millions.&lt;p&gt;So even if we simplify by assuming the rough magnitude of both groups is the same, you still have the intersection of two small groups -&amp;gt; tiny.  This is probably complicated a little bit because criminals have more incentive than average, if not more experience.</text></comment>