this post was submitted on 11 Jan 2025
182 points (97.9% liked)

Asklemmy

44331 readers
1032 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

  1. Open-ended question
  2. Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
  3. Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
  4. Not ad nauseam inducing: please make sure it is a question that would be new to most members
  5. An actual topic of discussion

Looking for support?

Looking for a community?

~Icon~ ~by~ ~@Double_[email protected]~

founded 5 years ago
MODERATORS
 

After reading about the "suicide" of yet another whistleblower, it got me thinking.

When working at large enough company, it's entirely possible that at some point you will get across some information the company does not want to be made public, but your ethics mandate you blow the whistle. So, I was wondering if I were in that position how I would approach creating a dead man's switch in order to protect myself.

From wikipedia:

A dead man's switch is a switch that is designed to be activated or deactivated if the human operator becomes incapacitated, such as through death, loss of consciousness, or being bodily removed from control. Originally applied to switches on a vehicle or machine, it has since come to be used to describe other intangible uses, as in computer software.

In this context, a dead man's switch would trigger the release of information. Some additional requirements could include:

  1. No single point of failure. (aka a usb can be stolen, your family can be killed, etc)
  2. Make the existence of the switch public. (aka make sure people know of your mutually assured destruction)
  3. Secrets should be safe until you die, disappear, or otherwise choose to make them public.

Anyway, how would you go about it?

(page 2) 47 comments
sorted by: hot top controversial new old
[–] [email protected] 6 points 4 days ago* (last edited 4 days ago)

The hardest part would be how to trigger the kill-switch periodically without showing it to your adversary whilst keeping it easy. Having your device queried directly would be a dead giveaway. My idea without involving people would be as follows:

  1. Set up a program that syncs files to a remote third-party cloud
  2. Sync it to a directory that frequently changes when you use your device (your docs, for example)
  3. Have a server that queries the third-party drive for that synchronised directory
  4. If there are no changes, trigget the alarm

But since this plan relies on the secrecy, it's kind of ruined now. That, and I think your threat model is a bit too extreme.

[–] [email protected] 3 points 4 days ago (1 children)

Well there are various services that let you disclose info to certain people upon death. examples: https://www.pcmag.com/how-to/how-to-prepare-your-digital-life-accounts-for-your-death

So you could create those and send them to various journalists or whoever you think would be interested. Then ensure in your will that they are notified of your death. Will them a small object or something.

Tbh I think the concept of a dead man switch is fantasy. You always hear about them in place but then nothing happens when the person dies.

Has there EVER been a dead man switch that worked?

[–] [email protected] 1 points 3 days ago (3 children)

Didn't Epstein have one? I think if something that incriminating can be eliminated, the concept as you said doesn't work.

load more comments (3 replies)
[–] [email protected] 3 points 4 days ago (1 children)

One issue from a legal/prosecutorial point of view (even assuming there is a willingness for the government to prosecute) is that the rules of evidence require authentication of documents. In the case of a whistleblower, they are themselves a witness and can authenticate (that is, attest to the genuine nature of) any supporting documents they bring in. If a whistleblower is killed, even if the government has the documents the whistleblower intended to authenticate, it becomes a lot trickier to use.

[–] [email protected] 1 points 3 days ago

I guess it would be more of a public court thing

[–] [email protected] 3 points 4 days ago* (last edited 4 days ago) (1 children)

Well, you'd need to send a message to some people that you know would care, when you die or are kidnapped.

There are plenty of services for sending any sort of message.

You'll send the data with a private key and hand out the paired public key before you die. That way any tampering with the data will be obvious to the receiver.

I'd just send a link to the data. For example store the data on Proton drive with a share link.

Now you'd need to detect that you're dead or kidnapped. You could have a timer of say a week or a month, and whenever an email or message is received it resets it. You could also send a warning message to yourself before it goes off, so you have a chance to deal with errors such as an email not arriving.

You'd need a 2nd service to check if the main service is running. Or perhaps it just replies once you send it a message once a day or week or month.

You'd also have to make sure that your reset message to the service is secured. Most likely it will be as long as it isn't absolutely obvious, like you japping on about it at work. But one idea would be to use a proton mail address and keep a pin lock on the app. If you want to go the extra mile the email should also contain something only you can know.

Quite frankly I don't think they'd even expect you to have any such system set up and they wouldn't hack you before you're dead. But maybe I'm wrong. If you really suspect that you'd need someone who is specialized in infosec.

I'd say go look for an existing service that can do this entirely via email, I'd bet it exists already. Otherwise you need to be able to code a bit or find a coder.

[–] [email protected] 2 points 4 days ago

I’d say go look for an existing service that can do this entirely via email, I’d bet it exists already.

I think any official service that offers this could be immediately captured or bribed to suppress signalling by a larger more powerful entity, since it would be an easy goto that they could trap for.

I reckon implementing it as chaotically and as distributed as possible, might be the only viable solution, albeit with multiple fault entry points.

[–] [email protected] 2 points 4 days ago
  1. An automated SMS message to activate something or something
  2. As Back-up, automated email that is checked if received or not (in cases where no mobile connection but there is internet)
  3. Final Back-up, none of the two maybe, radio that disables the mechanism for 48 hours just incase
[–] [email protected] 2 points 4 days ago

I don't know what's скороварка on English, I guess it's an easy rice cooking and heating device that can be set on timer. Buy one, then disassemble it and see where heating elements of that thing are. Tape them on you hard drives, better if they are SSDs, set the timer, put it into a wall socket and leave. If you are of adventurous kind, do the same with microwave's transmitter, pointing it out of the box, but be cautious as fuck because this shit can cook your balls or head in seconds.

or, better yet

You know that most MBs have special contacts for power\reset buttons? You can do two circles to them, one is for you to power up the system normally from some secret button and one from a normal button is to trigger some funsies with things easily triggered by current or heat, like dry gunpowder. So when some ABC agent would try to power up your machine, some funny thing occurs.

and if you are worried about it being disassembled in their lab, print big stickers that stick components to their slots, like OEM fuckers do, and then put cheap razorblades under them near the edge of said stickers. That's a lifehack nazis and then punks used to deny their posters from getting easily ripped off.

load more comments
view more: ‹ prev next ›