3.3 Plausible deniability and hidden volumes

Protection under coercion

Plausible deniability means that, under pressure to reveal your data, you can disclose something that looks complete and reasonable while keeping more sensitive material concealed.

It is not a promise that you will "get away with it". It is a design goal: reduce what can be proved, and make an innocent setup hard to tell apart from a protected one.

In practice, it is about making your explanation and your technical setup line up. It works best when the device holds an ordinary set of files you are willing to show, and the hidden material leaves no obvious traces.

It is not foolproof, and it does not remove the risk of coercion. It only changes what can be confidently demonstrated.

What a hidden volume is

A hidden volume is a second encrypted storage area sitting inside another encrypted container or partition, each with its own password:

• unlock the outer volume and you see a normal set of files;
• unlock the hidden volume with its separate password and a different set appears.

To an observer, both look like ordinary encrypted data. The hidden volume is designed to be indistinguishable from random noise within the outer volume.

A typical setup: a laptop whose outer volume holds everyday documents, photos and a work archive, while a smaller hidden volume holds a journalist's sources, a whistleblowing draft, or a domestic abuse survivor's planning notes. Unlocked with the "decoy" password, the device looks and behaves normally.

Two things to know:

• Hidden volumes are a feature of specific encryption tools, not a general property of "encrypted files".
• The outer and inner volumes share the same physical space, so a careless moment can overwrite hidden data.

Behavioural discipline required

The mechanism only works if your daily habits do not contradict it.

If you claim the outer volume is everything, it must look complete and believable. That means ordinary, dull data: bank statements, family photos, emails, a few work documents, and the usual clutter of a real machine. An empty or suspiciously tidy volume raises questions.

Watch when and where you unlock each volume. Unlock the hidden one often at home, then travel with the same laptop, and it could be exposed by:

• cached file lists;
• recently opened documents;
• cloud sync logs.

The obvious fix: keep hidden volumes off devices that routinely connect to services or get used for casual browsing.

Also, do not mix accounts. Logging into work email or social media while the hidden volume is open can leave traces outside the encrypted space: browser history, file previews, thumbnails, indexing databases, or application logs on the system drive. Minimising these leak paths is essential, and it often means a separate operating system or a dedicated device for the sensitive volume.

How deniability fails in practice

The most common failure is not cryptographic. It is inconsistency. Claim a small set of documents when your public work suggests more, and the mismatch invites scrutiny. A campaign organiser with five files and no drafts, or a researcher who cannot account for their datasets, looks implausible even if the encryption is perfect.

Metadata outside the container. Many operating systems keep caches of recent files, thumbnail previews or search indexes. On an unencrypted system drive, these can reveal the existence or shape of hidden content. The fix is to encrypt the system drive too and disable or routinely clear caches, but that adds friction and is easy to get wrong.

Backups and sync. Cloud storage clients can quietly copy filenames or document hashes before you notice. Even with encrypted contents, the pattern of what was backed up can suggest more exists than you are showing. Keep hidden volumes on storage that never touches consumer cloud services, and disable automatic indexing and sync on the host system.

Legal and psychological pressure

In the UK, there are legal powers to compel disclosure of encryption keys in certain circumstances. That is a legal context, not a technical one, and it shapes how deniability is judged. Even if a hidden volume exists and cannot be proven, refusing to provide a key may have consequences.

That is no reason to ignore privacy tools. It is a reason to understand the difference between technical protection and legal obligation.

Psychological pressure matters just as much. Under stress, people make mistakes, contradict themselves, or forget which password unlocks what. So:

• keep the routine simple and well practised;
• avoid complicated stories that are hard to maintain.

Some people keep a small, innocuous hidden volume they are prepared to reveal under pressure, with a second sensitive store elsewhere. It does not remove risk, but it can cut the chance of panic errors.

Why backups often undermine deniability

Backups are essential for data safety, and hostile to deniability. A hidden volume backed up to an external drive or cloud account may leave fingerprints:

• duplicate blocks;
• unusual file sizes;
• encryption containers that stand out.

Even if the backup is encrypted, the mere existence of an extra archive can be used to argue that more data exists than you disclosed.

Everyday example: a laptop with a hidden volume for sensitive work and a backup tool that copies the whole disk every night. That backup, sitting in a cupboard or syncing to the cloud, is a second point of exposure. Not theoretical, either: recovery tools, IT support staff or investigators can find archives you forgot were running.

Your options all involve trade-offs:

• Do not back up the hidden volume, and accept the risk of data loss.
• Keep backups offline, encrypted and physically controlled, which reduces exposure but still creates artefacts.
• Make the hidden data replaceable, for example by keeping only short-lived working files there and long-term records elsewhere.

None of these remove the underlying tension: deniability and dependable backup pull in opposite directions.

The UK legal reality: compelled key disclosure

Before relying on a hidden volume in this country, understand this: the United Kingdom has a specific law that can compel you to hand over keys.

The facts:

• Under Part III of the Regulation of Investigatory Powers Act 2000, a properly authorised notice (commonly called a Section 49 notice) can require you to disclose a decryption key or put protected information into an intelligible form.
• Failing to comply is itself a criminal offence, carrying up to two years in prison in most cases, and up to five years where national security or child indecency is involved.
• This is a legal power, not a technical attack. No amount of cryptographic cleverness changes the fact that refusal can lead to prosecution.

This is where deniability hits its hardest limit. The theory: you cannot be compelled to reveal a key to data whose existence cannot be proven, so a well-hidden volume is, in principle, protected by saying there is nothing more to disclose.

In reality, that puts you in a precarious position. You are betting that:

• no trace of the hidden volume exists anywhere (in caches, logs, backups, or your own behaviour);
• you can keep a consistent account under sustained, expert questioning.

If an investigator has independent reason to believe a hidden volume exists, your denial becomes a claim to be tested rather than a shield, and the burden of the situation shifts onto you. The interaction between encryption, coercion and border or custody powers is covered in Chapter 10, and wider pressure on encryption in UK law in 17.5.

The honest position: deniability defends against not being able to prove something exists, not against being asked.

• Genuinely valuable against an opportunistic thief, a controlling family member, or a border official doing a routine check. They have neither the legal power nor the forensic resources to press the point.
• Far weaker against a determined investigation backed by legal compulsion. Treating it as a magic defence there is a serious and potentially self-incriminating mistake.

Deciding whether deniability is worth it

For most people, most of the time, hidden volumes are the wrong tool. Saying so plainly is more useful than selling them as a default privacy feature. They:

• demand exacting, sustained discipline;
• sit in constant tension with the backups you need to avoid losing data;
• can be undermined by the operating system's own housekeeping;
• offer little protection against the adversary most people imagine they are guarding against: the state with legal power to compel keys.

A simpler arrangement protects the vast majority of users better, with far less to go wrong: ordinary strong full-disk encryption (see 3.2), good operational habits, and keeping genuinely dangerous material off your devices altogether.

The narrow case where deniability earns its complexity is a specific, well-understood threat:

• a journalist crossing a hostile border with sources to protect;
• an activist under an authoritarian regime;
• a survivor whose abuser has physical access to their devices and a motive to search them.

Even then, the right approach is usually not one device loaded with everything. Instead: minimise what travels with you, use dedicated devices for sensitive work, and rehearse the routine until it is second nature.

One hard truth: if you cannot keep up the discipline, a hidden volume can make you less safe than having no secret at all, because a half-maintained deniable setup leaves exactly the inconsistencies that invite scrutiny. Decide from a clear-eyed threat model, as set out in Chapter 1, not from the appeal of the idea.