18 ms·
Forcing suspects to reveal phone passwords is unconstitutional, court says
- vectorEQ 11y agobet is not unconstitutional to force someone to give up pw of PC though? :/
- ltnately 11y agoFrom my limited understanding, the difference is the government having a reasonable level of certainty that the device in question contains the evidence they're looking for. The analogy I would use is a locked closet full of file boxes. If the government is certain that the files relating to a specific crime are in the closet, then you can be compelled to assist them in opening your closet or face an obstruction of justice charge. However if the police suspect you of a crime and suspect that you're the type of person who would keep the evidence in your locked closet that is not enough compel you to open the closet so the police can check up on their hunch. In this case, I read it as the men are suspected of insider trading and the government believes that they would have used their cell phones to communicate about the deal and the phones contain evidence of such. There is no actual evidence that the phones were used and so they're not obstructing the police in obtaining evidence the police know is there, but rather preventing the police from poking around to see if the evidence exists at all.
- beeboop 11y agoI find it odd that they aren't just able to get the data from the carriers. The only reason it'd be on the device but not the carrier/Facebook/Twitter/etc servers is if they encrypted the messages, but they would probably mention this if it were the case.
- draugadrotten 11y agoThe police will stop forcing suspects and will start inducing cooperation.
- ck2 11y agoSo is Stingray and what the TSA does to you at the airport but I guess we are never going to address that.
- ctdonath 11y agoHere's hoping we're making progress toward ending TSA's fishing expedition. Given the concerns about mass murder being preventable via a security check, at least establishing that TSA's job is ONLY to watch for explosives et al, and may not act on discovery of other harmless (to the flight & passengers) contraband.
- zipfle 11y agoThe guy quoted at the end seems to think it's the passcode itself that would be incriminating, rather than the contents of the phone. Weird. I've seen a theory that compelling someone to disclose a password can be incriminating because it is the same as asking them to admit that they stored the data in the first place, and obviously there's a case to be made that compelling disclosure of the data on the phone could be self incriminating, but the idea that the password would be something like yesiinsidertraded4 is new to me. Edit: I missed the part where he's a former federal prosecutor. Mystery solved.
- Ensorceled 11y ago"If we disbarred the defence attorney, then they would't have client/lawyer privilege"
- FireBeyond 11y agoEven then, that's not retroactive. It's your conversations that are privileged, not you. Removing you as the person's attorney doesn't make the conversations you had as their attorney not subject to privilege.
- avar 11y agoThis opens up the possibility for an interesting defense, what if I make my password contain the coordinates of those illegal drugs I buried?
- Vexs 11y agoWell, that was already covered under "no forced self-incrimination" AFAIK.
- monochromatic 11y agoI don't know enough about this issue to have a real opinion. But I know that Orin Kerr is a smart guy who I usually agree with, so I'm inclined to give his analysis some weight.
- deleted 11y ago
- MengerSponge 11y agoThis seems reasonable. Anybody want to play internet lawyer to explain why you can't/shouldn't be compelled to unlock a fingerprint protected device?
- bendykstra 11y agoAfter Riley v California (2014), a warrant is required before the search of a mobile device. Therefore, in a scenario where you are asked to unlock your device, the only question is whether you are required to cooperate by giving your password or offering your finger. In the case of a password, the answer appears to be no, due to the privilege against self-incrimination. In the case of fingerprints, there is no such right. You are merely identifying yourself to the phone and your identity cannot be construed as incriminating testimony. http://www.supremecourt.gov/opinions/13pdf/13-132_8l9c.pdf http://www.supremecourt.gov/opinions/13pdf/13-132_8l9c.pdf http://scholarlycommons.law.northwestern.edu/cgi/viewcontent.cgi?article=3437&context=jclc http://scholarlycommons.law.northwestern.edu/cgi/viewcontent...
- ctdonath 11y agoNot that I do or don't agree... My current operating theory is that investigators may use a "rag doll" view: they can't compel you to admit or divulge anything, but they can make use of your limp uncooperative (but not resisting per se) body. They may note your biometrics (eye color, iris pattern, hair samples, fingerprints, etc), doing so non-invasively (no blood samples unless you're already bleeding); as such they could take your hand and press your finger onto a fingerprint reader, just as they are allowed to gather prints for a background check without a warrant (AFAIK). Corrections welcome.
- rhino369 11y agoYou are essentially correct. The fifth amendment says you can't be compelled to "to be a witness against himself." Courts have found that bio-metrics aren't witnessing, it's just evidence they are collecting about you.
- ams6110 11y agoThe analogy I've often heard is that it's like a safe. Presented with the proper warrants, you can't refuse to open a safe on the basis of the 5th ammendment.
- norea-armozel 11y agoI'm glad they've narrowed the conditions to compel suspects of revealing passwords. It just seems that it was too wide open for just any minor hint of suspicion was enough (sans warrant) to do these fishing expeditions. If they got reasonable suspicion then they need to get a friggin' warrant. I just don't get why law enforcement is getting so sloppy these days.
- talmand 11y agoI think it's the result of the easy-going attitude of such things in the past in the effort to appear tough on crime. When they were given such lenient rules of how they approached crimes and suspects. Rules that are now being slowly taken away from them, as unconstitutional, but are still trying to operate as if they are still there.
- abakker 11y agoAll we really need is a real passcode, and then a second special passcode that wipes the phone instantly if typed. so, my normal code might be 123456, but if someone asks what my code is and I say 345678, then the phone does a data wipe that isn't obvious from the outside, and just deletes all credentials, cookies, history, documents, etc. Is this workable?
- monochromatic 11y agoAnd then they get you for destruction of evidence?
- roosterjm2k2 11y agoWouldn't they have to prove that there was evidence pertaining specifically to the current case to get you for destroying evidence?
- openasocket 11y agoThey could almost certainly get you for interfering with an investigation, though.
- knodi123 11y agoIt must be the case that evidence can be either damning or exculpatory, and either way you're not allowed to destroy it. Otherwise destroying evidence would be incentivized, because once they can actually prove that the damning evidence was present before you destroyed it.... that proof is as good as having the evidence in the first place. A judge isn't a robot. If you say "I hit an emergency button to reformat my hard drives as the cops were breaking down the door, because I was preparing to sell those drives on ebay and needed to clean them up", the judge is not obligated to respond "Shoot, I can't prove otherwise, you're free to go."
- wang_li 11y ago"What the hell did you people do to my computer? Where's all my shit? I'm going to sue you assholes!!!"
- staunch 11y agoI'm glad when the courts uphold the U.S. Constitution in a meaningful way. I have faith America will sort its shit out. But we shouldn't have to rely on the law alone. We should be able to rely on technology to make it impossible to compel people to give up their most intimidate data. Computing devices have become an extension of the mind and no one on earth has a right to the contents of your mind.
- ClintEhrlich 11y agoThere's a more elegant solution: the government should be allowed to compel you to disclose your password if probable cause exists to search your device but only subject to an evidentiary privilege that prevents your knowledge of the correct password from itself being admitted as evidence to prosecute you.
- Lawtonfogle 11y agoAnd what happens if you don't know the password or have forgotten it? I have old encrypted files and lost devices that have passwords I no longer remember.
- MichaelGG 11y agoThat's what judges are for, right? They'll review the evidence and judge if you're likely to actually have forgotten the password, or are just saying so. If you're traveling with a phone or laptop that appears to have been in-use by you, and don't know the password to it, chances are you're not being truthful. Otherwise, you'd have a plausible alibi story (I just bought this phone off Craigslist; here see the email and the ad).
- venomsnake 11y agoWhat happens if i keep passwords on ram only servers in Elbonia, that self destruct if code is not entered once per week?
- beeboop 11y agoDestruction of evidence charges? I am often surprised at how adaptive the law is for preventing loopholes like this. I would say with great confidence that this wouldn't fly.
- venomsnake 11y agoHow can I destroy evidence if the system was set up before being in custody? And the government preventing you from storing your data with dead man's switch is punishing a thought crime.
- snowwrestler 11y agoThis concerns me a little bit, actually. I know there are folks here on HN who believe that they should have an absolute power to exclude the government at all times. I'm not one of them, though. Particularly in situations where law enforcement has obtained a lawful warrant, I think they should have a way to get that information. People do commit crimes, and the police do need to solve them. One way to grant the police access is to somehow give them privileged access to the encryption. For me, this idea is dead on arrival. There is no way to grant privileged access to the police without dangerously weakening the encryption in general. I'm a believer that encryption, properly implemented without backdoors, creates a lot more good than bad. So what does that leave? It leaves compelling the owner of the phone to unlock it. If the police get a warrant to search your house, you are legally required to unlock the door and let them in. It seems to me that a passcode on the phone serves exactly the same purpose. So, my concern is that if compelling the phone owner to unlock is not an option, it will put a lot more pressure behind the idea of encryption backdoors, as the "only option" to give law enforcement the power they need to do their jobs.
- navait 11y agoGiven that key escrow failed eventually, what is different today that would make backdoors possible?
- snowwrestler 11y agoBackdoors are an absolute bad idea. My point is that when a bad idea appears to be the only alternative, there will be pressure (from people who do not understand the technology but do understand law enforcement) to do it even though it's bad.
- LinuxBender 11y agoThere is no need for a back door. Phones are not encrypted once the user accesses them. The carriers can push and pull any files to or from the phone over the air. Some of them do not require a warrant. I was always told to never ask for one.
- brewdad 11y ago
- jonknee 11y agoWhen Apple said they can't turn over data the FBI said that means adorable children will die. I wonder what they will have to say about this?
- joesmo 11y ago'Kerr added, "Having the defendant enter in his passcode would minimize the Fifth Amendment implications of the compelled compliance, as it would not involve disclosing the potentially incriminating evidence of the passcode itself."' You gotta hand it to these lawyers, they certainly know how to talk bullshit. Actually, entering the passcode into the device could potentially then leak it from the device's memory so this isn't a valid way to circumvent the Fifth Amendment--which is clearly what this asshole wants. It's akin to being asked to write it down on a piece of paper instead of saying it aloud, something that's clearly unconstitutional. Unfortunately, idiots like Kerr will continue to go around spewing bullshit trying to undermine our constitution for their own gains.
- CrossWired 11y agoHe has reversed his opinion on the matter earlier today: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2015/09/25/a-revised-approach-to-the-fifth-amendment-and-obtaining-passcodes/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...
- dang 11y agoPlease edit name-calling ("clearly what this asshole wants", "idiots like Kerr", "go around spewing bullshit") out of your comments to HN. You have a substantive point to make here, but its signal-noise ratio is upset by extraneous venting, which breaks the site guidelines. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- msluyter 11y agoAny lawyers (or wanna be lawyers) want to chime in -- is your thumbprint protected in the same way? I can see how the 5th amendment prevents them from compelling you to reveal your passcode, but does it prevent them from grabbing your thumb and using TouchID to unlock your phone? (That, or, just using a thumbprint provided during booking or whatnot...)
- mikeash 11y agoI'm just in the wannabe category (not even that), but I seem to recall it being ruled that since this was just a physical thing, it could be compelled. If you're paranoid, try to shut off your phone before any such interaction, since it requires a passcode when powering on for the first time. Alternately, use the wrong finger five times in a row to lock out TouchID.
- slinkyavenger 11y agoFrom what I've read in the past, it doesn't cover your thumbprint. [1] Thumbprints are physical, so they don't get the same protections. It's kind of like having a physical key to a physical lock. It's not self-incrimination for law enforcement to take that key and use it in the lock. Same with writing your passcode on a piece of paper. It's no longer a matter of self-incrimination if they find that and use it. [1]: http://arstechnica.com/tech-policy/2014/10/virginia-judge-police-can-demand-a-suspect-unlock-a-phone-with-a-fingerprint/ http://arstechnica.com/tech-policy/2014/10/virginia-judge-po...
- CrossWired 11y agoThe difference is described here in Orin Kerrs reversal of his opinion earlier today: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2015/09/25/a-revised-approach-to-the-fifth-amendment-and-obtaining-passcodes/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... Basically, having to provide something in your mind, the passcode, is testimony, a finger print, much like a key, is not testimony.
- izzydata 11y agoI assume there is no difference between being forced to reveal a phone password and being forced to reveal a password to some other system such as a PC, encrypted container or website?
- lamby 11y agoHere's a somewhat-related quote from patio11 that I often refer back to: > Developers have a cultural quirk where they believe that, e.g., "file sharing is not theft" / "manipulating a URL can't be a crime" / "laws about disclosing protected information invariably contain a public policy exception which comports to the temperament of the dev community" are axiomatic and thereby create an internally consistent legal system which fails to falsify those axioms but also fails to meaningfully resemble the legal system we actually operate in. > This results in developers sincerely believe things like "Your Bitcoins are unprotected by the legal system because nobody can steal a number", which is a proposition that is absurd to the legal system as "JavaScript is not a programming language" is to a programmer. (https://news.ycombinator.com/item?id=7367312 https://news.ycombinator.com/item?id=7367312) In other words, no. There is—and should be—nothing special about computers.
- Karunamon 11y agoFile sharing is not theft, and there's unambiguous legal precedent to that effect. Really bad example. Stop conflating two laws that mean different things. Nothing special about computers? Okay. "Persons, papers, and effects" no longer means emails, computer files, or anything other than physical, tangible documents that existed when that law was drafted. I really don't think that's the world you want to live in, or the argument you really want to be making. The fact that the legal system thinks there's "nothing special about computers" is the cause of a great deal of difficulties that should not exist in a sane world. This is a world with new concepts that did not exist when a lot of our laws were written, and it doesn't make much sense to presuppose that there is or even can be a 1:1 mapping between the tangible and the not, all of the time.
- spacemanmatt 11y ago
- blendo 11y agoI think this ruling marks the recognition that the information processing performed by the devices we carry has, in a legal sense, "merged" with the thoughts we carry in our heads, and are now worthy of the same fifth amendment protections. I'm in favor, but for some reason this also makes me a little worried.
- eslaught 11y agoCan someone comment on what level of court this decision was made at, and how final this decision is likely to be (i.e. how many more appeals are possible at this point)?
- suneilp 11y agoIf backdoors legislation is passed, would there be any economic effect? Personally, I wouldn't be interested in doing anything more than "basic" stuff with my phone and would not feel compelled to upgrade phones so soon. As for computing devices, aside from proprietary systems like Windows and Macs, do we not have reliable options that allow us to use uncompromised encryption? Whats to stop app developers for embedding encryption packages or would they be forced to use compromised solutions? Can you stop a person from building a secure line over a compromised medium, if that is even doable?
- Jtsummers 11y agoThis is the reason (along with probably constitutional issues) I'm not terribly concerned about most of this sort of talk [0]. It seems to me that it'd be a temporary problem, mostly with proprietary systems, that would be resolved in a few years. Sort of like the encryption export issues in the 90s, and the OpenSSH project being hosted in Canada. [0] Ok, I'm not concerned about it actually happening. The part of it that bothers me is the otherwise seemingly-sane individuals who agree with these backdoors. It's very difficult to discuss the issue with some of them because their interest in it is largely driven by emotions, specifically a desire for security and justice/revenge/control of criminal/terrorists/whatevers.
- tormeh 11y agoForcing the suspect to input the password still looks legal, according to the last paragraph. They just can't force you to tell them the password.
- pvaldes 11y agoWhy they should really need your password?. They can ask the telephone company for a saved copy of your incoming and outcoming calls in the last year so they have already (or can trace) the 90% of the interesting data in your phone. This seems also protect the policy from the temptation of doing stupid things that could lead to future lawsuits against them (like leaking photos of you drunken in a party, of from your girlfriend naked brushing her teeth and so...)