5 ms·

How does the prosecution prove the plaintext came from defendants' devices? When DNA is used as evidence not only is there chain of custody rules for biological

by cmurf 11y ago

How does the prosecution prove the plaintext came from defendants' devices? When DNA is used as evidence not only is there chain of custody rules for biological material, but the details of DNA extraction and comparison are openly documented. You don't just have someone claim something is a match, there's proof.

forgotpwtomain 11y ago
They might just be planning to use the information learned from this to assist in the prosecution without providing it as evidence? For example they could subpoena those involved in the imessage conversations or find other criminal leads?
- mattlutze 11y ago
  If the information is used to build a case against a particular person, my non-lawyer understanding is that it becomes evidence. Or rather, if one of those leads ends up being complicit in the charges, you have to prove as the prosecution how you came to that conclusion. You can't just say "we started investigations, then magic, then we interviewed this guy and figured it out." Historically, when the FBI or some other organization helps but doesn't want to be named as part of the process (to protect their secret methods of accessing or collecting information), prosecutors will do something called "parallel construction," in which they build an alternative timeline to how they could have come by the information that led to the new interviews. It's interesting that in this case, with the FBI publicly acting in support, they're giving up the ghost on that and opening themselves to perhaps being called for testimony. I'm curious how they'd use state secrets protections to get around having to explain their process, and whether a local/appellate/superior court justice(s) would allow it.
  - venomsnake 11y ago
    My non-lawyer reads it differently - the poisonous tree fruit is when you infringe on someone's rights. If you obtain information that is not reliable, you can act on it (and convince judge to give you warrants) just probably not use it in real trial. I also think it depends if you want more information for the current suspect or you are on a fishing expedition
    - logfromblammo 11y ago
      You have to walk the entire path from the presumption of innocence. You need reasonable suspicion to accost someone in public. You need probable cause to arrest, and conduct searches or perform seizures. You need some credible evidence to go to trial. You need a preponderance of the evidence to win most civil disputes. You need clear and convincing evidence when the results of a civil dispute may impose a heavy burden or curtailment of rights on one of the parties. Criminal trials require evidence beyond reasonable doubt. Failing to propose a believable narrative for each increase in magnitude in the burden of proof may cause the entire case to fail in the US. If you collect evidence on someone that would ordinarily require probable cause when that person should be enjoying the presumption of innocence, that evidence is inadmissible, as is all investigation that depends on it to proceed. Parallel construction is taking theatrical steps ex post facto to defraud the courts into believing that evidence is not only admissible at trial, but also a reasonable basis for further investigation. If the FBI performs mass suspicionless surveillance on presumed innocent victims, finds evidence of a crime, then notifies another agency to contrive reasonable suspicion, then probable cause, to uncover the same evidence via a legally plausible narrative, that is kicking civil rights square in the teeth. Furthermore, it encourages otherwise innocent activities to be considered as reasonable suspicion, and promotes aggressive police tactics to manufacture probable cause out of reasonable suspicion, or bully people into providing consent or confessions. You get "judge dog" approving search warrants whenever the K-9 cop signals him to provide probable cause. And it combines with forfeiture to become even worse. When "accidental discovery" evidence is admissible, that is a significant weakening of the public's protections against government, as it provides additional avenues for parallel construction, such as dropping a smoke bomb through a window and pulling a fire alarm, such that responding fire department personnel can notice "drug paraphernalia" and tip the police, who get a warrant based on the tip and conduct a search for drugs. This encourages obstruction of services to promote public safety, such as disabling alarms or blocking emergency calls. When "clean hands" evidence is admissible, one "dirty hands" cop--or a paid informant--just needs to pretend to be an anonymous member of the public to tip off the "clean hands" cop. My own non-judge opinion is that poisonous fruit is when one law is broken in pursuit of enforcing another, not just when someone's rights are infringed.
- downandout 11y ago
  Yes, that would be my take on it. The government can still make use of inadmissible or illegally obtained evidence. The evidence here was obtained legally, so it will likely be used to bolster the case against the defendants and anyone that may have assisted them. Even in the case of illegally obtained evidence, there are techniques like parallel construction [1] that they can use to make their cases. They also have the so-called "clean hands" exception, which allows allows the government to introduce evidence into trial that was illegally obtained by a third party when the government did not play any role in obtaining that information [2]. The US legal system was designed to seem exceedingly fair on its surface, while allowing for unconscionable abuses by those skilled in maneuvering through its loopholes. [1] https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction [2] http://jipel.law.nyu.edu/ledger-vol-1-no-2-2-coffman/ http://jipel.law.nyu.edu/ledger-vol-1-no-2-2-coffman/
  - Retric 11y ago
    Parallel construction is not legal. It's goal is to disguise the origin of information, but just because you get away with breaking the law that does not mean what you did was legal. Proving this is very hard though.
  - cperciva 11y ago
    parallel construction You're probably thinking of "inevitable discovery", which says that illegally obtained information can be used anyway if the prosecution can show that they would have obtained it anyway. Parallel construction is something intelligence agencies do in order to hide how they obtained information in the first place (whether legal or otherwise).
    - nxzero 11y ago
      FBI, local law enforcement, etc use parallel construction too; for examples, look into how the FBI works with local law enforcement using tech like Stringray.
- nxzero 11y ago
  Unless they don't find proof that the defendants are not guilt, then legally they're required to provide this evidence.
roel_v 11y ago
Same way they 'prove' that the report about DNA is an accurate description of what the actual analysis showed, or that there even was an analysis at all: by trusting the technicians who did it, and the protocols surrounding that. There is no 'single legal way' to do DNA analysis: it's all about the judges and jury trusting the experts to be impartial. Manufacturers of DNA analysis devices don't have to show their firmware source code for the analysis to be admissible as evidence.
- cmurf 11y ago
  No there isn't a blind trust in an expert nor a requirement for source code. There is something in between this. Look at the PCR method of analyzing DNA and how the comparison is made. Look at the case law on this. One example, https://scholar.google.com/scholar_case?case=11856984917651138776 https://scholar.google.com/scholar_case?case=118569849176511... Now square that with "saying things does not make them true" and "you're entitled to your own opinion, but not your own facts". I don't see how the prosecution has met the burden of proof, beyond a reasonable doubt, unless they show their work. Otherwise this is way too easy to frame people.
  - TheSpiceIsLife 11y ago
    (Wrong button, intended to up vote you, my apologies.) Maybe DNA from blood is a different matter, but when it comes to hair samples I don't think we can trust the FBI. "The Justice Department and FBI have formally acknowledged that nearly every examiner in an elite FBI forensic unit gave flawed testimony in almost all trials in which they offered evidence against criminal defendants over more than a two-decade period before 2000."[1] 1. https://www.washingtonpost.com/local/crime/fbi-overstated-forensic-hair-matches-in-nearly-all-criminal-trials-for-decades/2015/04/18/39c8d8c6-e515-11e4-b510-962fcfabc310_story.html https://www.washingtonpost.com/local/crime/fbi-overstated-fo...
qb45 11y ago
> How does the prosecution prove the plaintext came from defendants' devices? You show the recovered key and plaintext and demonstrate that they match the ciphertext. The chance that several gigabytes of encrypted data accidentally happen to decrypt with wrong key to a different several gigabytes of perfectly valid data is rather slim, which means that any key which produces valid data is the key you are looking for.
- nxzero 11y ago
  Right, in some cases I've seen a party forced to deliver an encrypted version of evidence that in the future they maybe required to produce, since this in theory provides custody and non-repudiation if required. In fact, this maybe the future of evidence, all data is legally collected as encrypted, then accessible on demand. [1] https://en.m.wikipedia.org/wiki/Non-repudiation https://en.m.wikipedia.org/wiki/Non-repudiation
- OvidNaso 11y ago
  Wasn't that the entire purpose and function (practically) of TrueCrypt's hidden volumes?
  - pricechild 11y ago
    https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 is another interesting implementation of the idea. "Deniable Encryption" is the term.
bradleyjg 11y ago
You have someone from the FBI and/or the private contractor testify as to how the plaintext was obtained. Same thing as when you do a DNA match, you need to have the technician testify (unless the defense stipulates).
- cmurf 11y ago
  "how the plaintext was obtained" which means it sounds next to impossible FBI can keep their exploit secret indefinitely if anything on an encrypted device is going to be used as evidence in a criminal case.
  - bradleyjg 11y ago
    Maybe, if the defense counsel specifically tries to get that level of detail out on cross. But in the ordinary course of events it probably wouldn't. The jury isn't going to understand or care about the details -- how is eliciting them on cross going to help the defense? Remember the defense lawyer is responsible to his client, he isn't a roving do-gooder.

by cmurf 11y ago

forgotpwtomain 11y ago

They might just be planning to use the information learned from this to assist in the prosecution without providing it as evidence? For example they could subpoena those involved in the imessage conversations or find other criminal leads?

mattlutze 11y ago
If the information is used to build a case against a particular person, my non-lawyer understanding is that it becomes evidence. Or rather, if one of those leads ends up being complicit in the charges, you have to prove as the prosecution how you came to that conclusion. You can't just say "we started investigations, then magic, then we interviewed this guy and figured it out." Historically, when the FBI or some other organization helps but doesn't want to be named as part of the process (to protect their secret methods of accessing or collecting information), prosecutors will do something called "parallel construction," in which they build an alternative timeline to how they could have come by the information that led to the new interviews. It's interesting that in this case, with the FBI publicly acting in support, they're giving up the ghost on that and opening themselves to perhaps being called for testimony. I'm curious how they'd use state secrets protections to get around having to explain their process, and whether a local/appellate/superior court justice(s) would allow it.
- venomsnake 11y ago
  My non-lawyer reads it differently - the poisonous tree fruit is when you infringe on someone's rights. If you obtain information that is not reliable, you can act on it (and convince judge to give you warrants) just probably not use it in real trial. I also think it depends if you want more information for the current suspect or you are on a fishing expedition
  - logfromblammo 11y ago
    You have to walk the entire path from the presumption of innocence. You need reasonable suspicion to accost someone in public. You need probable cause to arrest, and conduct searches or perform seizures. You need some credible evidence to go to trial. You need a preponderance of the evidence to win most civil disputes. You need clear and convincing evidence when the results of a civil dispute may impose a heavy burden or curtailment of rights on one of the parties. Criminal trials require evidence beyond reasonable doubt. Failing to propose a believable narrative for each increase in magnitude in the burden of proof may cause the entire case to fail in the US. If you collect evidence on someone that would ordinarily require probable cause when that person should be enjoying the presumption of innocence, that evidence is inadmissible, as is all investigation that depends on it to proceed. Parallel construction is taking theatrical steps ex post facto to defraud the courts into believing that evidence is not only admissible at trial, but also a reasonable basis for further investigation. If the FBI performs mass suspicionless surveillance on presumed innocent victims, finds evidence of a crime, then notifies another agency to contrive reasonable suspicion, then probable cause, to uncover the same evidence via a legally plausible narrative, that is kicking civil rights square in the teeth. Furthermore, it encourages otherwise innocent activities to be considered as reasonable suspicion, and promotes aggressive police tactics to manufacture probable cause out of reasonable suspicion, or bully people into providing consent or confessions. You get "judge dog" approving search warrants whenever the K-9 cop signals him to provide probable cause. And it combines with forfeiture to become even worse. When "accidental discovery" evidence is admissible, that is a significant weakening of the public's protections against government, as it provides additional avenues for parallel construction, such as dropping a smoke bomb through a window and pulling a fire alarm, such that responding fire department personnel can notice "drug paraphernalia" and tip the police, who get a warrant based on the tip and conduct a search for drugs. This encourages obstruction of services to promote public safety, such as disabling alarms or blocking emergency calls. When "clean hands" evidence is admissible, one "dirty hands" cop--or a paid informant--just needs to pretend to be an anonymous member of the public to tip off the "clean hands" cop. My own non-judge opinion is that poisonous fruit is when one law is broken in pursuit of enforcing another, not just when someone's rights are infringed.
downandout 11y ago
Yes, that would be my take on it. The government can still make use of inadmissible or illegally obtained evidence. The evidence here was obtained legally, so it will likely be used to bolster the case against the defendants and anyone that may have assisted them. Even in the case of illegally obtained evidence, there are techniques like parallel construction [1] that they can use to make their cases. They also have the so-called "clean hands" exception, which allows allows the government to introduce evidence into trial that was illegally obtained by a third party when the government did not play any role in obtaining that information [2]. The US legal system was designed to seem exceedingly fair on its surface, while allowing for unconscionable abuses by those skilled in maneuvering through its loopholes. [1] https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction [2] http://jipel.law.nyu.edu/ledger-vol-1-no-2-2-coffman/ http://jipel.law.nyu.edu/ledger-vol-1-no-2-2-coffman/
- Retric 11y ago
  Parallel construction is not legal. It's goal is to disguise the origin of information, but just because you get away with breaking the law that does not mean what you did was legal. Proving this is very hard though.
- cperciva 11y ago
  parallel construction You're probably thinking of "inevitable discovery", which says that illegally obtained information can be used anyway if the prosecution can show that they would have obtained it anyway. Parallel construction is something intelligence agencies do in order to hide how they obtained information in the first place (whether legal or otherwise).
  - nxzero 11y ago
    FBI, local law enforcement, etc use parallel construction too; for examples, look into how the FBI works with local law enforcement using tech like Stringray.
nxzero 11y ago
Unless they don't find proof that the defendants are not guilt, then legally they're required to provide this evidence.

roel_v 11y ago

Same way they 'prove' that the report about DNA is an accurate description of what the actual analysis showed, or that there even was an analysis at all: by trusting the technicians who did it, and the protocols surrounding that. There is no 'single legal way' to do DNA analysis: it's all about the judges and jury trusting the experts to be impartial. Manufacturers of DNA analysis devices don't have to show their firmware source code for the analysis to be admissible as evidence.

cmurf 11y ago
No there isn't a blind trust in an expert nor a requirement for source code. There is something in between this. Look at the PCR method of analyzing DNA and how the comparison is made. Look at the case law on this. One example, https://scholar.google.com/scholar_case?case=11856984917651138776 https://scholar.google.com/scholar_case?case=118569849176511... Now square that with "saying things does not make them true" and "you're entitled to your own opinion, but not your own facts". I don't see how the prosecution has met the burden of proof, beyond a reasonable doubt, unless they show their work. Otherwise this is way too easy to frame people.
- TheSpiceIsLife 11y ago
  (Wrong button, intended to up vote you, my apologies.) Maybe DNA from blood is a different matter, but when it comes to hair samples I don't think we can trust the FBI. "The Justice Department and FBI have formally acknowledged that nearly every examiner in an elite FBI forensic unit gave flawed testimony in almost all trials in which they offered evidence against criminal defendants over more than a two-decade period before 2000."[1] 1. https://www.washingtonpost.com/local/crime/fbi-overstated-forensic-hair-matches-in-nearly-all-criminal-trials-for-decades/2015/04/18/39c8d8c6-e515-11e4-b510-962fcfabc310_story.html https://www.washingtonpost.com/local/crime/fbi-overstated-fo...

qb45 11y ago

> How does the prosecution prove the plaintext came from defendants' devices? You show the recovered key and plaintext and demonstrate that they match the ciphertext. The chance that several gigabytes of encrypted data accidentally happen to decrypt with wrong key to a different several gigabytes of perfectly valid data is rather slim, which means that any key which produces valid data is the key you are looking for.

nxzero 11y ago
Right, in some cases I've seen a party forced to deliver an encrypted version of evidence that in the future they maybe required to produce, since this in theory provides custody and non-repudiation if required. In fact, this maybe the future of evidence, all data is legally collected as encrypted, then accessible on demand. [1] https://en.m.wikipedia.org/wiki/Non-repudiation https://en.m.wikipedia.org/wiki/Non-repudiation
OvidNaso 11y ago
Wasn't that the entire purpose and function (practically) of TrueCrypt's hidden volumes?
- pricechild 11y ago
  https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 is another interesting implementation of the idea. "Deniable Encryption" is the term.

bradleyjg 11y ago

You have someone from the FBI and/or the private contractor testify as to how the plaintext was obtained. Same thing as when you do a DNA match, you need to have the technician testify (unless the defense stipulates).

cmurf 11y ago
"how the plaintext was obtained" which means it sounds next to impossible FBI can keep their exploit secret indefinitely if anything on an encrypted device is going to be used as evidence in a criminal case.
- bradleyjg 11y ago
  Maybe, if the defense counsel specifically tries to get that level of detail out on cross. But in the ordinary course of events it probably wouldn't. The jury isn't going to understand or care about the details -- how is eliciting them on cross going to help the defense? Remember the defense lawyer is responsible to his client, he isn't a roving do-gooder.