8 ms·

From the article: "Rawls, the government argues, (PDF) "repeatedly asserts that the All Writs Act order requires him to divulge his passcodes, but he is incorre

From the article: "Rawls, the government argues, (PDF) "repeatedly asserts that the All Writs Act order requires him to divulge his passcodes, but he is incorrect: the order requires no testimony from [Rawls], and he may keep his passcodes to himself. Instead, the order requires only that [Rawls] produce his computer and hard drives in an unencrypted state.""

justinjlynn 10y ago
Ah, yes... the legal equivalent of "I'm not touching youuuuu...."
Natanael_L 10y ago
That's like being forced to translate your own notebook written in code. Not my problem, get your own codebreakers to do it.
- cookiecaper 10y ago
  It's different because you can't verify the authenticity of the custom hand-rolled cipher. This is a request for the accused to produce the keys only, not to do the work of manually decoding.
  - Natanael_L 10y ago
    In a way still testimonial. I must provide secrets that reveal information about myself. It is literally the same as ordering me to tell them how to make sense of the unreadable data. I'm not giving them a plaintext copy of something already existing elsewhere (assuming no unencrypted backups), but producing new information for them. And unless you used FDE with full authentication (AEAD), which almost nobody does, there's nothing that says that this particular ciphertext represents the exact plaintext I've had at any given point in time. With XTS mode (Truecrypt) you can cut and paste together different blocks from different ciphertexts under the same key for as long as they're in the right positions. Depending on how much you know about the computer and if you've got access to multiple backups, you can splice together something that even if it doesn't contain anything illegal, it would look suspicious and incriminating. Consider for example LE getting your full file version history of a container from Dropbox. And revealing the keys is a kind of testimony that you have had read/write access to the drive, and that it indeed is encrypted (not just random).
  - mejari 10y ago
    Isn't the grandparent quote stating the opposite of what you've said here?
    - cookiecaper 10y ago
      Technically, maybe. The court's language is meant to clarify that the accused does not have to disclose his key, he need only unlock his disks. There is no reasonable expectation that this would require a significant effort or testimony on his part. His case hinges on whether he can prove that the work necessary to decrypt the disks, which is understood to mean entering the keys which he remembers, is testimonial self-incrimination and thus illegal under the Fifth Amendment. Believe it or not, most judges are aware of smartasses and are not required to accept "Well, I don't remember, and you can't prove that I do, so ha! You have to let me go now!" The evidence surely indicates that this man used his computer regularly, which necessarily required unlocking his disks, and that means that by all rational conclusions he is, or at least was, capable of complying with the order. Until the court is fully convinced that he is no longer capable of complying, or until the order is dropped, modified, or stayed, Rawls will remain detained for his failure to comply.
      - pdpi 10y ago
        > There is no reasonable expectation that this would require a significant effort or testimony on his part. Whether or not this is true is precisely the crux of the matter. Your comment echoes the government's position: Decrypting the hard disk is not equivalent to testimony, and is therefore not protected by the fifth. The defence and EFF's amicus brief argue instead that we live in a world where our phones and computers are effectively an extension of ourselves, and asking to decrypt those is equivalent to forcing you to testify on your most intimate secrets, which is most certainly not kosher.
      - type0 10y ago
        > The evidence surely indicates that this man used his computer regularly, which necessarily required unlocking his disks, and that means that by all rational conclusions he is, or at least was, capable of complying with the order. Well that is understandable but what if he burned the passwords just before he got arrested, heck he might even chewed them up and those are long gone. How would they find out? If he is a such dangerous child molester should they go full Sam L.Jackson Unthinkable style on him?
  - brw12 10y ago
    No, you're exactly wrong. The demand on Rawls is that he do whatever work is necessary to produce the drives in an unencrypted state. If he hid a printout of the password on Mount Everest, that means he is compelled by the court to climb Mount Everest.
    - cookiecaper 10y ago
      I'm speaking in practical terms here. I haven't read the actual order, but I understand the language of the order may technically require him to do the work necessary to render his drives in a decrypted state. That's because they expect the only requirement to be entering the key. If he had a password hidden on Mt. Everest and demonstrated that to the court's satisfaction, and then cooperated with the court's order to reasonably assist in decryption (e.g., allowing the court access to the sherpa that routinely retrieves this key and enters it to decrypt his disks via some remote mechanism), I assume he would be considered compliant.
      - belovedeagle 10y ago
        This explanation (and the other forms in which it's presented in this thread) is really troubling to me. It sounds like in order to offer a defense of the inability to comply with the order, the accused has to provide evidence which could be used against him in the trial. In your example, the existence of the password on Mt Everest could be used against him, and was evidence the prosecution probably could not have discovered but for his compelled testimony. It's even more troubling in the case of the Sherpa: revealing the identity of an accomplice (as it were) is surely self-incriminating! But if this were really how he obtains the password (and similar schemes of off-site passwords and accomplices aren't so outlandish in the case of servers which might require the keys on reboot a few times per year), how could he possibly defend himself from the contempt charge? It sickens me to imagine being in the same situation. If this isn't an instance of the cruel trilemma, I don't know what is =(
      - dingoegret 10y ago
        And that is the fucking problem. It's a principled issue and you admit that it is. What your arguing about is how much is enough to violate the principle. Since people can only agree on principles, you shouldn't kill, then the law needs to fucking operate on principle alone.
sjy 10y ago
That does not change the parent's point – he is in contempt for refusing to comply, not for being unable to comply. Contempt must be willful: https://www.justice.gov/usam/criminal-resource-manual-753-elements-offense-contempt https://www.justice.gov/usam/criminal-resource-manual-753-el...
- baddox 10y ago
  Yes, and the people who are holding him in a cage are the people deciding whether he is unable or unwilling. Not exactly any consolation.
  - cookiecaper 10y ago
    Yes, the state ultimately decides whether someone's behavior justifies their detainment or not. Is this really news to you? Should they just let him go because he said "Shoot, turns out I don't remember!" How would any criminal justice occur if we let people off with flimsy excuses like that? Most of the time, absolute certainty that someone is guilty is not possible; that's why the criminal standard is "beyond a reasonable doubt", not "proven to the point of mathematical certainty". In this case, the simple fact is that the court does not believe Rawls's assertion that he is unable to comply, so he remains detained on contempt. This will change once the court is convinced that Rawls is indeed no longer able to comply.
    - baddox 10y ago
      > should they just let him go because he said "Shoot, turns out I don't remember!" No, I don't think any private individual should be jailed for failing to decrypt data, regardless of whether they are able to, as part of a case wherein they are the accused. This should be a basic fundamental right of the accused, and I think the current working interpretations of the fifth amendment are unjust. > How would any criminal justice occur if we let people off with flimsy excuses like that? Justice in my view is the presumption of innocence, with the duty to demonstrate guilt beyond reasonable doubt placed on the prosecution. Forcing accused to decrypt data obviously helps the prosecution, but so would warrantless searches, and I oppose both for precisely the same reason.

justinjlynn 10y ago

Ah, yes... the legal equivalent of "I'm not touching youuuuu...."

Natanael_L 10y ago

That's like being forced to translate your own notebook written in code. Not my problem, get your own codebreakers to do it.

cookiecaper 10y ago
It's different because you can't verify the authenticity of the custom hand-rolled cipher. This is a request for the accused to produce the keys only, not to do the work of manually decoding.
- Natanael_L 10y ago
  In a way still testimonial. I must provide secrets that reveal information about myself. It is literally the same as ordering me to tell them how to make sense of the unreadable data. I'm not giving them a plaintext copy of something already existing elsewhere (assuming no unencrypted backups), but producing new information for them. And unless you used FDE with full authentication (AEAD), which almost nobody does, there's nothing that says that this particular ciphertext represents the exact plaintext I've had at any given point in time. With XTS mode (Truecrypt) you can cut and paste together different blocks from different ciphertexts under the same key for as long as they're in the right positions. Depending on how much you know about the computer and if you've got access to multiple backups, you can splice together something that even if it doesn't contain anything illegal, it would look suspicious and incriminating. Consider for example LE getting your full file version history of a container from Dropbox. And revealing the keys is a kind of testimony that you have had read/write access to the drive, and that it indeed is encrypted (not just random).
- mejari 10y ago
  Isn't the grandparent quote stating the opposite of what you've said here?
  - cookiecaper 10y ago
    Technically, maybe. The court's language is meant to clarify that the accused does not have to disclose his key, he need only unlock his disks. There is no reasonable expectation that this would require a significant effort or testimony on his part. His case hinges on whether he can prove that the work necessary to decrypt the disks, which is understood to mean entering the keys which he remembers, is testimonial self-incrimination and thus illegal under the Fifth Amendment. Believe it or not, most judges are aware of smartasses and are not required to accept "Well, I don't remember, and you can't prove that I do, so ha! You have to let me go now!" The evidence surely indicates that this man used his computer regularly, which necessarily required unlocking his disks, and that means that by all rational conclusions he is, or at least was, capable of complying with the order. Until the court is fully convinced that he is no longer capable of complying, or until the order is dropped, modified, or stayed, Rawls will remain detained for his failure to comply.
    - pdpi 10y ago
      > There is no reasonable expectation that this would require a significant effort or testimony on his part. Whether or not this is true is precisely the crux of the matter. Your comment echoes the government's position: Decrypting the hard disk is not equivalent to testimony, and is therefore not protected by the fifth. The defence and EFF's amicus brief argue instead that we live in a world where our phones and computers are effectively an extension of ourselves, and asking to decrypt those is equivalent to forcing you to testify on your most intimate secrets, which is most certainly not kosher.
    - type0 10y ago
      > The evidence surely indicates that this man used his computer regularly, which necessarily required unlocking his disks, and that means that by all rational conclusions he is, or at least was, capable of complying with the order. Well that is understandable but what if he burned the passwords just before he got arrested, heck he might even chewed them up and those are long gone. How would they find out? If he is a such dangerous child molester should they go full Sam L.Jackson Unthinkable style on him?
- brw12 10y ago
  No, you're exactly wrong. The demand on Rawls is that he do whatever work is necessary to produce the drives in an unencrypted state. If he hid a printout of the password on Mount Everest, that means he is compelled by the court to climb Mount Everest.
  - cookiecaper 10y ago
    I'm speaking in practical terms here. I haven't read the actual order, but I understand the language of the order may technically require him to do the work necessary to render his drives in a decrypted state. That's because they expect the only requirement to be entering the key. If he had a password hidden on Mt. Everest and demonstrated that to the court's satisfaction, and then cooperated with the court's order to reasonably assist in decryption (e.g., allowing the court access to the sherpa that routinely retrieves this key and enters it to decrypt his disks via some remote mechanism), I assume he would be considered compliant.
    - belovedeagle 10y ago
      This explanation (and the other forms in which it's presented in this thread) is really troubling to me. It sounds like in order to offer a defense of the inability to comply with the order, the accused has to provide evidence which could be used against him in the trial. In your example, the existence of the password on Mt Everest could be used against him, and was evidence the prosecution probably could not have discovered but for his compelled testimony. It's even more troubling in the case of the Sherpa: revealing the identity of an accomplice (as it were) is surely self-incriminating! But if this were really how he obtains the password (and similar schemes of off-site passwords and accomplices aren't so outlandish in the case of servers which might require the keys on reboot a few times per year), how could he possibly defend himself from the contempt charge? It sickens me to imagine being in the same situation. If this isn't an instance of the cruel trilemma, I don't know what is =(
    - dingoegret 10y ago
      And that is the fucking problem. It's a principled issue and you admit that it is. What your arguing about is how much is enough to violate the principle. Since people can only agree on principles, you shouldn't kill, then the law needs to fucking operate on principle alone.

sjy 10y ago

That does not change the parent's point – he is in contempt for refusing to comply, not for being unable to comply. Contempt must be willful: https://www.justice.gov/usam/criminal-resource-manual-753-elements-offense-contempt https://www.justice.gov/usam/criminal-resource-manual-753-el...

baddox 10y ago
Yes, and the people who are holding him in a cage are the people deciding whether he is unable or unwilling. Not exactly any consolation.
- cookiecaper 10y ago
  Yes, the state ultimately decides whether someone's behavior justifies their detainment or not. Is this really news to you? Should they just let him go because he said "Shoot, turns out I don't remember!" How would any criminal justice occur if we let people off with flimsy excuses like that? Most of the time, absolute certainty that someone is guilty is not possible; that's why the criminal standard is "beyond a reasonable doubt", not "proven to the point of mathematical certainty". In this case, the simple fact is that the court does not believe Rawls's assertion that he is unable to comply, so he remains detained on contempt. This will change once the court is convinced that Rawls is indeed no longer able to comply.
  - baddox 10y ago
    > should they just let him go because he said "Shoot, turns out I don't remember!" No, I don't think any private individual should be jailed for failing to decrypt data, regardless of whether they are able to, as part of a case wherein they are the accused. This should be a basic fundamental right of the accused, and I think the current working interpretations of the fifth amendment are unjust. > How would any criminal justice occur if we let people off with flimsy excuses like that? Justice in my view is the presumption of innocence, with the duty to demonstrate guilt beyond reasonable doubt placed on the prosecution. Forcing accused to decrypt data obviously helps the prosecution, but so would warrantless searches, and I oppose both for precisely the same reason.