31 ms·

Man jailed indefinitely for refusing to decrypt hard drives loses appeal

319 points by davesailer 10y ago

ChoGGi 10y ago
I'm surprised he hasn't argued there's evidence of a different crime on the disk(s), as a reason why he is refusing under the Fifth. Edit: Thanks for the downvotes :)
- pmyteh 10y ago
  They'd offer him immunity on the "different crime", then he'd have no defence.
  - ChoGGi 10y ago
    That would work? Not a lawyer or American so (Thanks for the upvotes, and pmyteh for replying)
mgamache 10y ago
So if I forget my password, I can be in jail forever?
- solipsism 10y ago
  Assuming it's shown to be a foregone conclusion you have child porn on your machine, yes.
  - grawlinson 10y ago
    Then why hasn't this person been prosecuted yet? Are they just wanting him to give up his credentials so that they can refer to this case as a precedent?
    - ryandrake 10y ago
      They clearly don't need to prosecute him now, since it looks like he can be jailed indefinitely and everyone's cool with it. Scary stuff.
    - cheez 10y ago
      Same. I can't understand why, if it's a foregone conclusion, the other stuff can't be used to convict him.
    - petee 10y ago
      A possibility is that if they prosecute based on what they have now, then he will _never_ decrypt it - they may be aiming to break up a porn-ring or the actual producers, and he may have very valuable data on the drive, that may potentially save lives
      - neltnerb 10y ago
        If this were the case, they would provide him immunity in exchange for cooperation in prosecuting up the "food chain" like they do with mobsters.
        mjolk 10y ago
        I think this is just a thing that happens in the movies. Also, check out the source document and let me know if you think someone found guilty of the described acts deserves immunity.
        fjdlwlv 10y ago
        What? It happens all the time on regular cirminal cases. Movies didn't invent "informants". Immunity can mean being convicted for lesser offenses, or negotiating a less than maximal punishment.
        neltnerb 10y ago
        It's not really a matter of my opinion on the specific case. Even with the full documents, there is no way that I'd have enough information to judge fairly, so I wouldn't try to. I'm just saying that they have a way out, and it seems that they've made the judgment that the potential of finding other criminals (if that's even a motivation) for them is not worth it. And the courts are making the downside "indefinite prison", which isn't much of a downside for the prosecutor. I think you can expect this to be used far more broadly if this is allowed. If I were a prosecutor I'd probably abuse the power too as yet another lever to use to get my way.
  - FussyZeus 10y ago
    Then charge him for it. This is such an insane precedent to set, I cannot believe anyone is OK with this like we don't have a long and proud history of railroading people we disagree with for any number of stupid reasons.
- 2_listerine_pls 10y ago
  just Hardcode it into the dna of your gut flora using CRISPR. If they ask for you password, give them a sample.
- salesguy222 10y ago
  Reading this story actually makes me ill. When a technical defense protects you from the state, they jail you for contempt. When you say, "but we have a constitutional amendment that protects us from self-incrimination", they say "sure but that doesn't apply here." And of course it is child porn that is in question. It is a mere crime to "possess" it, that is to say, possess a hard drive on which images are found. It goes without saying that images, at any point in time before, after, or during an investigation, can appear against your will on your hard drive. But since it is so morally outrageous, it is the go to charge that prosecutors use to jail their personal and political enemies. Or just soft targets, I guess...
  - kelnos 10y ago
    If that's all they had, I'd probably agree with you. But that's not. They have: * Backup logs that show hashes of files that match that of known child porn image files. * Testimony from the guy's sister that she has seen him decrypting the drives, and that he showed her child porn from the drives. So yes, what you're saying is true, but in this case, I'm (reluctantly) on the side of the authorities.
    - mickronome 10y ago
      Which should be plenty to convict on if the evidence and testimony is reliable, shouldn't it ?
    - salesguy222 10y ago
      I can see where you are coming from, and I really want to avoid commenting on if he is truly a pedo. I agree with the poster below you that they should charge him if they do have that evidence. But if they are holding him in contempt while waiting to force decrypt so that legal precedent can be set, or if they're holding him so that this way he is in jail without getting credit for time served on his potential cp charges, then this is all a pretty hefty abuse of due process and etc. We really need to defend even the worst people's right to a decent correctional experience. Why? Because if you are ever wrongfully imprisoned, you would want the same. And it really does happen!
    - 10y ago
- praneshp 10y ago
  Nit: He is pleading the fifth, not claiming he forgot his password, no? I agree with the sentiment that this possibly sets a bad precedent.
- nabla9 10y ago
  It would be interesting to know why he has not used this excuse. Imagine having encrypted disk format where fast delete happens by writing over the main key in the volume header with random data and not all zero or some other magic value. You could have lots of deleted disks and memory sticks and go to jail because you can't decrypt them when asked.
  - danso 10y ago
    It's possible that the suspect wasn't thinking things through when he was hit with the search warrant. It says that he gave them his iPhone 5S password but not his Mac password, or the passwords for the hard drives. They apparently were able to get into the Mac (maybe the password was the same as his iPhone?) but not his hard drives. He is said to have "refused" to give those passwords. I suppose he gave up the ability to maintain a consistent defense when he said "No, I don't have/want to" instead of "I forgot". https://arstechnica.com/wp-content/uploads/2017/03/rawlsopinion.pdf https://arstechnica.com/wp-content/uploads/2017/03/rawlsopin... I'm confused by this statement in the above ruling: The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash” values to be child pornography. The files, however, were not on the Mac Pro, but instead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed. So forensic analysis of the Mac revealed that he downloaded known porn files (identifiable by the database of hashes that law enforcement uses)...but don't you need access to the actual file to be able to calculate its hash? If the files were moved to, or downloaded right to the encrypted drives, how could forensic analysis reveal the files' hash values?
    - skoob 10y ago
      I'm assuming the files were downloaded using Bittorrent or some other file sharing service, and the hashes of the downloaded files were logged on his Mac.
      - danso 10y ago
        Ah, that makes perfect sense. Since they could log into his Mac, looking at the Bittorrent metadata would be trivial (apparently he didn't clear history, or at least do so securely), and some clients would indicate not only the downloaded file, but where it was saved to locally.
- danso 10y ago
  That would be an interesting case but that's not what seems to be argued here. The state is arguing that they have enough evidence that "the presence of child porn on his drives was a 'foregone conclusion.'". It's likely the defendant didn't use forgetting-the-password as a defense because it was obvious via IP traffic and witness testimony that he had regularly and recently used his computer. The ruling here seems focused on the point of whether the knowledge/use of a password constitutes self-incrimination, which people have a Constitutional right not to engage in. IANAL, but it seems akin to arguing that you have a Fifth Amendment right not to give up a DNA sample. edit: Looks like I'm wrong, defendant did use forgetfulness as a defense at one point, though that was ultimately not his only reasoning for appeal. Look at page 7 of the document here: https://arstechnica.com/wp-content/uploads/2017/03/rawlsopinion.pdf https://arstechnica.com/wp-content/uploads/2017/03/rawlsopin... Approximately one week after the Quashal Denial, Doe and his counsel appeared at the Delaware County Police Department for the forensic examination of his devices. Doe produced the Apple iPhone 6 Plus, including the files on the secret application, in a fully unencrypted state by entering three separate passwords on the device. The phone contained adult pornography, a video of Doe’s four-year-old niece in which she was wearing only her underwear, and approximately twenty photographs which focused on the genitals of Doe’s six-year-old niece. Doe, however, stated that he could not remember the passwords necessary to decrypt the hard drives and entered several incorrect passwords during the forensic examination. The Government remains unable to view the decrypted content of the hard drives without his assistance. However, in the next paragraph, the document refers to a ruling in which the court found that there was enough evidence to show that the suspect "remembered the passwords needed to decrypt the hard drives but chose not to reveal them because of the devices' contents". I imagine the details of that evidence was in the Oct 5., 2015 hearing in which the suspect "neither testified nor called witnesses. He offered no physical or documentary evidence into the record and provided no explanation for his failure to comply with the Decryption order".
  - smsm42 10y ago
    If it's a foregone conclusion, why don't they charge him under CP laws and be done with it? Looks like it's either not as foregone as they try to present it, or they try to use it to establish a precedent (or probably both) and latch on this case because of the defendant being so unsympathetic.
- mirimir 10y ago
  If they "know" that you have something illegal, yes.
- b3lvedere 10y ago
  Yes. But that's not all. Depending on the country, your origin, your job, your beliefs, your principles, your preferences or whatever, a government could jail you just for being you. Forever.
alphabettsy 10y ago
Almost like they chose this particular topic to set a precedent...
- mjolk 10y ago
  Or, this is a case in which a defendant had a non-foreign-government reason to accept whatever consequences come from not cooperating (thus not having political machinations at work) and it's a case with real human harm that makes it worth pursuing for the prosecutor.
tpolm 10y ago
and this is why the software you use to encrypt hard drives should support plausible deniability. You give away the (other) password and the decrypted drive contains nothing but cat pictures.
- gonzo 10y ago
  On the third failed try, it should re-encrypt the drive with a random key.
  - mod 10y ago
    Will it also re-encrypt the backup image the LEO made?
    - tedunangst 10y ago
      Quantum crypto. Spooky encryption at a distance.
- silveira 10y ago
  This. This is actually a good solution. Not cat pictures though, it would need to be something at least shameful, maybe even lightly criminal. This would work as an alibi for why you are encrypting the drive.
  - SolarNet 10y ago
    Or deeply personal like a journal.
- repples 10y ago
  Or, you know, just be a decent person and don't download huge swathes of child pornography. To be honest, it's quite disgusting that you're most concerned with how to hide such horrendous material.
  - mickronome 10y ago
smsm42 10y ago
This reads as extremely bizarre. I mean, reading the fifth amendment makes it pretty clear - no one should be compelled to witness against oneself. However, it looks like the current executive and judicial are thinking "well, those Founders were just idiots for putting such an amendment in, clearly it'd be much easier to prosecute people if we could compel them to witness against themselves, so why don't we just ignore it and put people in jail indefinitely until they agree to witness against themselves?". Terrifying that it is so easy for them to completely ignore all constitutional protections.
- bobbington 10y ago
  The supreme court is unelected, and are the supreme authority in this nation, above president and congress. the solution is simple - make the supreme court stand up to elections. America has had atrocious decisions from the supreme court. In Dred Scott, they said black people have no rights because they are black. In Roe v Wade, the abortion laws of 47 states were struck down by 5 oligarchs. No matter what you believe about black people or abortion, it isn't right that 5 unelected people should determine the fate of a nation, able to overrule every state and federal law with no consequences.
  - hackuser 10y ago
    I don't see U.S. (or any) elected officials, including Congress and the White House, making better decisions. All have made atrocious decisions. The argument in the parent is well-worn, but it fails serious consideration if it ignores the facts that the U.S. courts interpret laws made by the elected officials, that the judges are appointed by elected officials, that their unelected status is established by elected officials and a national referendum (i.e., the votes that established the Constitution), and the reasons for their unelected status.
    - bobbington 10y ago
      Power corrupts. Unelected officials in office for life are at particular risk. i still think the people should be supreme. Right now, there is no legal way for the people to fight an outrageous decision. They can't elect somebody new in 4 years. Thomas Jefferson was adamantly opposed to said judiciary, because it made the constitution a "thing of wax" The whole reason behind federalism was that states would have different ideas of what is good and should implement that. that way you could get away from states with bad laws. Today the Supreme Court and other judges completely ignores the constitution. If they say the sky is green, nobody can correct them save Death itself.
finkin1 10y ago
Is there a charitable interpretation of this that I'm not seeing? Or is this truly as terrifying as it appears?
- mirimir 10y ago
  Nope. If this becomes widespread precedent, encryption is no longer viable in the US.
  - Pitarou 10y ago
    I think we’re about to see an increase in interest in deniable encryption. A simple solution is to have your encryption software automatically add a large garbage file inside every encrypted volume. When you have something to hide, replace the garbage file with your new encrypted data. This lets you nest your encryption to arbitrary depth, allowing plenty of room for plausible deniability. E.g. you could put your financial records at the first level, pictures from an erotic crossdressing forum at the second level, and the stuff you’re ACTUALLY hiding at the third level.
    - mirimir 10y ago
      That's an interesting idea. But it arguably wouldn't have helped Mr. Rawls. Investigators claimed to know what they sought, so they'd still argue that he was holding out. Maybe it's safer to keep encrypted stuff anonymously in cloud storage. Mr. Rawls could have run his Freenet node on an anonymously-leased VPS, used Tor onion services for the various WebGUIs, and accessed it all via Tails. There would have been nothing local to go after.
      - Pitarou 10y ago
        Rawls’ is an odd case. If the reports are accurate, he seems to have believed that a strong password on his hard drive gave him legal immunity, and didn’t really try to conceal what he was doing. Nonetheless, a line has been crossed, and cyber-libertarians have been predicting this breach for as long as I can remember. There’s nothing cyber-libertarians love more than a technical solution to state oppression.
fencepost 10y ago
This is an interesting contrast to the article reported this past week about Nigel Lang, a black man in the UK who was accused of having or sharing child porn because of an extra digit added to an IP address during investigations[1]. One relevant section from the apology/explanation letter: "The issues around the downloading of IIOC [indecent images of children] are that statistically out of a cohort of offenders, the predominant characteristic is that the offence will be committed in the main by white males. Only a very small percentage will be black, around 3%, and only around 2% will be female. Consequently, any arrests that are made for this offence will revolve around the male in the address as the starting point for the investigation." Notably Rawls (the man indefinitely jailed) is black. [1] https://www.buzzfeed.com/matthewchampion/this-mans-life-was-destroyed-by-a-police-typo?utm_term=.sq1RxMpPw#.dly024JKV https://www.buzzfeed.com/matthewchampion/this-mans-life-was-...
- fjdlwlv 10y ago
  It's nice to see white folks be the victims of racial profiling once in a while.
  - Karlozkiller 10y ago
    Is racial profiling ever truly nice to see?
- bsder 10y ago
  > The issues around the downloading of IIOC [indecent images of children] are that statistically out of a cohort of offenders, the predominant characteristic is that the offence will be committed in the main by white males. Only a very small percentage will be black, around 3%, and only around 2% will be female. That's quite a remarkable statistic. I wonder why.
  - c3534l 10y ago
    Fewer black people for one.
    - 10y ago
ahelwer 10y ago
Here's a recording of the oral arguments for the US Court of Appeals, Third Circuit back in September: http://www2.ca3.uscourts.gov/oralargument/audio/15-3537USAv.AppleMacProComputer.mp3 http://www2.ca3.uscourts.gov/oralargument/audio/15-3537USAv.... The gov's argument seems to be that because the defendant doesn't have to give the government the password but rather produce the decrypted hard drives, his actions aren't protected under the fifth. Analogy drawn with unlocking a safe. EFF counter-argument to the safe analogy is that the encrypted documents do not simultaneously exist in a decrypted form protected by an obstacle, like a safe, but rather are produced as an act of translating the data from decrypted to unencrypted form; the government already has the data on the drives, they just can't understand it without the contents of the defendant's mind. Justices then press the gov lawyer on whether there are fourth amendment issues in the case, as in whether the government can search all files on the hard drive, if decrypted, for evidence of criminality beyond the specific files they seek. Gov lawyer punts on the issue. Basically it seems like a steep hill for proponents of encryption. The justices talk about how we're heading for a world where almost everything is encrypted, and encryption proponents are asking the government to give up an enormous amount of power.
- zer0t3ch 10y ago
  Can you be compelled to provide something that you don't have access to? Were anyone else in this situation, wouldn't it be plausible to simply claim you don't know that password?
  - null0pointer 10y ago
    I've wondered about scenarios where you can legitimately claim to not know the password to decrypt a drive. A few different cases I can think of which may be ruled differently by a court. 1) I use a password manager so I don't know the password. However, I have the means to acquire the password. 2) I use a password manager but somehow lost access to it unintentionally. 3) I use a password manager and lost access to it by design. (eg. Using a dead man's switch of some kind that deletes it if I don't "check in" for some period of time) 4) I used to know the password. However, I suffered a traumatic brain injury and cannot recall it. I obviously don't have the answers but I think these are interesting to think about as different points in a large legal grey area.
NightMKoder 10y ago
This case is interesting. If I'm reading https://en.m.wikipedia.org/wiki/United_States_v._Hubbell https://en.m.wikipedia.org/wiki/United_States_v._Hubbell correctly, the fifth amendment only applies if "they don't know what they're looking for." In this case, because there is (enough) evidence of CP on his computer, they are subpoenaing him to produce the unencrypted drives. In some sense, they're not asking for a password - they're asking for the drive contents, which they know to at least partially be illegal. IANAL though. Assuming that interpretation of the 5th is correct, subpoenas can easily be used to access encrypted information. I just hope the judges that decide when to grant subpoenas know where that line is.
- ethbro 10y ago
  It is amazing that anything produced would be admissible. I don't see how this is different than having circumstantial evidence that someone is a murderer, so ordering them to lead you to where they buried the body.
  - NightMKoder 10y ago
    I think they key is that the evidence is beyond circumstantial - they have concrete evidence that he uploaded files that were CP from that computer. It's a bit worrying why that isn't circumstantial (hacked computers aren't a thing?), but maybe the standard for issuing a subpoena is lower than guilt but higher than circumstantial. Sounds like the only right answer for your password is "I do not recall"
    - RUG3Y 10y ago
      This might be a stupid thought but if they already have enough concrete evidence against the suspect, why do they require the contents of the drive?
      - NightMKoder 10y ago
        My bet would be to up the sentence. Go from 2 counts of CP to 200 - 5 years in jail to life sentence.
Overtonwindow 10y ago
This raises an interesting idea: why not create two passwords for encrypted drives, one password decrypt the drive, another password completely wipes the drive. This way if someone is forced to give a password to decrypt something, that password renders the data moot. Thoughts?
- striking 10y ago
  Here's mine: destruction of evidence is a crime. Probably not the best idea. Hiding the partition or otherwise making the encrypted data hidden is probably your only bet.
  - Overtonwindow 10y ago
    Which would you rather go down for: destruction of evidence, or what's in your hard drive? I'm asking a technical question, not a legal one. There are many instances where this would be preferable than giving up the data.
    - striking 10y ago
      If someone released such a tool, the feds would make sure to clone your hard drive before supplying the password to it, or write a patched version of the tool that reads it to remove the disk wiping call. And then you'd be in really hot water.
      - MaulingMonkey 10y ago
        An interesting talk on disk antiforensics: https://www.youtube.com/watch?v=qZtkANvDxZA https://www.youtube.com/watch?v=qZtkANvDxZA Of course, having watched this, the feds might look for such tricks...
      - naasking 10y ago
        I expect cloning to already be standard forensic procedure, but perhaps I'm wrong. If not, it should be.
goodplay 10y ago
Sitting directly in front of me are two moderately large encrypted hard drives the passwords for which I forgot. If I get a subpoena to produce their contents, I will potentially remain in jail of the rest of my life for the crime of being forgetful. That judge's behavior and (the laws that enables it) is sickening. You either have enough evidence to convict a person, or you don't.
- M_Grey 10y ago
  More and more I'm convinced that the only solution is data destruction on a fail-deadly system. Like a warrant canary, if it's your default operation, you should be alright. As I always add though, don't keep your family photos on that drive.
  - walrus 10y ago
    I don't understand what a fail-deadly drive would look like. Can you give an example?
    - stagbeetle 10y ago
      I'd imagine you'd have to do a task (like inputting a passcode) every so often or the drive would be made inoperable. For SSD's it'd be as simple as an automatic single pass overwrite and a new encryption key. For HDD, the hyper-paranoid could rig their drives with small explosives to fracture the platters.
      - M_Grey 10y ago
        ^This. In fact you can buy readymade solutions now which physically destroy the NAND gates on the input of a code, or as you say, if you fail to input a code within a time limit.
    - M_Grey 10y ago
      An example I've given here before is: http://securedrives.co.uk/ http://securedrives.co.uk/ There are other solutions though, and of course you can make your own if you feel confident about it.
cnnjhvyhvc 10y ago
This reminds me that I need to wipe the drive I was using to test Bitlocker, as I typed in a random password and have long since forgotten it. I can only imagine the Kafkaesque horror of being imprisoned until I decrypt it, spending decades trying to brute force it.
hackuser 10y ago
Some discussion overlooks that this is a special case: ... the appeals court, like the police, agreed that the presence of child porn on his drives was a "foregone conclusion." The Fifth Amendment, at its most basic level, protects suspects from being forced to disclose incriminating evidence. In this instance, however, the authorities said they already know there's child porn on the drives, so Rawls' constitutional rights aren't compromised. The Philadelphia-based appeals court ruled: Forensic examination also disclosed that Doe [Rawls] had downloaded thousands of files known by their "hash" values to be child pornography. The files, however, were not on the Mac Pro, but instead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed. The court also noted that the authorities "found [on the Mac Book Pro] one image depicting a pubescent girl in a sexually suggestive position and logs that suggested the user had visited groups with titles common in child exploitation." They also said the man's sister had "reported" that her brother showed him hundreds of pictures and videos of child pornography. All of this, according to the appeals court, meant that the lower court lawfully ordered Rawls to unlock the drives.
- dongslol 10y ago
  The critical question is, why haven't they charged him? It is disingenuous of them to bring up the evidence they currently have essentially in an attempt to demonize him. Their evidence is sufficient or it isn't; if it is they should charge him; if not they're demanding self-incrimination.
  - rayiner 10y ago
    You need to distinguish between requiring the defendant to turn over incriminating evidence (which the 5th amendment does not protect), and requiring the defendant to make incriminating statements (i.e. to provide incriminating testimony). Sometimes, the act of producing evidence in response to a government request involves the defendant making implicit incriminating assertions. If the government says "produce all your cooked accounting books," handing over those documents implicitly communicates the assertions that (1) certain books exist; (2) those books are doctored; and (3) you have ownership/control over them. However, say the government asks you for your bank records. When you hand them over, you're implicitly saying "I have bank records," and "these are my bank records." That's not incriminating -- even if the bank records themselves might contain incriminating evidence. The "foregone conclusion rule," says that the act of production is non-testimonial when the incriminating facts are already known.[1] If the existence of doctored books is already known by other means, the act of producing them doesn't communicate anything to the authorities. The books themselves are obviously communicated, but the 5th amendment does not protect the underlying evidence. It protects the implied statements by the defendant about the underlying evidence. Hence the threading the needle in the opinion. They're not asking the guy to make incriminating statements about the existence of incriminating evidence. They're asking him to turn over the incriminating evidence they already know exists. [1] Note that the Court is not saying "we already know he's guilty so the 5th amendment doesn't apply."
deleted 10y ago
[deleted]
1024core 10y ago
Can you refuse a search warrant? My understanding (albeit limited) is that you can't, if it's been signed by the proper legal authority. Is refusing to unlock the HDD the same as refusing to unlock a room, when presented with a lawful warrant? I would think so.
oh_sigh 10y ago
What happens if this guy just claims that he forgets the password and sticks to his story? Will he be effectively imprisoned for life, whether true or not?
- jlebrech 10y ago
  if they imprisoned him in a way which is later seen as unlawful he can get a huge payout. why not just stick to your guns and get $1m+ for sleeping in bed and doing a few push up.
theonemind 10y ago
Quite a minefield of legal issues. Indefinite detention pretty much seems like an abuse of the court's power to find people in contempt. He should get charged with a real crime like obstructing justice and serve a sentence for it, if they have the evidence for that, but this is absurd.
azinman2 10y ago
If they already know it's on there, then isn't that enough to build the case and just try him as is?
Steeeve 10y ago
It goes to show that regardless of what protection encryption theoretically provides, security is only as good as the weakest link in the chain. Torture in some fashion is _always_ an option to force decryption. The same goes for constitutional protections. The more time goes on, the more constitutional protections will be attacked and minimized. The fact that a child pornography case is being used to break encryption via the courts should come as no surprise. Emotion is being used to broaden the power of the courts.
ryan_j_naughton 10y ago
Thought experiment: What if there were an encryption system whereby if a user inputs one decryption key, the encrypted data decrypts to one set of values and if the user uses a second key, it decrypts to a second set of values. Sure, in order to encode both sets of data into a single encrypted result would require more storage space, but that is a small price to pay for protection against self incrimination from our ever growing police and surveillance state. The end of the article captures why this idea would be so effective, viz. "The authorities, however, said no testimony was needed from Rawls. Rather, they said, 'he can keep his passwords to himself' and 'produce his computer and hard drives in an unencrypted state.'" It is absolutely true and valid that the government has the right to compel people to hand over evidence that they are KNOWN to possess (in the same way that legal discovery is essential to civil cases). The line the government is drawing between self-incrimination and forced cooperation in an investigation is they they don't want him to tell them the password or what is on the drives -- they simply want him to hand over the drives in an intelligible state. Thus, if one could decrypt the drives to an intelligible set of data but not the data they desire, then you would be complying with the court order and could not be held in contempt. Can someone on HN who knows more about cryptography help poke holes in my idea?
- mifreewil 10y ago
  This is possible, at least in some contexts. I'm no expert, but the bitcoin wallet, Trezor, has implemented this - known as "plausible deniability". The idea is if you are compelled somehow by force to unlock your bitcoin wallet, you can use a secondary password that assumingly has less bitcoin than your regular bitcoin wallet. https://news.bitcoin.com/bitcoin-wallet-plausible-deniability/ https://news.bitcoin.com/bitcoin-wallet-plausible-deniabilit...
- tedunangst 10y ago
  They also have a set of hashes of files they expect to find. If they don't find those files, they'll probably ask more questions.
  - kbart 10y ago
    How can they be sure that files weren't deleted?
hollander 10y ago
Is this another case of "encryption works"?!
69mlgsniperdad 10y ago
What would happen if he lobotomized(carefully and mildly) himself, and legitimately could not remember his encryption keys/pw nor the reason he performed lobotomy?
- jacobush 10y ago
  Or very carefully shot himself in the heart?
  - pc86 10y ago
    Surely this layman knows enough about the brain to know how to lobotomize himself such that he forgets his passwords, but not such that he forgets how to perform a self-lobotomy!
    - jacquesm 10y ago
      That's easy, just snip the blue neurons. Or was it the red ones? No, definitely blue. (Snips red neuron.)
    - 69mlgsniperdad 10y ago
      I can attest that it indeed quite simple. Have done a nearly a dozen on myself, no evident issues whatsoever.
      - dang 10y ago
        We've banned this account for posting unsubstantive comments and ignoring our request to stop.
        Sciencehaters 10y ago
        Can you stop doing everything you can to make people hate science. Stop being elitist maybe?
        Dangisbiased 10y ago
jlebrech 10y ago
what if there was a password to decrypt the drive into rick astley on a loop?
employee8000 10y ago
After 18 months in jail, can't the accused legitimately say that he forgot his password? I don't know if I would remember a relatively complex password if I were stuck in s jail cell for 18 months with no computer or ability to type it in every few days.
moonshinefe 10y ago
If they've got the evidence, legitimately charge him then? If it's sufficient, let a jury of his peers convict him then. How is this any more complicated than that, no matter how you frame it? We have laws as a check and balance system for a reason, apparently the US courts are slowly forgetting it or something...
pyabo 10y ago
They are doing the same inquisidores did, they are torturing someone to confess (in this case decrypt)
emanreus 10y ago
The scary part is that someone can be jailed indefinitely. I had no idea that was legally possible.[1] But it's CP so it's an easy sell. [1] https://en.wikipedia.org/wiki/Indefinite_imprisonment https://en.wikipedia.org/wiki/Indefinite_imprisonment
Radle 10y ago
"The fact remains that the government has not brought charges," Donoghue said in a telephone interview. "Our client has now been in custody for almost 18 months based on his assertion of his Fifth Amendment right against compelled self-incrimination." This should be simple, either they have enough to charge him or not.
Zuescho 10y ago
Okay now, what if my password is the hash of a CP Picture, then there would be no way for me to offer that password without committing a crime in the first place. So in that case you would be safe. Or when the password would be some file that could incriminate me
tombert 10y ago
It seems like the law is kind of ambiguous on this (https://en.wikipedia.org/wiki/TrueCrypt#United_States_v._John_Doe https://en.wikipedia.org/wiki/TrueCrypt#United_States_v._Joh...), unless my interpretation is completely flawed. I wonder if this will have to go to the Supreme Court at some point.
- vilhelm_s 10y ago
  In this case, the 3rd circuit applied the same standard as the 11th (the government can compel decryption if they know what is on the drive), so it doesn't yet create a circuit split. However, they don't decide that that is the right standard. In a footnote they suggest that the correct standard would be more lax (the government can compel decryption if they know the person knows the password). So if a case comes up where they rule that way, it would create a circuit split and lead the supreme court to take the case. Orin Kerr writes a column about it here: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/03/20/third-circuit-doesnt-resolve-standard-for-forced-decryption-under-the-fifth-amendment/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...
bawana 10y ago
Although most of the comments here have to do with legality, I am more concerned with the technical aspect. The prosecutors say they know that he has porn because the hash values they obtained are identical to the hash values of porn images. Are hash collisions not a consideration? Can hash values be as incriminating as direct evidence? Is it possible to take a hash of a benign image (kitten?) and encrypt it with an algorithm that gives a result which is identical to an unencrypted hash value of a pornographic image?
- DanBC 10y ago
  > Are hash collisions not a consideration? His defence team would be hopelessly incompetent if they didn't mention that if it was a realistic possibility.
- xeonoex 10y ago
  I'm wondering how they obtained the hashes. You can't hash images on an encrypted drive. How are they able to obtain a hash of an image without actually having the image? Were the hash values from what he has downloaded stored somewhere?
pnutjam 10y ago
The sad part is he has provided the password, but it's "fuckoffI'llnevertell"
noahbullock 10y ago
It's my understanding that, while one is obligated to comply with a warrant granting police access to places or materials in one's control, one cannot be compelled to aid them in their search or understanding. In other words, if presented with a warrant, a person would be required to grant access to a home or to hand over an accounting ledger, but the Fifth Amendment protects against being compelled to tell police where in the home drugs are hidden or which line items in the ledger contain embezzlement. A warrant grants the police the right to search, but not the right to find. With that in mind, here's a thought exercise: Let's say that I'm caught on camera signing a document with a man who later kills my business partner. The camera then records me going into my warehouse with the document and emerging later without it. The police, believing that I arranged the murder and that the proof is in the document, duly obtain a warrant to search the warehouse. The warehouse is large and when the police enter, they find it is stacked floor to ceiling with sheets of paper, all indistinguishable except for their contents. They estimate the number of pages to be in the billions -- far too many for them to feasibly comb through. If I understand the right against self incrimination correctly, I can't be forced to tell the police where I hid the specific piece of paper they're looking for. Why is this different from finding a password? Assume we use a 43 character password (since the encryption key is AES 256, a password longer than 43 characters wouldn't add additional security). If this is the case, approximately 1.01e86 - 1 passwords effectively yield a garbage document, and 1 password produces the document the police are looking for. If one can't be compelled to help the police find the solution in a physical search space, why can one be compelled to help find one in a digital search space?

319 points by davesailer 10y ago

I'm surprised he hasn't argued there's evidence of a different crime on the disk(s), as a reason why he is refusing under the Fifth. Edit: Thanks for the downvotes :)

pmyteh 10y ago
They'd offer him immunity on the "different crime", then he'd have no defence.
- ChoGGi 10y ago
  That would work? Not a lawyer or American so (Thanks for the upvotes, and pmyteh for replying)

mgamache 10y ago

So if I forget my password, I can be in jail forever?

solipsism 10y ago
Assuming it's shown to be a foregone conclusion you have child porn on your machine, yes.
- grawlinson 10y ago
  Then why hasn't this person been prosecuted yet? Are they just wanting him to give up his credentials so that they can refer to this case as a precedent?
  - ryandrake 10y ago
    They clearly don't need to prosecute him now, since it looks like he can be jailed indefinitely and everyone's cool with it. Scary stuff.
  - cheez 10y ago
    Same. I can't understand why, if it's a foregone conclusion, the other stuff can't be used to convict him.
  - petee 10y ago
    A possibility is that if they prosecute based on what they have now, then he will _never_ decrypt it - they may be aiming to break up a porn-ring or the actual producers, and he may have very valuable data on the drive, that may potentially save lives
    - neltnerb 10y ago
      If this were the case, they would provide him immunity in exchange for cooperation in prosecuting up the "food chain" like they do with mobsters.
      - mjolk 10y ago
        I think this is just a thing that happens in the movies. Also, check out the source document and let me know if you think someone found guilty of the described acts deserves immunity.
        fjdlwlv 10y ago
        What? It happens all the time on regular cirminal cases. Movies didn't invent "informants". Immunity can mean being convicted for lesser offenses, or negotiating a less than maximal punishment.
        neltnerb 10y ago
        It's not really a matter of my opinion on the specific case. Even with the full documents, there is no way that I'd have enough information to judge fairly, so I wouldn't try to. I'm just saying that they have a way out, and it seems that they've made the judgment that the potential of finding other criminals (if that's even a motivation) for them is not worth it. And the courts are making the downside "indefinite prison", which isn't much of a downside for the prosecutor. I think you can expect this to be used far more broadly if this is allowed. If I were a prosecutor I'd probably abuse the power too as yet another lever to use to get my way.
- FussyZeus 10y ago
  Then charge him for it. This is such an insane precedent to set, I cannot believe anyone is OK with this like we don't have a long and proud history of railroading people we disagree with for any number of stupid reasons.
2_listerine_pls 10y ago
just Hardcode it into the dna of your gut flora using CRISPR. If they ask for you password, give them a sample.
salesguy222 10y ago
Reading this story actually makes me ill. When a technical defense protects you from the state, they jail you for contempt. When you say, "but we have a constitutional amendment that protects us from self-incrimination", they say "sure but that doesn't apply here." And of course it is child porn that is in question. It is a mere crime to "possess" it, that is to say, possess a hard drive on which images are found. It goes without saying that images, at any point in time before, after, or during an investigation, can appear against your will on your hard drive. But since it is so morally outrageous, it is the go to charge that prosecutors use to jail their personal and political enemies. Or just soft targets, I guess...
- kelnos 10y ago
  If that's all they had, I'd probably agree with you. But that's not. They have: * Backup logs that show hashes of files that match that of known child porn image files. * Testimony from the guy's sister that she has seen him decrypting the drives, and that he showed her child porn from the drives. So yes, what you're saying is true, but in this case, I'm (reluctantly) on the side of the authorities.
  - mickronome 10y ago
    Which should be plenty to convict on if the evidence and testimony is reliable, shouldn't it ?
  - salesguy222 10y ago
    I can see where you are coming from, and I really want to avoid commenting on if he is truly a pedo. I agree with the poster below you that they should charge him if they do have that evidence. But if they are holding him in contempt while waiting to force decrypt so that legal precedent can be set, or if they're holding him so that this way he is in jail without getting credit for time served on his potential cp charges, then this is all a pretty hefty abuse of due process and etc. We really need to defend even the worst people's right to a decent correctional experience. Why? Because if you are ever wrongfully imprisoned, you would want the same. And it really does happen!
  - 10y ago
praneshp 10y ago
Nit: He is pleading the fifth, not claiming he forgot his password, no? I agree with the sentiment that this possibly sets a bad precedent.
nabla9 10y ago
It would be interesting to know why he has not used this excuse. Imagine having encrypted disk format where fast delete happens by writing over the main key in the volume header with random data and not all zero or some other magic value. You could have lots of deleted disks and memory sticks and go to jail because you can't decrypt them when asked.
- danso 10y ago
  It's possible that the suspect wasn't thinking things through when he was hit with the search warrant. It says that he gave them his iPhone 5S password but not his Mac password, or the passwords for the hard drives. They apparently were able to get into the Mac (maybe the password was the same as his iPhone?) but not his hard drives. He is said to have "refused" to give those passwords. I suppose he gave up the ability to maintain a consistent defense when he said "No, I don't have/want to" instead of "I forgot". https://arstechnica.com/wp-content/uploads/2017/03/rawlsopinion.pdf https://arstechnica.com/wp-content/uploads/2017/03/rawlsopin... I'm confused by this statement in the above ruling: The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash” values to be child pornography. The files, however, were not on the Mac Pro, but instead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed. So forensic analysis of the Mac revealed that he downloaded known porn files (identifiable by the database of hashes that law enforcement uses)...but don't you need access to the actual file to be able to calculate its hash? If the files were moved to, or downloaded right to the encrypted drives, how could forensic analysis reveal the files' hash values?
  - skoob 10y ago
    I'm assuming the files were downloaded using Bittorrent or some other file sharing service, and the hashes of the downloaded files were logged on his Mac.
    - danso 10y ago
      Ah, that makes perfect sense. Since they could log into his Mac, looking at the Bittorrent metadata would be trivial (apparently he didn't clear history, or at least do so securely), and some clients would indicate not only the downloaded file, but where it was saved to locally.
danso 10y ago
That would be an interesting case but that's not what seems to be argued here. The state is arguing that they have enough evidence that "the presence of child porn on his drives was a 'foregone conclusion.'". It's likely the defendant didn't use forgetting-the-password as a defense because it was obvious via IP traffic and witness testimony that he had regularly and recently used his computer. The ruling here seems focused on the point of whether the knowledge/use of a password constitutes self-incrimination, which people have a Constitutional right not to engage in. IANAL, but it seems akin to arguing that you have a Fifth Amendment right not to give up a DNA sample. edit: Looks like I'm wrong, defendant did use forgetfulness as a defense at one point, though that was ultimately not his only reasoning for appeal. Look at page 7 of the document here: https://arstechnica.com/wp-content/uploads/2017/03/rawlsopinion.pdf https://arstechnica.com/wp-content/uploads/2017/03/rawlsopin... Approximately one week after the Quashal Denial, Doe and his counsel appeared at the Delaware County Police Department for the forensic examination of his devices. Doe produced the Apple iPhone 6 Plus, including the files on the secret application, in a fully unencrypted state by entering three separate passwords on the device. The phone contained adult pornography, a video of Doe’s four-year-old niece in which she was wearing only her underwear, and approximately twenty photographs which focused on the genitals of Doe’s six-year-old niece. Doe, however, stated that he could not remember the passwords necessary to decrypt the hard drives and entered several incorrect passwords during the forensic examination. The Government remains unable to view the decrypted content of the hard drives without his assistance. However, in the next paragraph, the document refers to a ruling in which the court found that there was enough evidence to show that the suspect "remembered the passwords needed to decrypt the hard drives but chose not to reveal them because of the devices' contents". I imagine the details of that evidence was in the Oct 5., 2015 hearing in which the suspect "neither testified nor called witnesses. He offered no physical or documentary evidence into the record and provided no explanation for his failure to comply with the Decryption order".
- smsm42 10y ago
  If it's a foregone conclusion, why don't they charge him under CP laws and be done with it? Looks like it's either not as foregone as they try to present it, or they try to use it to establish a precedent (or probably both) and latch on this case because of the defendant being so unsympathetic.
mirimir 10y ago
If they "know" that you have something illegal, yes.
b3lvedere 10y ago
Yes. But that's not all. Depending on the country, your origin, your job, your beliefs, your principles, your preferences or whatever, a government could jail you just for being you. Forever.

alphabettsy 10y ago

Almost like they chose this particular topic to set a precedent...

mjolk 10y ago
Or, this is a case in which a defendant had a non-foreign-government reason to accept whatever consequences come from not cooperating (thus not having political machinations at work) and it's a case with real human harm that makes it worth pursuing for the prosecutor.

tpolm 10y ago

and this is why the software you use to encrypt hard drives should support plausible deniability. You give away the (other) password and the decrypted drive contains nothing but cat pictures.

gonzo 10y ago
On the third failed try, it should re-encrypt the drive with a random key.
- mod 10y ago
  Will it also re-encrypt the backup image the LEO made?
  - tedunangst 10y ago
    Quantum crypto. Spooky encryption at a distance.
silveira 10y ago
This. This is actually a good solution. Not cat pictures though, it would need to be something at least shameful, maybe even lightly criminal. This would work as an alibi for why you are encrypting the drive.
- SolarNet 10y ago
  Or deeply personal like a journal.
repples 10y ago
Or, you know, just be a decent person and don't download huge swathes of child pornography. To be honest, it's quite disgusting that you're most concerned with how to hide such horrendous material.
- mickronome 10y ago

smsm42 10y ago

This reads as extremely bizarre. I mean, reading the fifth amendment makes it pretty clear - no one should be compelled to witness against oneself. However, it looks like the current executive and judicial are thinking "well, those Founders were just idiots for putting such an amendment in, clearly it'd be much easier to prosecute people if we could compel them to witness against themselves, so why don't we just ignore it and put people in jail indefinitely until they agree to witness against themselves?". Terrifying that it is so easy for them to completely ignore all constitutional protections.

bobbington 10y ago
The supreme court is unelected, and are the supreme authority in this nation, above president and congress. the solution is simple - make the supreme court stand up to elections. America has had atrocious decisions from the supreme court. In Dred Scott, they said black people have no rights because they are black. In Roe v Wade, the abortion laws of 47 states were struck down by 5 oligarchs. No matter what you believe about black people or abortion, it isn't right that 5 unelected people should determine the fate of a nation, able to overrule every state and federal law with no consequences.
- hackuser 10y ago
  I don't see U.S. (or any) elected officials, including Congress and the White House, making better decisions. All have made atrocious decisions. The argument in the parent is well-worn, but it fails serious consideration if it ignores the facts that the U.S. courts interpret laws made by the elected officials, that the judges are appointed by elected officials, that their unelected status is established by elected officials and a national referendum (i.e., the votes that established the Constitution), and the reasons for their unelected status.
  - bobbington 10y ago
    Power corrupts. Unelected officials in office for life are at particular risk. i still think the people should be supreme. Right now, there is no legal way for the people to fight an outrageous decision. They can't elect somebody new in 4 years. Thomas Jefferson was adamantly opposed to said judiciary, because it made the constitution a "thing of wax" The whole reason behind federalism was that states would have different ideas of what is good and should implement that. that way you could get away from states with bad laws. Today the Supreme Court and other judges completely ignores the constitution. If they say the sky is green, nobody can correct them save Death itself.

finkin1 10y ago

Is there a charitable interpretation of this that I'm not seeing? Or is this truly as terrifying as it appears?

mirimir 10y ago
Nope. If this becomes widespread precedent, encryption is no longer viable in the US.
- Pitarou 10y ago
  I think we’re about to see an increase in interest in deniable encryption. A simple solution is to have your encryption software automatically add a large garbage file inside every encrypted volume. When you have something to hide, replace the garbage file with your new encrypted data. This lets you nest your encryption to arbitrary depth, allowing plenty of room for plausible deniability. E.g. you could put your financial records at the first level, pictures from an erotic crossdressing forum at the second level, and the stuff you’re ACTUALLY hiding at the third level.
  - mirimir 10y ago
    That's an interesting idea. But it arguably wouldn't have helped Mr. Rawls. Investigators claimed to know what they sought, so they'd still argue that he was holding out. Maybe it's safer to keep encrypted stuff anonymously in cloud storage. Mr. Rawls could have run his Freenet node on an anonymously-leased VPS, used Tor onion services for the various WebGUIs, and accessed it all via Tails. There would have been nothing local to go after.
    - Pitarou 10y ago
      Rawls’ is an odd case. If the reports are accurate, he seems to have believed that a strong password on his hard drive gave him legal immunity, and didn’t really try to conceal what he was doing. Nonetheless, a line has been crossed, and cyber-libertarians have been predicting this breach for as long as I can remember. There’s nothing cyber-libertarians love more than a technical solution to state oppression.

fencepost 10y ago

This is an interesting contrast to the article reported this past week about Nigel Lang, a black man in the UK who was accused of having or sharing child porn because of an extra digit added to an IP address during investigations[1]. One relevant section from the apology/explanation letter: "The issues around the downloading of IIOC [indecent images of children] are that statistically out of a cohort of offenders, the predominant characteristic is that the offence will be committed in the main by white males. Only a very small percentage will be black, around 3%, and only around 2% will be female. Consequently, any arrests that are made for this offence will revolve around the male in the address as the starting point for the investigation." Notably Rawls (the man indefinitely jailed) is black. [1] https://www.buzzfeed.com/matthewchampion/this-mans-life-was-destroyed-by-a-police-typo?utm_term=.sq1RxMpPw#.dly024JKV https://www.buzzfeed.com/matthewchampion/this-mans-life-was-...

fjdlwlv 10y ago
It's nice to see white folks be the victims of racial profiling once in a while.
- Karlozkiller 10y ago
  Is racial profiling ever truly nice to see?
bsder 10y ago
> The issues around the downloading of IIOC [indecent images of children] are that statistically out of a cohort of offenders, the predominant characteristic is that the offence will be committed in the main by white males. Only a very small percentage will be black, around 3%, and only around 2% will be female. That's quite a remarkable statistic. I wonder why.
- c3534l 10y ago
  Fewer black people for one.
  - 10y ago

ahelwer 10y ago

Here's a recording of the oral arguments for the US Court of Appeals, Third Circuit back in September: http://www2.ca3.uscourts.gov/oralargument/audio/15-3537USAv.AppleMacProComputer.mp3 http://www2.ca3.uscourts.gov/oralargument/audio/15-3537USAv.... The gov's argument seems to be that because the defendant doesn't have to give the government the password but rather produce the decrypted hard drives, his actions aren't protected under the fifth. Analogy drawn with unlocking a safe. EFF counter-argument to the safe analogy is that the encrypted documents do not simultaneously exist in a decrypted form protected by an obstacle, like a safe, but rather are produced as an act of translating the data from decrypted to unencrypted form; the government already has the data on the drives, they just can't understand it without the contents of the defendant's mind. Justices then press the gov lawyer on whether there are fourth amendment issues in the case, as in whether the government can search all files on the hard drive, if decrypted, for evidence of criminality beyond the specific files they seek. Gov lawyer punts on the issue. Basically it seems like a steep hill for proponents of encryption. The justices talk about how we're heading for a world where almost everything is encrypted, and encryption proponents are asking the government to give up an enormous amount of power.

zer0t3ch 10y ago
Can you be compelled to provide something that you don't have access to? Were anyone else in this situation, wouldn't it be plausible to simply claim you don't know that password?
- null0pointer 10y ago
  I've wondered about scenarios where you can legitimately claim to not know the password to decrypt a drive. A few different cases I can think of which may be ruled differently by a court. 1) I use a password manager so I don't know the password. However, I have the means to acquire the password. 2) I use a password manager but somehow lost access to it unintentionally. 3) I use a password manager and lost access to it by design. (eg. Using a dead man's switch of some kind that deletes it if I don't "check in" for some period of time) 4) I used to know the password. However, I suffered a traumatic brain injury and cannot recall it. I obviously don't have the answers but I think these are interesting to think about as different points in a large legal grey area.

NightMKoder 10y ago

This case is interesting. If I'm reading https://en.m.wikipedia.org/wiki/United_States_v._Hubbell https://en.m.wikipedia.org/wiki/United_States_v._Hubbell correctly, the fifth amendment only applies if "they don't know what they're looking for." In this case, because there is (enough) evidence of CP on his computer, they are subpoenaing him to produce the unencrypted drives. In some sense, they're not asking for a password - they're asking for the drive contents, which they know to at least partially be illegal. IANAL though. Assuming that interpretation of the 5th is correct, subpoenas can easily be used to access encrypted information. I just hope the judges that decide when to grant subpoenas know where that line is.

ethbro 10y ago
It is amazing that anything produced would be admissible. I don't see how this is different than having circumstantial evidence that someone is a murderer, so ordering them to lead you to where they buried the body.
- NightMKoder 10y ago
  I think they key is that the evidence is beyond circumstantial - they have concrete evidence that he uploaded files that were CP from that computer. It's a bit worrying why that isn't circumstantial (hacked computers aren't a thing?), but maybe the standard for issuing a subpoena is lower than guilt but higher than circumstantial. Sounds like the only right answer for your password is "I do not recall"
  - RUG3Y 10y ago
    This might be a stupid thought but if they already have enough concrete evidence against the suspect, why do they require the contents of the drive?
    - NightMKoder 10y ago
      My bet would be to up the sentence. Go from 2 counts of CP to 200 - 5 years in jail to life sentence.

Overtonwindow 10y ago

This raises an interesting idea: why not create two passwords for encrypted drives, one password decrypt the drive, another password completely wipes the drive. This way if someone is forced to give a password to decrypt something, that password renders the data moot. Thoughts?

striking 10y ago
Here's mine: destruction of evidence is a crime. Probably not the best idea. Hiding the partition or otherwise making the encrypted data hidden is probably your only bet.
- Overtonwindow 10y ago
  Which would you rather go down for: destruction of evidence, or what's in your hard drive? I'm asking a technical question, not a legal one. There are many instances where this would be preferable than giving up the data.
  - striking 10y ago
    If someone released such a tool, the feds would make sure to clone your hard drive before supplying the password to it, or write a patched version of the tool that reads it to remove the disk wiping call. And then you'd be in really hot water.
    - MaulingMonkey 10y ago
      An interesting talk on disk antiforensics: https://www.youtube.com/watch?v=qZtkANvDxZA https://www.youtube.com/watch?v=qZtkANvDxZA Of course, having watched this, the feds might look for such tricks...
    - naasking 10y ago
      I expect cloning to already be standard forensic procedure, but perhaps I'm wrong. If not, it should be.

goodplay 10y ago

Sitting directly in front of me are two moderately large encrypted hard drives the passwords for which I forgot. If I get a subpoena to produce their contents, I will potentially remain in jail of the rest of my life for the crime of being forgetful. That judge's behavior and (the laws that enables it) is sickening. You either have enough evidence to convict a person, or you don't.

M_Grey 10y ago
More and more I'm convinced that the only solution is data destruction on a fail-deadly system. Like a warrant canary, if it's your default operation, you should be alright. As I always add though, don't keep your family photos on that drive.
- walrus 10y ago
  I don't understand what a fail-deadly drive would look like. Can you give an example?
  - stagbeetle 10y ago
    I'd imagine you'd have to do a task (like inputting a passcode) every so often or the drive would be made inoperable. For SSD's it'd be as simple as an automatic single pass overwrite and a new encryption key. For HDD, the hyper-paranoid could rig their drives with small explosives to fracture the platters.
    - M_Grey 10y ago
      ^This. In fact you can buy readymade solutions now which physically destroy the NAND gates on the input of a code, or as you say, if you fail to input a code within a time limit.
  - M_Grey 10y ago
    An example I've given here before is: http://securedrives.co.uk/ http://securedrives.co.uk/ There are other solutions though, and of course you can make your own if you feel confident about it.

cnnjhvyhvc 10y ago

This reminds me that I need to wipe the drive I was using to test Bitlocker, as I typed in a random password and have long since forgotten it. I can only imagine the Kafkaesque horror of being imprisoned until I decrypt it, spending decades trying to brute force it.

hackuser 10y ago

Some discussion overlooks that this is a special case: ... the appeals court, like the police, agreed that the presence of child porn on his drives was a "foregone conclusion." The Fifth Amendment, at its most basic level, protects suspects from being forced to disclose incriminating evidence. In this instance, however, the authorities said they already know there's child porn on the drives, so Rawls' constitutional rights aren't compromised. The Philadelphia-based appeals court ruled: Forensic examination also disclosed that Doe [Rawls] had downloaded thousands of files known by their "hash" values to be child pornography. The files, however, were not on the Mac Pro, but instead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed. The court also noted that the authorities "found [on the Mac Book Pro] one image depicting a pubescent girl in a sexually suggestive position and logs that suggested the user had visited groups with titles common in child exploitation." They also said the man's sister had "reported" that her brother showed him hundreds of pictures and videos of child pornography. All of this, according to the appeals court, meant that the lower court lawfully ordered Rawls to unlock the drives.

dongslol 10y ago
The critical question is, why haven't they charged him? It is disingenuous of them to bring up the evidence they currently have essentially in an attempt to demonize him. Their evidence is sufficient or it isn't; if it is they should charge him; if not they're demanding self-incrimination.
- rayiner 10y ago
  You need to distinguish between requiring the defendant to turn over incriminating evidence (which the 5th amendment does not protect), and requiring the defendant to make incriminating statements (i.e. to provide incriminating testimony). Sometimes, the act of producing evidence in response to a government request involves the defendant making implicit incriminating assertions. If the government says "produce all your cooked accounting books," handing over those documents implicitly communicates the assertions that (1) certain books exist; (2) those books are doctored; and (3) you have ownership/control over them. However, say the government asks you for your bank records. When you hand them over, you're implicitly saying "I have bank records," and "these are my bank records." That's not incriminating -- even if the bank records themselves might contain incriminating evidence. The "foregone conclusion rule," says that the act of production is non-testimonial when the incriminating facts are already known.[1] If the existence of doctored books is already known by other means, the act of producing them doesn't communicate anything to the authorities. The books themselves are obviously communicated, but the 5th amendment does not protect the underlying evidence. It protects the implied statements by the defendant about the underlying evidence. Hence the threading the needle in the opinion. They're not asking the guy to make incriminating statements about the existence of incriminating evidence. They're asking him to turn over the incriminating evidence they already know exists. [1] Note that the Court is not saying "we already know he's guilty so the 5th amendment doesn't apply."

deleted 10y ago

[deleted]

1024core 10y ago

Can you refuse a search warrant? My understanding (albeit limited) is that you can't, if it's been signed by the proper legal authority. Is refusing to unlock the HDD the same as refusing to unlock a room, when presented with a lawful warrant? I would think so.

oh_sigh 10y ago

What happens if this guy just claims that he forgets the password and sticks to his story? Will he be effectively imprisoned for life, whether true or not?

jlebrech 10y ago
if they imprisoned him in a way which is later seen as unlawful he can get a huge payout. why not just stick to your guns and get $1m+ for sleeping in bed and doing a few push up.

theonemind 10y ago

Quite a minefield of legal issues. Indefinite detention pretty much seems like an abuse of the court's power to find people in contempt. He should get charged with a real crime like obstructing justice and serve a sentence for it, if they have the evidence for that, but this is absurd.

azinman2 10y ago

If they already know it's on there, then isn't that enough to build the case and just try him as is?

Steeeve 10y ago

It goes to show that regardless of what protection encryption theoretically provides, security is only as good as the weakest link in the chain. Torture in some fashion is _always_ an option to force decryption. The same goes for constitutional protections. The more time goes on, the more constitutional protections will be attacked and minimized. The fact that a child pornography case is being used to break encryption via the courts should come as no surprise. Emotion is being used to broaden the power of the courts.

ryan_j_naughton 10y ago

Thought experiment: What if there were an encryption system whereby if a user inputs one decryption key, the encrypted data decrypts to one set of values and if the user uses a second key, it decrypts to a second set of values. Sure, in order to encode both sets of data into a single encrypted result would require more storage space, but that is a small price to pay for protection against self incrimination from our ever growing police and surveillance state. The end of the article captures why this idea would be so effective, viz. "The authorities, however, said no testimony was needed from Rawls. Rather, they said, 'he can keep his passwords to himself' and 'produce his computer and hard drives in an unencrypted state.'" It is absolutely true and valid that the government has the right to compel people to hand over evidence that they are KNOWN to possess (in the same way that legal discovery is essential to civil cases). The line the government is drawing between self-incrimination and forced cooperation in an investigation is they they don't want him to tell them the password or what is on the drives -- they simply want him to hand over the drives in an intelligible state. Thus, if one could decrypt the drives to an intelligible set of data but not the data they desire, then you would be complying with the court order and could not be held in contempt. Can someone on HN who knows more about cryptography help poke holes in my idea?

mifreewil 10y ago
This is possible, at least in some contexts. I'm no expert, but the bitcoin wallet, Trezor, has implemented this - known as "plausible deniability". The idea is if you are compelled somehow by force to unlock your bitcoin wallet, you can use a secondary password that assumingly has less bitcoin than your regular bitcoin wallet. https://news.bitcoin.com/bitcoin-wallet-plausible-deniability/ https://news.bitcoin.com/bitcoin-wallet-plausible-deniabilit...
tedunangst 10y ago
They also have a set of hashes of files they expect to find. If they don't find those files, they'll probably ask more questions.
- kbart 10y ago
  How can they be sure that files weren't deleted?

hollander 10y ago

Is this another case of "encryption works"?!

69mlgsniperdad 10y ago

What would happen if he lobotomized(carefully and mildly) himself, and legitimately could not remember his encryption keys/pw nor the reason he performed lobotomy?

jacobush 10y ago
Or very carefully shot himself in the heart?
- pc86 10y ago
  Surely this layman knows enough about the brain to know how to lobotomize himself such that he forgets his passwords, but not such that he forgets how to perform a self-lobotomy!
  - jacquesm 10y ago
    That's easy, just snip the blue neurons. Or was it the red ones? No, definitely blue. (Snips red neuron.)
  - 69mlgsniperdad 10y ago
    I can attest that it indeed quite simple. Have done a nearly a dozen on myself, no evident issues whatsoever.
    - dang 10y ago
      We've banned this account for posting unsubstantive comments and ignoring our request to stop.
      - Sciencehaters 10y ago
        Can you stop doing everything you can to make people hate science. Stop being elitist maybe?
      - Dangisbiased 10y ago

jlebrech 10y ago

what if there was a password to decrypt the drive into rick astley on a loop?

employee8000 10y ago

After 18 months in jail, can't the accused legitimately say that he forgot his password? I don't know if I would remember a relatively complex password if I were stuck in s jail cell for 18 months with no computer or ability to type it in every few days.

moonshinefe 10y ago

If they've got the evidence, legitimately charge him then? If it's sufficient, let a jury of his peers convict him then. How is this any more complicated than that, no matter how you frame it? We have laws as a check and balance system for a reason, apparently the US courts are slowly forgetting it or something...

pyabo 10y ago

They are doing the same inquisidores did, they are torturing someone to confess (in this case decrypt)

emanreus 10y ago

The scary part is that someone can be jailed indefinitely. I had no idea that was legally possible.[1] But it's CP so it's an easy sell. [1] https://en.wikipedia.org/wiki/Indefinite_imprisonment https://en.wikipedia.org/wiki/Indefinite_imprisonment

Radle 10y ago

"The fact remains that the government has not brought charges," Donoghue said in a telephone interview. "Our client has now been in custody for almost 18 months based on his assertion of his Fifth Amendment right against compelled self-incrimination." This should be simple, either they have enough to charge him or not.

Zuescho 10y ago

Okay now, what if my password is the hash of a CP Picture, then there would be no way for me to offer that password without committing a crime in the first place. So in that case you would be safe. Or when the password would be some file that could incriminate me

tombert 10y ago

It seems like the law is kind of ambiguous on this (https://en.wikipedia.org/wiki/TrueCrypt#United_States_v._John_Doe https://en.wikipedia.org/wiki/TrueCrypt#United_States_v._Joh...), unless my interpretation is completely flawed. I wonder if this will have to go to the Supreme Court at some point.

vilhelm_s 10y ago
In this case, the 3rd circuit applied the same standard as the 11th (the government can compel decryption if they know what is on the drive), so it doesn't yet create a circuit split. However, they don't decide that that is the right standard. In a footnote they suggest that the correct standard would be more lax (the government can compel decryption if they know the person knows the password). So if a case comes up where they rule that way, it would create a circuit split and lead the supreme court to take the case. Orin Kerr writes a column about it here: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/03/20/third-circuit-doesnt-resolve-standard-for-forced-decryption-under-the-fifth-amendment/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

bawana 10y ago

Although most of the comments here have to do with legality, I am more concerned with the technical aspect. The prosecutors say they know that he has porn because the hash values they obtained are identical to the hash values of porn images. Are hash collisions not a consideration? Can hash values be as incriminating as direct evidence? Is it possible to take a hash of a benign image (kitten?) and encrypt it with an algorithm that gives a result which is identical to an unencrypted hash value of a pornographic image?

DanBC 10y ago
> Are hash collisions not a consideration? His defence team would be hopelessly incompetent if they didn't mention that if it was a realistic possibility.
xeonoex 10y ago
I'm wondering how they obtained the hashes. You can't hash images on an encrypted drive. How are they able to obtain a hash of an image without actually having the image? Were the hash values from what he has downloaded stored somewhere?

pnutjam 10y ago

The sad part is he has provided the password, but it's "fuckoffI'llnevertell"

noahbullock 10y ago

It's my understanding that, while one is obligated to comply with a warrant granting police access to places or materials in one's control, one cannot be compelled to aid them in their search or understanding. In other words, if presented with a warrant, a person would be required to grant access to a home or to hand over an accounting ledger, but the Fifth Amendment protects against being compelled to tell police where in the home drugs are hidden or which line items in the ledger contain embezzlement. A warrant grants the police the right to search, but not the right to find. With that in mind, here's a thought exercise: Let's say that I'm caught on camera signing a document with a man who later kills my business partner. The camera then records me going into my warehouse with the document and emerging later without it. The police, believing that I arranged the murder and that the proof is in the document, duly obtain a warrant to search the warehouse. The warehouse is large and when the police enter, they find it is stacked floor to ceiling with sheets of paper, all indistinguishable except for their contents. They estimate the number of pages to be in the billions -- far too many for them to feasibly comb through. If I understand the right against self incrimination correctly, I can't be forced to tell the police where I hid the specific piece of paper they're looking for. Why is this different from finding a password? Assume we use a 43 character password (since the encryption key is AES 256, a password longer than 43 characters wouldn't add additional security). If this is the case, approximately 1.01e86 - 1 passwords effectively yield a garbage document, and 1 password produces the document the police are looking for. If one can't be compelled to help the police find the solution in a physical search space, why can one be compelled to help find one in a digital search space?