5 ms·

Sitting directly in front of me are two moderately large encrypted hard drives the passwords for which I forgot. If I get a subpoena to produce their contents,

Sitting directly in front of me are two moderately large encrypted hard drives the passwords for which I forgot. If I get a subpoena to produce their contents, I will potentially remain in jail of the rest of my life for the crime of being forgetful. That judge's behavior and (the laws that enables it) is sickening. You either have enough evidence to convict a person, or you don't.

M_Grey 10y ago
More and more I'm convinced that the only solution is data destruction on a fail-deadly system. Like a warrant canary, if it's your default operation, you should be alright. As I always add though, don't keep your family photos on that drive.
- walrus 10y ago
  I don't understand what a fail-deadly drive would look like. Can you give an example?
  - stagbeetle 10y ago
    I'd imagine you'd have to do a task (like inputting a passcode) every so often or the drive would be made inoperable. For SSD's it'd be as simple as an automatic single pass overwrite and a new encryption key. For HDD, the hyper-paranoid could rig their drives with small explosives to fracture the platters.
    - M_Grey 10y ago
      ^This. In fact you can buy readymade solutions now which physically destroy the NAND gates on the input of a code, or as you say, if you fail to input a code within a time limit.
  - M_Grey 10y ago
    An example I've given here before is: http://securedrives.co.uk/ http://securedrives.co.uk/ There are other solutions though, and of course you can make your own if you feel confident about it.
Bamberg 10y ago
mmm this poses an interesting question: what if a defendant/suspect cannot remember the password? Does anyone know if there is any comparable precedent regarding forgetting things?
- isaacremuant 10y ago
  If you're a politician, "I don't recall" seems to work wonders for depositions.
  - fjdlwlv 10y ago
    Only if you are too powerful to jail
petermcnister25 10y ago
When the original case surfaced I was wondering the same. If they had (real) evidence that your encrypted hard drives have CP, then I'd be okay putting you in jail (; However, if that was the case then they wouldn't need to decrypt the drives, so this whole case smells quite a bit. AFAIK there is a similar situation in the airport immigration; if you are an US citizen and don't want to provide a password for an encrypted device, they'll make you have a bad time, then throw the device and then let you in. Same for foreigners except with a flight back instead of letting them in. The bad time they give you basically depends on the immigration officer.
beisner 10y ago
Our justice system, by and large, rests not on proving the truth or not, but on a (idealistically) rational group of peers deciding both on the probability that a crime occurred and the justification/reasoning of both the crime itself and the law criminalizing it. Beyond that, it rests on a legal system (police, courts, etc) that, by and large, also act on notions of reasonability and discretion to bring forth evidence that will inform a jury's decision. As we have seen in many high-profile examples, the system is imperfect - it is human, and in many prominent cases (from exoneration of lynchers in the 1930s to indefinite detention today) it fails in disturbing ways. It is because of intentional vagueness that these failures arise, but it is also by this vagueness that unique exceptions arise. In this case, I don't think that the decision necessarily sets precedent for all of us with hard drives for which we have forgotten the password. I don't necessarily agree with the indefinite detention (although I do not claim to know the scope of other investigations that might rely on the evidence on those drives), but I think the circumstances are positioned such that this decision is an exception to our system rather than the beginning of a slippery slope. Of course i might be wrong, but I wouldn't decry the end of privacy just yet.
rayiner 10y ago
The Court's opinion explicitly addresses that (at 18-19). It first recognizes that impossibility of compliance is a defense to a contempt charge. But it then explains why the trial judge reasonably did not buy that argument: > At the contempt hearing, the Government presented several witnesses to support its prima facie case of contempt. Doe’s sister testified to the fact that, while in her presence, Doe accessed child pornography files on his Mac Pro computer by means of entering passwords from memory. Further, a detective who executed the original search warrant stated that Doe did not provide his password at the time because he wanted to prevent the police from accessing his computer. Doe never asserted an inability to remember the passwords at that time.
- pinum 10y ago
  18 months later, though, it is completely plausible that he really has forgot. I don't think I would remember a complex password that I haven't used for 18 months. Hell, I sometimes have to reset simple passwords that I created last month. If you don't use knowledge, you forget it.
  - timv 10y ago
    Perhaps, but the judge can only make judgements based on the arguments presented. If the defendant wanted to argue that he no longer remembered the password (but would be willing to decrypt the drive if he could), then that's something that the judge would consider. But a judge can't (and won't) simply say "Oh, maybe he hasn't complied because he just forgot the password. I'm going to let him off"
    - michaelmrose 10y ago
      Its literally impossible to prove someone has or hasn't forgotten something. You shouldn't be able to jail someone indefinitely for not producing something you can't prove exists.
      - superflyguy 10y ago
        That's not something that's going to trouble US authorities given that the US invasion of Iraq was alleged to have been because the Iraqi leadership couldn't demonstrate that there were no "weapons of mass destruction" hidden somewhere in the country.
repples 10y ago
Unless you've been engaging in online noncery and have amassed a gigantic collection of photographs and videos of child abuse like the scumbag described in the article has evidenced, you should be absolutely fine. It's certainly not the judge's behaviour that is sickening here.
- DerpyBaby123 10y ago
  Isn't the man innocent until proven guilty?
  - repples 10y ago
    The court accepted evidence that he'd downloaded and shared all manner of such filth, including both technical evidence and testimony from his sister.
    - tonyedgecombe 10y ago
      Then why couldn't they convict him on that evidence?
      - goodplay 10y ago
        This is my main gripe. You either have the evidence to put the defendant in jail or you don't. If you don't have enough evidence to support putting him in jail, you let him free. Innocence until proven guilty. I don't want to live in a society where law is determined by emotions and personal bias, even if some criminals end up escaping justice. Side note: I can't believe I feel the need to state this, but evidently it needs to be stated (from comments in this thread): these two drives where set up as part of a backup solution. They contain my personal data. They do not contain child pornography.
      - haikuginger 10y ago
        The ability to convict a particular case on a particular set of evidence is unknowable before trial, where the facts are decided by a jury. It would be irresponsible for a prosecutor to attempt a trial if they know stronger evidence is available. The prosecution was able to convince a judge that there is encrypted child pornography on those drives. The judge can't force a jury to accept that (a ruling of fact), but (s)he can make a ruling of law that the defendant no longer has a fifth amendment defense to producing a decrypted version of those drives.

M_Grey 10y ago

More and more I'm convinced that the only solution is data destruction on a fail-deadly system. Like a warrant canary, if it's your default operation, you should be alright. As I always add though, don't keep your family photos on that drive.

walrus 10y ago
I don't understand what a fail-deadly drive would look like. Can you give an example?
- stagbeetle 10y ago
  I'd imagine you'd have to do a task (like inputting a passcode) every so often or the drive would be made inoperable. For SSD's it'd be as simple as an automatic single pass overwrite and a new encryption key. For HDD, the hyper-paranoid could rig their drives with small explosives to fracture the platters.
  - M_Grey 10y ago
    ^This. In fact you can buy readymade solutions now which physically destroy the NAND gates on the input of a code, or as you say, if you fail to input a code within a time limit.
- M_Grey 10y ago
  An example I've given here before is: http://securedrives.co.uk/ http://securedrives.co.uk/ There are other solutions though, and of course you can make your own if you feel confident about it.

Bamberg 10y ago

mmm this poses an interesting question: what if a defendant/suspect cannot remember the password? Does anyone know if there is any comparable precedent regarding forgetting things?

isaacremuant 10y ago
If you're a politician, "I don't recall" seems to work wonders for depositions.
- fjdlwlv 10y ago
  Only if you are too powerful to jail

petermcnister25 10y ago

When the original case surfaced I was wondering the same. If they had (real) evidence that your encrypted hard drives have CP, then I'd be okay putting you in jail (; However, if that was the case then they wouldn't need to decrypt the drives, so this whole case smells quite a bit. AFAIK there is a similar situation in the airport immigration; if you are an US citizen and don't want to provide a password for an encrypted device, they'll make you have a bad time, then throw the device and then let you in. Same for foreigners except with a flight back instead of letting them in. The bad time they give you basically depends on the immigration officer.

beisner 10y ago

Our justice system, by and large, rests not on proving the truth or not, but on a (idealistically) rational group of peers deciding both on the probability that a crime occurred and the justification/reasoning of both the crime itself and the law criminalizing it. Beyond that, it rests on a legal system (police, courts, etc) that, by and large, also act on notions of reasonability and discretion to bring forth evidence that will inform a jury's decision. As we have seen in many high-profile examples, the system is imperfect - it is human, and in many prominent cases (from exoneration of lynchers in the 1930s to indefinite detention today) it fails in disturbing ways. It is because of intentional vagueness that these failures arise, but it is also by this vagueness that unique exceptions arise. In this case, I don't think that the decision necessarily sets precedent for all of us with hard drives for which we have forgotten the password. I don't necessarily agree with the indefinite detention (although I do not claim to know the scope of other investigations that might rely on the evidence on those drives), but I think the circumstances are positioned such that this decision is an exception to our system rather than the beginning of a slippery slope. Of course i might be wrong, but I wouldn't decry the end of privacy just yet.

rayiner 10y ago

The Court's opinion explicitly addresses that (at 18-19). It first recognizes that impossibility of compliance is a defense to a contempt charge. But it then explains why the trial judge reasonably did not buy that argument: > At the contempt hearing, the Government presented several witnesses to support its prima facie case of contempt. Doe’s sister testified to the fact that, while in her presence, Doe accessed child pornography files on his Mac Pro computer by means of entering passwords from memory. Further, a detective who executed the original search warrant stated that Doe did not provide his password at the time because he wanted to prevent the police from accessing his computer. Doe never asserted an inability to remember the passwords at that time.

pinum 10y ago
18 months later, though, it is completely plausible that he really has forgot. I don't think I would remember a complex password that I haven't used for 18 months. Hell, I sometimes have to reset simple passwords that I created last month. If you don't use knowledge, you forget it.
- timv 10y ago
  Perhaps, but the judge can only make judgements based on the arguments presented. If the defendant wanted to argue that he no longer remembered the password (but would be willing to decrypt the drive if he could), then that's something that the judge would consider. But a judge can't (and won't) simply say "Oh, maybe he hasn't complied because he just forgot the password. I'm going to let him off"
  - michaelmrose 10y ago
    Its literally impossible to prove someone has or hasn't forgotten something. You shouldn't be able to jail someone indefinitely for not producing something you can't prove exists.
    - superflyguy 10y ago
      That's not something that's going to trouble US authorities given that the US invasion of Iraq was alleged to have been because the Iraqi leadership couldn't demonstrate that there were no "weapons of mass destruction" hidden somewhere in the country.

repples 10y ago

Unless you've been engaging in online noncery and have amassed a gigantic collection of photographs and videos of child abuse like the scumbag described in the article has evidenced, you should be absolutely fine. It's certainly not the judge's behaviour that is sickening here.

DerpyBaby123 10y ago
Isn't the man innocent until proven guilty?
- repples 10y ago
  The court accepted evidence that he'd downloaded and shared all manner of such filth, including both technical evidence and testimony from his sister.
  - tonyedgecombe 10y ago
    Then why couldn't they convict him on that evidence?
    - goodplay 10y ago
      This is my main gripe. You either have the evidence to put the defendant in jail or you don't. If you don't have enough evidence to support putting him in jail, you let him free. Innocence until proven guilty. I don't want to live in a society where law is determined by emotions and personal bias, even if some criminals end up escaping justice. Side note: I can't believe I feel the need to state this, but evidently it needs to be stated (from comments in this thread): these two drives where set up as part of a backup solution. They contain my personal data. They do not contain child pornography.
    - haikuginger 10y ago
      The ability to convict a particular case on a particular set of evidence is unknowable before trial, where the facts are decided by a jury. It would be irresponsible for a prosecutor to attempt a trial if they know stronger evidence is available. The prosecution was able to convince a judge that there is encrypted child pornography on those drives. The judge can't force a jury to accept that (a ruling of fact), but (s)he can make a ruling of law that the defendant no longer has a fifth amendment defense to producing a decrypted version of those drives.