6 ms·

Judge won’t release man jailed 2 years for refusing to decrypt drives

90 points by sus_007 9y ago

vonzeppelin 9y ago
If you can be jailed indefinitely for not decrypting a drive then can't you be jailed indefinitely for not remembering your password? That sounds fair.
- drostie 9y ago
  At the contempt hearing, you are allowed to testify that you do not remember your password, and it puts the burden of proof on the government to prove that you secretly remember your password and are lying to the court when you say that you don't. Of course if you do testify this and you are lying, then that's a perjury charge -- which means that for example if you have told your lawyer that you do remember your password, your lawyer cannot knowingly allow you to lie on the stand and could be disbarred etc. if you do. But assuming that you're not lying and so forth, you can just say "I can't comply with this court order because I don't remember the password" and that will suffice for your defense at your contempt hearing unless the government can meet a strong burden of proof that you secretly do know your password and are lying about it, which you are of course entitled to counterexamine and poke holes in. Rawls did not testify, at his contempt hearing, that he did not remember his password. He did not testify at all at that hearing. He said prior that he doesn't remember his password to the police, and he has said it afterwards to the media, and he might have even said it to a different judge in these weird follow-up hearings--but he didn't say it at the contempt hearing and as I understand it he didn't appeal this hearing directly to say "well shoot I didn't realize I was getting jailed on a technicality, let's re-do this hearing so that I can testify that I forgot it properly." There are many reasons that Rawls might not have testified; possibly he has a very good lawyer who is concerned about some bigger issues that Rawls might have to address if he testifies at all; possibly he has a very bad lawyer who did not know that this is how forgot-my-password law works and did not read the Supplemental Order the judge wrote explaining why Rawls is being held in contempt of court. I do not know why he did not testify this. However, testifying this is sufficient to be not held in contempt of court, unless the government can meet a stiff burden of proof that you are lying.
  - charlesdm 9y ago
    > However, testifying this is sufficient to be not held in contempt of court, unless the government can meet a stiff burden of proof that you are lying. Which in essence is impossible in most cases, unless you are stupid enough to actually tell people that you refuse to decrypt the drive and those can then testify against you. It's all a matter of perception. It just shows how much a few words can matter a lot in a legal context, and how by saying you don't remember the password, you will walk, whereas by saying you won't give it up, you'll be held in contempt for 2+ years rotting away in a cell. Perhaps he could say he doesn't remember the password in a few years? "It's been years, it was a complex password containing a lot of characters, and I no longer know what the password is" -- that doesn't seem unreasonable.
  - humanrebar 9y ago
    > At the contempt hearing, you are allowed to testify that you do not remember your password Isn't it the government's job to prove you remember it? Shouldn't the right to remain silent apply in contempt hearings as well?
    - jo909 9y ago
      You never have to make a statement to the police, and this is why it's part of the Miranda warning. There is no per se right to remain silent before a judge. The fifth amendment allows one to not be whitness against oneself, but that doesn't allow you to ignore the judge. And if you raise the fifth as a response and the court does not believe it applies, you get to argue why it does before another judge, which is where this man is now. A forgotten password is not part of the current debate.
    - drostie 9y ago
      It is the government's job to prove you remember it. They have the burden of persuading the court that you don't remember it. This is spelled out explicitly in the Supplemental Order issued by the judge, PDF freely available at: https://ia601303.us.archive.org/0/items/gov.uscourts.paed.507511/gov.uscourts.paed.507511.21.0.pdf https://ia601303.us.archive.org/0/items/gov.uscourts.paed.50... What is at stake is a burden of evidence production. The difference between production and persuasion, in a court room, is a distinction both of quantity and quality. You "produce" single pieces of evidence, whether weak or strong -- then the totality of all of the pieces of evidence, evaluated together according to their strengths, "persuades" the court. "Produce" is quality-agnostic and refers to single pieces of evidence; "persuade" or "prove" refers to all of the evidence on both sides and weighs them by their quality. And what's really at stake is that your lawyer, at a contempt hearing, cannot merely claim, "Well, your honor, the prosecution has not proven that my client is definitely able to fulfill the order, because they have not disproven every possible reason why my client could not fulfill the order." The reason that this is not enough is that it is asking the government to prove a negative, "you cannot possibly have any excuse." Instead the procedures that courts use to decide these cases require the defense to identify specific reasons why the defendant cannot fulfill the earlier order, and then the burden falls on the prosecution to prove that those specific reasons are BS. And for this purpose they need to produce some evidence -- it doesn't need to be strong, persuasive evidence -- that the defendant cannot fulfill the order for that reason. Because it does not have to be strong or persuasive, a statement of testimony is taken at face-value as sufficient. The only attack the government can make at the evidence-production level is "even if this evidence were 100% persuasive the defendant would still be able to decrypt the drives", so the evidence has to have some clear logical relation to the excuse. But obviously if your sworn testimony that you cannot decrypt the hard drives were 100% persuasive, you would not be able to. It's still the government's job to prove you remember it, but you need to produce some sort of pertinent evidence (no matter how flimsy) that you don't, so that the court even evaluates this defense in the first place.
- TomK32 9y ago
  plot twist: password is "I don't remember my password"
  - philsnow 9y ago
    https://www.youtube.com/watch?v=bLE7zsJk4AI https://www.youtube.com/watch?v=bLE7zsJk4AI it was a fun day teaching my children the use-mention distinction https://en.wikipedia.org/wiki/Use%E2%80%93mention_distinction https://en.wikipedia.org/wiki/Use%E2%80%93mention_distinctio...
    - lathiat 9y ago
      Thanks for sharing that link, something I knew about but not by name :-) Also thumbs up for Rocket Jump In a related tangent when I setup the WiFi for the Perth Artifactory Hackerspace, I told everyone (via email) the password was on the back of the door. Which had a sign that said "KEEP DOOR CLOSED" :-) Fortunately the first person to try it, did figure it out.
crb002 9y ago
Confess regardless of guilt there was child abuse obscenity and forgot password. Then file lawsuit claiming confession was coerced.
- imglorp 9y ago
  Does being jailed for refusing to cooperate count as coercion?
  - SomeStupidPoint 9y ago
    Isn't the exact point of jailing for refusing to cooperate coercion to cooperate? That's why there isn't a trial -- the judge is coercing you to obey him, you're not being punished for not.
  - crb002 9y ago
    The fatal flaw here is that this guy lost over 90 days (I think that's the lower bound) of liberty without a jury trial. Under this scheme a judge could jail you until you produce the body in a suspected murder, or until you tell the cops where the money is in a suspected bank robbery. Contempt is a quasi-criminal remedy with severe limitations. SCOTUS will rule from this that contempt confinement for longer than 90 days requires jury fact finding.
    - seanhunter 9y ago
      Hmm. It's not true to say under this scheme a judge could jail you for not producing a body. This is more like a situation where the judge could jail you for not allowing people to search the spot where they suspect the body is (eg if you won't let police search your freezer). That's something they can in fact already do. That is to say, they have the right (assuming a warrant) to search where they want to search, and if there is a physical protection (eg a key) it isn't covered by 5th amendment and you have to cough it up. The 5th amendment doesn't bestow a right to prevent the collection of evidence in general. You could argue that this particular person wanted a jury trial they could easily have got that by disclosing the password and allowing decryption. That said, forcing disclosure of a password is particularly troubling. On its face it seems obvious that he is deliberately not doing that so as not to reveal the incriminating evidence (ie incriminate himself), which is why he is pleading the 5th amendment right not to be forced to do that.
kazinator 9y ago
What sort of lousy hard drive encryption reveals hash values of plaintext?
- jotato 9y ago
  I had the same thought.
- jo909 9y ago
  They have access to the OS drive, and found some logfile or metadata on there. http://www2.ca3.uscourts.gov/opinarch/153537p.pdf http://www2.ca3.uscourts.gov/opinarch/153537p.pdf Despite Doe’s refusal, f orensic analysts discovered the password to decrypt the Mac Pro Computer , but could not de crypt the external hard drives. [...] The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash ” values to be child pornography. 3 The files, however, were not on the Mac Pro, but i nstead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed.
  - daxorid 9y ago
    > forensic analysts discovered the password to decrypt the Mac Pro Computer A little concerning. Does the FBI have an undisclosed FileVault backdoor?
    - Tuna-Fish 9y ago
      It's much more likely that he wrote it down somewhere.
    - eridius 9y ago
      From the PDF: > Despite Doe’s refusal, forensic analysts discovered the password to decrypt the Mac Pro Computer, but could not decrypt the external hard drives. So either the Mac Pro had a weak password or Doe had it written down somewhere. It's rather unlikely that the FBI has a zero-day for FileVault.
      - 9y ago
alethiophile 9y ago
This is interesting, because the case is clearly being structured (intentionally by the government, one presumes) to force the test case of "is compelled decryption legal" onto the most unsympathetic possible defendant. If the government "knows beyond doubt" that the encrypted drives have CP on them, then they have everything necessary to move forward with a trial without decrypting the drives at all. That satisfies society's legitimate interest in suppressing child porn, while also not trampling all over the legal right to use encryption. Choosing to structure the case in this way, with an appeal to the Supreme Court over a matter that's a technicality in the original case, clearly shows that the goal is to get a precedent for forced decryption, not merely to jail one child porn possessor.
- jo909 9y ago
  They don't "know beyond doubt" in an absolute sense. They know sure enough to make the encrypted drives content part of the trial in the first place, which is a determination the judge made himself and that wasn't challenged by the defense so far. At some point the main trial will continue, very probably without the decrypted drives. Then the defense will very very likely argue why the hashes aren't enough proof for possession of illegal files, and they will hear experts statements on the matter on both sides, other evidence for the possession etc. And then a _jury_ will make the judgement, with much more factors and on a very different standard of "beyond doubt".
  - eridius 9y ago
    They "know beyond doubt" that the drives at least used to contain CP, and most likely do now. It's possible that the CP was deleted at some point, and the only way to determine that would be to decrypt the drives.
    - dragonwriter 9y ago
      > They "know beyond doubt" that the drives at least used to contain CP If they even merely had sufficient evidence to know beyond a reasonable doubt, then they would have sufficient evidence for a trial conviction and the decryption would be a sideshow. Either they are lying about their knowledge (unnecessarily from a legal perspective, so probably for PR), or lying about needing the decryption for evidence, or telling the truth about both but the source of their knowledge is itself illegal evidence (and any evidence they collect based on that knowledge is fruit of the poisonous tree.)
Johnny555 9y ago
Prosecutors said Rawls has a lot of "chutzpah" to even ask to get out of jail while he appeals the contempt-of-court order to the Supreme Court, which has never decided whether forcing somebody to decrypt hardware amounted to a Fifth Amendment violation. He's being held in jail on a basis that may violate his constitutional rights, yet he is the one with chutzpah?
rufusroflpunch 9y ago
I feel like anyone with a functional brain can see this is a fifth amendment violation.
- seanhunter 9y ago
  Although I'm sympathetic with the side I think you're on, the legal issue at stake here is much more complex than you are giving credit for, and reasonable people can disagree about this. Courts have apparently found in the past that disclosing a physical key is not a 5th amendment violation whereas disclosing a code (eg the combination to a safe) is. The EFF is apparently of the mind that this is a violation. There's a decent writeup of a different case that raises the same issue here http://www.outsidethebeltway.com/the-fifth-amendment-privacy-and-computer-passwords/ http://www.outsidethebeltway.com/the-fifth-amendment-privacy...

90 points by sus_007 9y ago

If you can be jailed indefinitely for not decrypting a drive then can't you be jailed indefinitely for not remembering your password? That sounds fair.

drostie 9y ago
At the contempt hearing, you are allowed to testify that you do not remember your password, and it puts the burden of proof on the government to prove that you secretly remember your password and are lying to the court when you say that you don't. Of course if you do testify this and you are lying, then that's a perjury charge -- which means that for example if you have told your lawyer that you do remember your password, your lawyer cannot knowingly allow you to lie on the stand and could be disbarred etc. if you do. But assuming that you're not lying and so forth, you can just say "I can't comply with this court order because I don't remember the password" and that will suffice for your defense at your contempt hearing unless the government can meet a strong burden of proof that you secretly do know your password and are lying about it, which you are of course entitled to counterexamine and poke holes in. Rawls did not testify, at his contempt hearing, that he did not remember his password. He did not testify at all at that hearing. He said prior that he doesn't remember his password to the police, and he has said it afterwards to the media, and he might have even said it to a different judge in these weird follow-up hearings--but he didn't say it at the contempt hearing and as I understand it he didn't appeal this hearing directly to say "well shoot I didn't realize I was getting jailed on a technicality, let's re-do this hearing so that I can testify that I forgot it properly." There are many reasons that Rawls might not have testified; possibly he has a very good lawyer who is concerned about some bigger issues that Rawls might have to address if he testifies at all; possibly he has a very bad lawyer who did not know that this is how forgot-my-password law works and did not read the Supplemental Order the judge wrote explaining why Rawls is being held in contempt of court. I do not know why he did not testify this. However, testifying this is sufficient to be not held in contempt of court, unless the government can meet a stiff burden of proof that you are lying.
- charlesdm 9y ago
  > However, testifying this is sufficient to be not held in contempt of court, unless the government can meet a stiff burden of proof that you are lying. Which in essence is impossible in most cases, unless you are stupid enough to actually tell people that you refuse to decrypt the drive and those can then testify against you. It's all a matter of perception. It just shows how much a few words can matter a lot in a legal context, and how by saying you don't remember the password, you will walk, whereas by saying you won't give it up, you'll be held in contempt for 2+ years rotting away in a cell. Perhaps he could say he doesn't remember the password in a few years? "It's been years, it was a complex password containing a lot of characters, and I no longer know what the password is" -- that doesn't seem unreasonable.
- humanrebar 9y ago
  > At the contempt hearing, you are allowed to testify that you do not remember your password Isn't it the government's job to prove you remember it? Shouldn't the right to remain silent apply in contempt hearings as well?
  - jo909 9y ago
    You never have to make a statement to the police, and this is why it's part of the Miranda warning. There is no per se right to remain silent before a judge. The fifth amendment allows one to not be whitness against oneself, but that doesn't allow you to ignore the judge. And if you raise the fifth as a response and the court does not believe it applies, you get to argue why it does before another judge, which is where this man is now. A forgotten password is not part of the current debate.
  - drostie 9y ago
    It is the government's job to prove you remember it. They have the burden of persuading the court that you don't remember it. This is spelled out explicitly in the Supplemental Order issued by the judge, PDF freely available at: https://ia601303.us.archive.org/0/items/gov.uscourts.paed.507511/gov.uscourts.paed.507511.21.0.pdf https://ia601303.us.archive.org/0/items/gov.uscourts.paed.50... What is at stake is a burden of evidence production. The difference between production and persuasion, in a court room, is a distinction both of quantity and quality. You "produce" single pieces of evidence, whether weak or strong -- then the totality of all of the pieces of evidence, evaluated together according to their strengths, "persuades" the court. "Produce" is quality-agnostic and refers to single pieces of evidence; "persuade" or "prove" refers to all of the evidence on both sides and weighs them by their quality. And what's really at stake is that your lawyer, at a contempt hearing, cannot merely claim, "Well, your honor, the prosecution has not proven that my client is definitely able to fulfill the order, because they have not disproven every possible reason why my client could not fulfill the order." The reason that this is not enough is that it is asking the government to prove a negative, "you cannot possibly have any excuse." Instead the procedures that courts use to decide these cases require the defense to identify specific reasons why the defendant cannot fulfill the earlier order, and then the burden falls on the prosecution to prove that those specific reasons are BS. And for this purpose they need to produce some evidence -- it doesn't need to be strong, persuasive evidence -- that the defendant cannot fulfill the order for that reason. Because it does not have to be strong or persuasive, a statement of testimony is taken at face-value as sufficient. The only attack the government can make at the evidence-production level is "even if this evidence were 100% persuasive the defendant would still be able to decrypt the drives", so the evidence has to have some clear logical relation to the excuse. But obviously if your sworn testimony that you cannot decrypt the hard drives were 100% persuasive, you would not be able to. It's still the government's job to prove you remember it, but you need to produce some sort of pertinent evidence (no matter how flimsy) that you don't, so that the court even evaluates this defense in the first place.
TomK32 9y ago
plot twist: password is "I don't remember my password"
- philsnow 9y ago
  https://www.youtube.com/watch?v=bLE7zsJk4AI https://www.youtube.com/watch?v=bLE7zsJk4AI it was a fun day teaching my children the use-mention distinction https://en.wikipedia.org/wiki/Use%E2%80%93mention_distinction https://en.wikipedia.org/wiki/Use%E2%80%93mention_distinctio...
  - lathiat 9y ago
    Thanks for sharing that link, something I knew about but not by name :-) Also thumbs up for Rocket Jump In a related tangent when I setup the WiFi for the Perth Artifactory Hackerspace, I told everyone (via email) the password was on the back of the door. Which had a sign that said "KEEP DOOR CLOSED" :-) Fortunately the first person to try it, did figure it out.

crb002 9y ago

Confess regardless of guilt there was child abuse obscenity and forgot password. Then file lawsuit claiming confession was coerced.

imglorp 9y ago
Does being jailed for refusing to cooperate count as coercion?
- SomeStupidPoint 9y ago
  Isn't the exact point of jailing for refusing to cooperate coercion to cooperate? That's why there isn't a trial -- the judge is coercing you to obey him, you're not being punished for not.
- crb002 9y ago
  The fatal flaw here is that this guy lost over 90 days (I think that's the lower bound) of liberty without a jury trial. Under this scheme a judge could jail you until you produce the body in a suspected murder, or until you tell the cops where the money is in a suspected bank robbery. Contempt is a quasi-criminal remedy with severe limitations. SCOTUS will rule from this that contempt confinement for longer than 90 days requires jury fact finding.
  - seanhunter 9y ago
    Hmm. It's not true to say under this scheme a judge could jail you for not producing a body. This is more like a situation where the judge could jail you for not allowing people to search the spot where they suspect the body is (eg if you won't let police search your freezer). That's something they can in fact already do. That is to say, they have the right (assuming a warrant) to search where they want to search, and if there is a physical protection (eg a key) it isn't covered by 5th amendment and you have to cough it up. The 5th amendment doesn't bestow a right to prevent the collection of evidence in general. You could argue that this particular person wanted a jury trial they could easily have got that by disclosing the password and allowing decryption. That said, forcing disclosure of a password is particularly troubling. On its face it seems obvious that he is deliberately not doing that so as not to reveal the incriminating evidence (ie incriminate himself), which is why he is pleading the 5th amendment right not to be forced to do that.

kazinator 9y ago

What sort of lousy hard drive encryption reveals hash values of plaintext?

jotato 9y ago
I had the same thought.
jo909 9y ago
They have access to the OS drive, and found some logfile or metadata on there. http://www2.ca3.uscourts.gov/opinarch/153537p.pdf http://www2.ca3.uscourts.gov/opinarch/153537p.pdf Despite Doe’s refusal, f orensic analysts discovered the password to decrypt the Mac Pro Computer , but could not de crypt the external hard drives. [...] The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash ” values to be child pornography. 3 The files, however, were not on the Mac Pro, but i nstead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed.
- daxorid 9y ago
  > forensic analysts discovered the password to decrypt the Mac Pro Computer A little concerning. Does the FBI have an undisclosed FileVault backdoor?
  - Tuna-Fish 9y ago
    It's much more likely that he wrote it down somewhere.
  - eridius 9y ago
    From the PDF: > Despite Doe’s refusal, forensic analysts discovered the password to decrypt the Mac Pro Computer, but could not decrypt the external hard drives. So either the Mac Pro had a weak password or Doe had it written down somewhere. It's rather unlikely that the FBI has a zero-day for FileVault.
    - 9y ago

alethiophile 9y ago

This is interesting, because the case is clearly being structured (intentionally by the government, one presumes) to force the test case of "is compelled decryption legal" onto the most unsympathetic possible defendant. If the government "knows beyond doubt" that the encrypted drives have CP on them, then they have everything necessary to move forward with a trial without decrypting the drives at all. That satisfies society's legitimate interest in suppressing child porn, while also not trampling all over the legal right to use encryption. Choosing to structure the case in this way, with an appeal to the Supreme Court over a matter that's a technicality in the original case, clearly shows that the goal is to get a precedent for forced decryption, not merely to jail one child porn possessor.

jo909 9y ago
They don't "know beyond doubt" in an absolute sense. They know sure enough to make the encrypted drives content part of the trial in the first place, which is a determination the judge made himself and that wasn't challenged by the defense so far. At some point the main trial will continue, very probably without the decrypted drives. Then the defense will very very likely argue why the hashes aren't enough proof for possession of illegal files, and they will hear experts statements on the matter on both sides, other evidence for the possession etc. And then a _jury_ will make the judgement, with much more factors and on a very different standard of "beyond doubt".
- eridius 9y ago
  They "know beyond doubt" that the drives at least used to contain CP, and most likely do now. It's possible that the CP was deleted at some point, and the only way to determine that would be to decrypt the drives.
  - dragonwriter 9y ago
    > They "know beyond doubt" that the drives at least used to contain CP If they even merely had sufficient evidence to know beyond a reasonable doubt, then they would have sufficient evidence for a trial conviction and the decryption would be a sideshow. Either they are lying about their knowledge (unnecessarily from a legal perspective, so probably for PR), or lying about needing the decryption for evidence, or telling the truth about both but the source of their knowledge is itself illegal evidence (and any evidence they collect based on that knowledge is fruit of the poisonous tree.)

Johnny555 9y ago

Prosecutors said Rawls has a lot of "chutzpah" to even ask to get out of jail while he appeals the contempt-of-court order to the Supreme Court, which has never decided whether forcing somebody to decrypt hardware amounted to a Fifth Amendment violation. He's being held in jail on a basis that may violate his constitutional rights, yet he is the one with chutzpah?

rufusroflpunch 9y ago

I feel like anyone with a functional brain can see this is a fifth amendment violation.

seanhunter 9y ago
Although I'm sympathetic with the side I think you're on, the legal issue at stake here is much more complex than you are giving credit for, and reasonable people can disagree about this. Courts have apparently found in the past that disclosing a physical key is not a 5th amendment violation whereas disclosing a code (eg the combination to a safe) is. The EFF is apparently of the mind that this is a violation. There's a decent writeup of a different case that raises the same issue here http://www.outsidethebeltway.com/the-fifth-amendment-privacy-and-computer-passwords/ http://www.outsidethebeltway.com/the-fifth-amendment-privacy...