8 ms·

> And to be clear, a court in the US cannot force you to give up your passcode. That passcode exists in your head, and yours alone. It is your property, and won

> And to be clear, a court in the US cannot force you to give up your passcode. That passcode exists in your head, and yours alone. It is your property, and won’t be used to incriminate you or strong-arm access to your data unless you voluntarily give it up. While technically true this is false in practice. While they can't force you to provide your passcode they can force you to unlock your phone. Francis Rawls has been in prison for two years now over refusing to decrypt a hard drive.[1] The same principle applies to phones. If a judge finds you in contempt-of-court they can imprison you indefinitely. 1: https://arstechnica.com/tech-policy/2017/09/judge-wont-release-man-jailed-2-years-for-refusing-to-decrypt-drives/ https://arstechnica.com/tech-policy/2017/09/judge-wont-relea...

bodz 9y ago
To add more examples to this, Florida courts have also ruled that you can be imprisoned for not giving police access to your phone.[1] The "police can't force you to give up your passcode" misconception stems from a case in Virginia from 2014 [2], and while that may still be the case in Virginia, it does not mean you can just say "my phone is locked with a passcode, fuck off cop" in every other jurisdiction. 1: https://9to5mac.com/2017/06/01/fifth-amendement-passcodes-passwords-law/ https://9to5mac.com/2017/06/01/fifth-amendement-passcodes-pa... 2: https://9to5mac.com/2014/10/31/touch-id-police/ https://9to5mac.com/2014/10/31/touch-id-police/
- dheera 9y ago
  Hmm, I guess I could just not carry a phone. Or just have it factory reset every morning automatically and not put any personal data on it. I hardly store anything on my phone anyway and use it pretty rarely so it wouldn't make much difference. What a world we live in.
  - stephenr 9y ago
    > What a world we live in. s/world/country/ fixed that for you.
solomatov 9y ago
I think, at some point it gets to the Supreme court which will decide whether it's covered by the 5th amendment or not.
- blunte 9y ago
  Sucks to be in jail waiting for that process to play out, though. *edit typo!
- driverdan 9y ago
  It's likely Rawls' case will make it to the Supreme Court. Let's hope it's sooner rather than later.
- 19guid 9y ago
  The answer is probably no. Requiring a person to unlock a device is not prohibited by the Fifth Amendment simply because the device contains incriminating information that would otherwise be inaccessible to police. If the police have a valid warrant to search your safe, you are generally required to unlock it for them, even if the safe contains evidence that incriminates you. If you are issued a valid subpoena to produce certain documents in your possession, you are generally required to produce those documents, even if they incriminate you. Compelled decryption of hard drives is fundamentally no different. It is true that the act of unlocking the safe or producing those documents is itself testimonial in the sense that you are conveying the fact that you know the combination or possess those documents. But under the "foregone conclusion" doctrine, if the state already knows that implicit testimony, then it is not protected by the Fifth Amendment. It's obvious that Rawls knows the password to the drives. There are legitimate concerns about how search warrants should apply to electronic devices. However, these are Fourth Amendment issues, not Fifth Amendment ones. If you're interested, Orin Kerr from the Volokh Conspiracy has written several articles about compelled decryption, including with respect to this particular case [1, 2, 3]. 1: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/06/07/the-fifth-amendment-limits-on-forced-decryption-and-applying-the-foregone-conclusion-doctrine/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... 2: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/09/09/thoughts-on-the-third-circuits-decryption-and-self-incrimination-oral-argument/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... 3: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/03/20/third-circuit-doesnt-resolve-standard-for-forced-decryption-under-the-fifth-amendment/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...
chirau 9y ago
What if you just say you forgot the passcode?
- icelancer 9y ago
  Not necessarily clear, but Rawls did not use this defense. It should be effective but we are in unknown territory.
pcl 9y ago
> The same principle applies to phones. Do you have a reference for this?
ge96 9y ago
That's F'd isn't that same as Bitcoin private keys too. I suppose depends, criminal right thing is to help solve a crime or something I don't know. Seems similar to using VPN in China. Is it illegal to protect/use your privacy.
castis 9y ago
That man may still be in prison, but that drive is still encrypted. If you are unwilling to give something you know to someone, no amount of force can take it from you. Had that drive been encrypted using facial biometrics, they could have just knocked him out, glued his eyes open, and taken what they wanted. What works, and what has been deemed legal, as you probably already know, are not mutually exclusive.
- nimchimpsky 9y ago
  Which is torture, so they could do that until he tells them the passcode aswell.
  - castis 9y ago
    It's true that torturing a person is an effective way to change what that person wants. It doesn't always end with the torturer getting what they want, though.
- EGreg 9y ago
  Why do people assume that deniability results in more whacking? Technology can easily be used to encrypt a hard drive to reveal different things for different passwords. TrueCrypt does it. Plus you can have cryptographic keys stored with friends or beacons that signify you are safe. For example you hide files on your phone before a flight, and to unhide them you need your host's wifi at your destination. Until the friend or beacon gives the ok, you can either have your phone LOCKED or have all sorts of files that are encrypted and HIDDEN. The computer can be unlocked but won't show those files. Why isn't this technology widespread? YOU CANT WHACK EVERYONE!
  - tdb7893 9y ago
    This might not be a commonly held view but in my experience societal norms and values are the only thing really protecting us. If the police come after me and the courts don't stop them nothing will make a difference, even with the best cryptography all they would have to do is threaten my family and I would always unlock it. In my view technological protections of fundamental freedoms should only be temporary stopgaps for what essentially needs to be political solutions.
problems 9y ago
Fuck, that is absolutely nauseating. What's worse is that trustworthy deniable encryption - which would solve this - is practically non-existent now that TrueCrypt is gone.
- jFlatz 9y ago
  You can get this from VeraCrypt (https://www.veracrypt.fr/en/Home.html https://www.veracrypt.fr/en/Home.html)
  - problems 9y ago
    I got the impression that VeraCrypt was not being run very well and that the developers didn't have much security experience based on the audit report that came out. I didn't consider it a trustworthy project. Has anything changed that?
- nugget 9y ago
  Isn't TrueCrypt 7.1a still reliable?
  - problems 9y ago
    Yeah, it works well enough - some pain, have to deactivate it to do the major updates and such on Win10, but it does work.
- tedunangst 9y ago
  Eh... The prosecution claims, and the judge believes, that they have a list of files they expect to find on the drive. If he gives them a password and those files don't appear, the judge will conclude he gave them the wrong password, and he will stay put until the right password is produced.
  - taneq 9y ago
    So you mean, if he floats, he's a witch, and they burn him, and if he sinks, he's innocent but he drowns?
ajross 9y ago
> Francis Rawls has been in prison for two years now over refusing to decrypt a hard drive. People have got to stop martyrizing this guy. He's in jail because the prosecution got a fortuitous decision that says they can hold him as long as they want until he coughs up a password. They aren't fishing for evidence, nor have they used this trick on anyone else. If he went to trial on the evidence already in public, the guy would hang (metaphorically). There is no significant doubt in anyone's mind that this drive contains CP. But the principle is the important part you say? Sure. Make a principled argument. Don't cite this guy.
- trendia 9y ago
  > He's in jail because the prosecution got a fortuitous decision that says they can hold him as long as they want until he coughs up a password. You call it a fortuitous decision, I call it precedent.
- gervase 9y ago
  If it's been proven beyond a reasonable doubt that the drive contains CP, then why don't they just go to trial? It seems to me that they've intentionally chosen a morally-objectionable individual upon which to build a legal precedent, as anyone who speaks in his defense can have his crime thrown back in their face. We've heard a lot about these so-called "hashes" that prove the presence of CP. It's also pretty easy to make a probabilistic proof about the likelihood of a hash collision between two non-identical files. I would venture that if you can show mathematically that you're 99.9999999% certain that the files are CP, that would qualify for "beyond a reasonable doubt". It's incontrovertible that if he's committed the crime for which he's been accused, he should be jailed. If they've already proven that crime, then why isn't he already serving his sentence? Or does the prosecution's case rest upon this one piece of evidence, and if so, is he therefore required to testify against himself in order to avoid indefinite detention?
  - bodz 9y ago
    It's worth noting that despite the prosecutors saying "its a foregone conclusion", they have not actually even charged Reynolds with possession of child pornography. It seems to me that while their words say they already have proof, their actions say they don't have any.
yosito 9y ago
What if you legitimately don't know the password?
jv22222 9y ago
Perhaps there could be a way to instantly delete all iphone data with a voice command. Something like "siri delete my iphone code alpha nine x." Or even an undetectable command like "silly sausages" for example. Might that stop a judge from being able to send you to prison indefinitely?
- otp124 9y ago
  I would bet the judge would consider that destruction of evidence. Disclaimer: I never studied law
  - boobsbr 9y ago
    What if the authorities do not know what the self-erase command is? Like, inputting your password backwards, or adding 1 to every number. What if it only erases a certain file or partition, so the phone still contains some personal data, but it's like TrueCrypts's plausible deniability?

bodz 9y ago

To add more examples to this, Florida courts have also ruled that you can be imprisoned for not giving police access to your phone.[1] The "police can't force you to give up your passcode" misconception stems from a case in Virginia from 2014 [2], and while that may still be the case in Virginia, it does not mean you can just say "my phone is locked with a passcode, fuck off cop" in every other jurisdiction. 1: https://9to5mac.com/2017/06/01/fifth-amendement-passcodes-passwords-law/ https://9to5mac.com/2017/06/01/fifth-amendement-passcodes-pa... 2: https://9to5mac.com/2014/10/31/touch-id-police/ https://9to5mac.com/2014/10/31/touch-id-police/

dheera 9y ago
Hmm, I guess I could just not carry a phone. Or just have it factory reset every morning automatically and not put any personal data on it. I hardly store anything on my phone anyway and use it pretty rarely so it wouldn't make much difference. What a world we live in.
- stephenr 9y ago
  > What a world we live in. s/world/country/ fixed that for you.

solomatov 9y ago

I think, at some point it gets to the Supreme court which will decide whether it's covered by the 5th amendment or not.

blunte 9y ago
Sucks to be in jail waiting for that process to play out, though. *edit typo!
driverdan 9y ago
It's likely Rawls' case will make it to the Supreme Court. Let's hope it's sooner rather than later.
19guid 9y ago
The answer is probably no. Requiring a person to unlock a device is not prohibited by the Fifth Amendment simply because the device contains incriminating information that would otherwise be inaccessible to police. If the police have a valid warrant to search your safe, you are generally required to unlock it for them, even if the safe contains evidence that incriminates you. If you are issued a valid subpoena to produce certain documents in your possession, you are generally required to produce those documents, even if they incriminate you. Compelled decryption of hard drives is fundamentally no different. It is true that the act of unlocking the safe or producing those documents is itself testimonial in the sense that you are conveying the fact that you know the combination or possess those documents. But under the "foregone conclusion" doctrine, if the state already knows that implicit testimony, then it is not protected by the Fifth Amendment. It's obvious that Rawls knows the password to the drives. There are legitimate concerns about how search warrants should apply to electronic devices. However, these are Fourth Amendment issues, not Fifth Amendment ones. If you're interested, Orin Kerr from the Volokh Conspiracy has written several articles about compelled decryption, including with respect to this particular case [1, 2, 3]. 1: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/06/07/the-fifth-amendment-limits-on-forced-decryption-and-applying-the-foregone-conclusion-doctrine/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... 2: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/09/09/thoughts-on-the-third-circuits-decryption-and-self-incrimination-oral-argument/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... 3: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/03/20/third-circuit-doesnt-resolve-standard-for-forced-decryption-under-the-fifth-amendment/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

chirau 9y ago

What if you just say you forgot the passcode?

icelancer 9y ago
Not necessarily clear, but Rawls did not use this defense. It should be effective but we are in unknown territory.

pcl 9y ago

> The same principle applies to phones. Do you have a reference for this?

ge96 9y ago

That's F'd isn't that same as Bitcoin private keys too. I suppose depends, criminal right thing is to help solve a crime or something I don't know. Seems similar to using VPN in China. Is it illegal to protect/use your privacy.

castis 9y ago

That man may still be in prison, but that drive is still encrypted. If you are unwilling to give something you know to someone, no amount of force can take it from you. Had that drive been encrypted using facial biometrics, they could have just knocked him out, glued his eyes open, and taken what they wanted. What works, and what has been deemed legal, as you probably already know, are not mutually exclusive.

nimchimpsky 9y ago
Which is torture, so they could do that until he tells them the passcode aswell.
- castis 9y ago
  It's true that torturing a person is an effective way to change what that person wants. It doesn't always end with the torturer getting what they want, though.
EGreg 9y ago
Why do people assume that deniability results in more whacking? Technology can easily be used to encrypt a hard drive to reveal different things for different passwords. TrueCrypt does it. Plus you can have cryptographic keys stored with friends or beacons that signify you are safe. For example you hide files on your phone before a flight, and to unhide them you need your host's wifi at your destination. Until the friend or beacon gives the ok, you can either have your phone LOCKED or have all sorts of files that are encrypted and HIDDEN. The computer can be unlocked but won't show those files. Why isn't this technology widespread? YOU CANT WHACK EVERYONE!
- tdb7893 9y ago
  This might not be a commonly held view but in my experience societal norms and values are the only thing really protecting us. If the police come after me and the courts don't stop them nothing will make a difference, even with the best cryptography all they would have to do is threaten my family and I would always unlock it. In my view technological protections of fundamental freedoms should only be temporary stopgaps for what essentially needs to be political solutions.

problems 9y ago

Fuck, that is absolutely nauseating. What's worse is that trustworthy deniable encryption - which would solve this - is practically non-existent now that TrueCrypt is gone.

jFlatz 9y ago
You can get this from VeraCrypt (https://www.veracrypt.fr/en/Home.html https://www.veracrypt.fr/en/Home.html)
- problems 9y ago
  I got the impression that VeraCrypt was not being run very well and that the developers didn't have much security experience based on the audit report that came out. I didn't consider it a trustworthy project. Has anything changed that?
nugget 9y ago
Isn't TrueCrypt 7.1a still reliable?
- problems 9y ago
  Yeah, it works well enough - some pain, have to deactivate it to do the major updates and such on Win10, but it does work.
tedunangst 9y ago
Eh... The prosecution claims, and the judge believes, that they have a list of files they expect to find on the drive. If he gives them a password and those files don't appear, the judge will conclude he gave them the wrong password, and he will stay put until the right password is produced.
- taneq 9y ago
  So you mean, if he floats, he's a witch, and they burn him, and if he sinks, he's innocent but he drowns?

ajross 9y ago

> Francis Rawls has been in prison for two years now over refusing to decrypt a hard drive. People have got to stop martyrizing this guy. He's in jail because the prosecution got a fortuitous decision that says they can hold him as long as they want until he coughs up a password. They aren't fishing for evidence, nor have they used this trick on anyone else. If he went to trial on the evidence already in public, the guy would hang (metaphorically). There is no significant doubt in anyone's mind that this drive contains CP. But the principle is the important part you say? Sure. Make a principled argument. Don't cite this guy.

trendia 9y ago
> He's in jail because the prosecution got a fortuitous decision that says they can hold him as long as they want until he coughs up a password. You call it a fortuitous decision, I call it precedent.
gervase 9y ago
If it's been proven beyond a reasonable doubt that the drive contains CP, then why don't they just go to trial? It seems to me that they've intentionally chosen a morally-objectionable individual upon which to build a legal precedent, as anyone who speaks in his defense can have his crime thrown back in their face. We've heard a lot about these so-called "hashes" that prove the presence of CP. It's also pretty easy to make a probabilistic proof about the likelihood of a hash collision between two non-identical files. I would venture that if you can show mathematically that you're 99.9999999% certain that the files are CP, that would qualify for "beyond a reasonable doubt". It's incontrovertible that if he's committed the crime for which he's been accused, he should be jailed. If they've already proven that crime, then why isn't he already serving his sentence? Or does the prosecution's case rest upon this one piece of evidence, and if so, is he therefore required to testify against himself in order to avoid indefinite detention?
- bodz 9y ago
  It's worth noting that despite the prosecutors saying "its a foregone conclusion", they have not actually even charged Reynolds with possession of child pornography. It seems to me that while their words say they already have proof, their actions say they don't have any.

yosito 9y ago

What if you legitimately don't know the password?

jv22222 9y ago

Perhaps there could be a way to instantly delete all iphone data with a voice command. Something like "siri delete my iphone code alpha nine x." Or even an undetectable command like "silly sausages" for example. Might that stop a judge from being able to send you to prison indefinitely?

otp124 9y ago
I would bet the judge would consider that destruction of evidence. Disclaimer: I never studied law
- boobsbr 9y ago
  What if the authorities do not know what the self-erase command is? Like, inputting your password backwards, or adding 1 to every number. What if it only erases a certain file or partition, so the phone still contains some personal data, but it's like TrueCrypts's plausible deniability?