7 ms·

Remember the 5th Amendment applies to passwords. No law enforcement officer may EVER compel you to log in to a device with a password / pass code / unlock patt

by skrowl 9y ago

Remember the 5th Amendment applies to passwords. No law enforcement officer may EVER compel you to log in to a device with a password / pass code / unlock pattern, for any reason.

greensoap 9y ago
In other words, don't enable touch id or face unlock.
- cmsimike 9y ago
  on iOS anyway, you can enable face id/touch id but specifically disable it from being able to log into the phone with it. You can then use face/touch id for authentication in apps.
- komali2 9y ago
  I'm trying to find the article now, but I recall reading that in the USA it's a lawful order to have you unlock your phone with a thumbprint, but not to unlock with a PIN code. God knows why. Here: https://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-can-be-required-to-unlock-phone-with-fingerprint/ https://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-... Unsure about federal application, actually. We as country need to get our shit together regarding device privacy. You should need a warrant to look at a phone, laptop, whatever, with or without a password. The security of the device should be meaningless. As for me, I'm grateful that I have the resources to push back should this ever happen to me, jailtime or included. That's a luxury probably very few Americans can realistically afford (seeing as they can just throw you in jail for 48 hours).
  - saagarjha 9y ago
    > I recall reading that in the USA it's a lawful order to have you unlock your phone with a thumbprint, but not to unlock with a PIN code. God knows why. I believe the rationale was that they can't ask you to incriminate yourself (give up your passcode), but you don't have to say anything for them to force you to give your fingerprint.
    - skrowl 9y ago
      My understanding is that it stemmed from them being able to compel you to take your fingerprints. In the old days you'd put your fingers in ink then put them on paper so they could record your fingerprint. I guess a judge ruled that putting your thumb on your phone isn't substantially different than that. That said, you shouldn't ever rely solely on biometrics. In addition to the legal reason, an adversary could also unlock your phone if you were unconscious / etc using your thumb.
- r00fus 9y ago
  Or at any checkpoint, simply shut down your device (or click power button 5x). Then they can have it, but it requires a passcode that is protected by the 5th amendment.
  - saagarjha 9y ago
    On iPhone X, all you have to do is "squeeze" the phone, or press the side and volume buttons at the same time.
- deleted 9y ago
  [deleted]
neuland 9y ago
This is the way things should work. But, there was a widely reported case recently where a man accused of possessing child pornography has been held in jail for a long time [0]. From what I can tell, he's been in jail for contempt of court for nearly 2 and a half years! [0] https://arstechnica.com/tech-policy/2017/03/man-jailed-indefinitely-for-refusing-to-decrypt-hard-drives-loses-appeal/ https://arstechnica.com/tech-policy/2017/03/man-jailed-indef...
- deleted 9y ago
  [deleted]
- NegativeK 9y ago
  That's because the issue is more complicated than any absolute statements. One case decided that law enforcement can compel you to turn over documents that it knows you have possession of, regardless of where they exist. You're not testifying against yourself; you're turning over evidence. Another case has decided that they can't compel you to turn over a password so they can search for evidence.
  - neuland 9y ago
    That's true. Nothing is guaranteed. That's actually what I'm trying to say, too. Normally, 5A covers passwords. But it didn't in this case, because somehow the court was able to decide that this hard drive undeniably has CP on it. So, it's not incriminating yourself to decrypt something everyone already knows you have. That's kinda weird and concerning, depending on how they proved the hard drive's contents without decrypting it. I mean, if it's just someone saying "I saw it on his computer" then that's problematic in my opinion. Whereas if they have server logs, or logs from a different hard drive of his detailing the contents of the encrypted drive, or something more concrete than hearsay, I don't see an issue. Edit: I guess the issue is: why do they need the contents of the drive if they can already prove the contents of the drive enough to convict?
  - KMag 9y ago
    > can compel you to turn over documents that it knows you have possession of, The only way to positively know that one has possession of the documents in question is to read them. If they need someone's help to decrypt the documents, then they at best have a very strong suspicion/circumstantial evidence of possession. Even if they intercepted transmission of the documents in question, they don't know if the documents are still in possession or have been deleted until they've gotten the suspect to cooperate and decrypt all of the suspected documents. If one had a hidden encrypted partition filled only with copies of the U.S. bill of rights, and the government used sworn testimony of definite knowledge that the hidden partition contained contraband in order to force disclosure of decryption keys, what's the likelihood that a good lawyer could get enough damages out of the government to make it worthwhile to sit in detention for a month or two while things got sorted out?
AlexCoventry 9y ago
What's the latest case law on this? I thought it was still unsettled, and there were a lot of confusing edge cases. E.g. https://www.inc.com/will-yakowicz/smartphone-passwords-constitution-yesjulz-extortion.html https://www.inc.com/will-yakowicz/smartphone-passwords-const...

by skrowl 9y ago

Remember the 5th Amendment applies to passwords. No law enforcement officer may EVER compel you to log in to a device with a password / pass code / unlock pattern, for any reason.

greensoap 9y ago

In other words, don't enable touch id or face unlock.

cmsimike 9y ago
on iOS anyway, you can enable face id/touch id but specifically disable it from being able to log into the phone with it. You can then use face/touch id for authentication in apps.
komali2 9y ago
I'm trying to find the article now, but I recall reading that in the USA it's a lawful order to have you unlock your phone with a thumbprint, but not to unlock with a PIN code. God knows why. Here: https://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-can-be-required-to-unlock-phone-with-fingerprint/ https://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-... Unsure about federal application, actually. We as country need to get our shit together regarding device privacy. You should need a warrant to look at a phone, laptop, whatever, with or without a password. The security of the device should be meaningless. As for me, I'm grateful that I have the resources to push back should this ever happen to me, jailtime or included. That's a luxury probably very few Americans can realistically afford (seeing as they can just throw you in jail for 48 hours).
- saagarjha 9y ago
  > I recall reading that in the USA it's a lawful order to have you unlock your phone with a thumbprint, but not to unlock with a PIN code. God knows why. I believe the rationale was that they can't ask you to incriminate yourself (give up your passcode), but you don't have to say anything for them to force you to give your fingerprint.
  - skrowl 9y ago
    My understanding is that it stemmed from them being able to compel you to take your fingerprints. In the old days you'd put your fingers in ink then put them on paper so they could record your fingerprint. I guess a judge ruled that putting your thumb on your phone isn't substantially different than that. That said, you shouldn't ever rely solely on biometrics. In addition to the legal reason, an adversary could also unlock your phone if you were unconscious / etc using your thumb.
r00fus 9y ago
Or at any checkpoint, simply shut down your device (or click power button 5x). Then they can have it, but it requires a passcode that is protected by the 5th amendment.
- saagarjha 9y ago
  On iPhone X, all you have to do is "squeeze" the phone, or press the side and volume buttons at the same time.
deleted 9y ago
[deleted]

neuland 9y ago

This is the way things should work. But, there was a widely reported case recently where a man accused of possessing child pornography has been held in jail for a long time [0]. From what I can tell, he's been in jail for contempt of court for nearly 2 and a half years! [0] https://arstechnica.com/tech-policy/2017/03/man-jailed-indefinitely-for-refusing-to-decrypt-hard-drives-loses-appeal/ https://arstechnica.com/tech-policy/2017/03/man-jailed-indef...

deleted 9y ago
[deleted]
NegativeK 9y ago
That's because the issue is more complicated than any absolute statements. One case decided that law enforcement can compel you to turn over documents that it knows you have possession of, regardless of where they exist. You're not testifying against yourself; you're turning over evidence. Another case has decided that they can't compel you to turn over a password so they can search for evidence.
- neuland 9y ago
  That's true. Nothing is guaranteed. That's actually what I'm trying to say, too. Normally, 5A covers passwords. But it didn't in this case, because somehow the court was able to decide that this hard drive undeniably has CP on it. So, it's not incriminating yourself to decrypt something everyone already knows you have. That's kinda weird and concerning, depending on how they proved the hard drive's contents without decrypting it. I mean, if it's just someone saying "I saw it on his computer" then that's problematic in my opinion. Whereas if they have server logs, or logs from a different hard drive of his detailing the contents of the encrypted drive, or something more concrete than hearsay, I don't see an issue. Edit: I guess the issue is: why do they need the contents of the drive if they can already prove the contents of the drive enough to convict?
- KMag 9y ago
  > can compel you to turn over documents that it knows you have possession of, The only way to positively know that one has possession of the documents in question is to read them. If they need someone's help to decrypt the documents, then they at best have a very strong suspicion/circumstantial evidence of possession. Even if they intercepted transmission of the documents in question, they don't know if the documents are still in possession or have been deleted until they've gotten the suspect to cooperate and decrypt all of the suspected documents. If one had a hidden encrypted partition filled only with copies of the U.S. bill of rights, and the government used sworn testimony of definite knowledge that the hidden partition contained contraband in order to force disclosure of decryption keys, what's the likelihood that a good lawyer could get enough damages out of the government to make it worthwhile to sit in detention for a month or two while things got sorted out?

AlexCoventry 9y ago

What's the latest case law on this? I thought it was still unsettled, and there were a lot of confusing edge cases. E.g. https://www.inc.com/will-yakowicz/smartphone-passwords-constitution-yesjulz-extortion.html https://www.inc.com/will-yakowicz/smartphone-passwords-const...