25 ms·

Man jailed over computer password refusal

271 points by alexandros 16y ago

ryanwaggoner 16y ago
Just thought of a feature idea for TrueCrypt and other similar packages: encrypted files or partitions can have multiple passwords, which reveal different things. So you could have a password that reveals something embarrassing but not incriminating. If the police or border nazis threaten you with prosecution unless you reveal your password, you give them this one. Meanwhile, you hide anything really confidential behind a password that you never give out. Or maybe they already have this?
- tynan 16y ago
  They already have this, It's called plausible deniability. What are the laws in the US on this?
  - pilom 16y ago
    In the US the current rules for personal hard drives are bound by the 5th amendment which has been interpreted as "a reasonable expectation for privacy." What happens is the police say "Give us your password and we'll drop whatever sentence by 75% for helping the investigation." You don't have to give your password but the NSA works pretty extensively with law enforcement and the FBI (most US cases that require password cracks are federal cases but thats a separate issue). Anything that ever touches an ISP is a totally separate issue though. In that case, in the US, any information stored by an ISP can be retrieved without a warrant 6 months (I'd need to confirm its not 120 days) after the incident. Those cases fall under the interpretation of a message overheard. In 5th Amendment cases, if you say a message in a crowded room, you don't have a reasonable expectation of privacy and this is how any message on the internet is interpreted legally. There was also a court case this spring where the DoD sued an ISP to give over IP addresses sooner than the 6 month (120 days?) limit (anyone got a link?). The DoD dropped the case though.
    - jrockway 16y ago
      Do you think the NSA is going to reveal to foreign governments that they've broken AES by going after some guy with child porn on his laptop? I personally doubt it. Could the NSA cooperate with the FBI? Yes. Will they? Not if it means they can't spy on Russia anymore.
      - alextgordon 16y ago
        "Breaking AES" is not at all necessary. All it takes is one implementation hole, or some plaintext unknowingly cached by a program. The NSA don't merely employ scores of cryptanalysts to sit around all day to try to break ciphers (though I expect they do this too). Exploiting mistakes is their bread and butter.
        jrockway 16y ago
        And "hey guys, stop using that broken software" is not what they want to tell the people they are spying on. Can anyone name one case where the NSA has ever testified for the prosecution?
      - pilom 16y ago
        It has nothing to do with holes in AES, NSA just has better brute force capabilities than the FBI or any other law enforcement. And while you sit in jail awaiting trial, they take the months it takes to brute force a key.
      - rdtsc 16y ago
        They could just provide the password without divulging how they did it. The best way would be for them to get the drive, if they crack the password, and the password looks like it could have been guessed or generated from some contextual info about the subject or the case, then they return it the police. If they do crack it but the password is actually a random string and disclosing it would betray NSA's abilities, they they simply refuse to disclose it. On the other hand maybe it would be better to create disinformation that they have cracked all kinds of ciphers or at least their popular implementations? Maybe it will lead enemies to try to implement their own or use alternate implementations that are actually less secure. This will be similar to Airforce's disinformation related to captured UFO tech in the 50s and 60s...
- digitallogic 16y ago
  TrueCrypt already has this feature: http://www.truecrypt.org/hiddenvolume http://www.truecrypt.org/hiddenvolume
  - ryanwaggoner 16y ago
    Ah well...at least I thought of something worth doing :)
    - edanm 16y ago
      More people should learn from this attitude. This is what I say every time I have an idea, and I later found out someone already built a startup around it (happens quite a lot, since I spend half my waking time thinking of startups).
      - InclinedPlane 16y ago
        Indeed. It means you possibly have a head for good ideas. You should be far, far more worried if nobody else has beaten you to the punch on any of your ideas, because that would tend to indicate that your ideas are either impractical or of low quality.
  - omh 16y ago
    Presumably the UK police are aware of this feature, which could lead to a more interesting situation when you can't prove that you've really unlocked to the deepest level.
    - ryanwaggoner 16y ago
      Seems like you're giving the police a lot of credit, but maybe not. Regardless, there's really no way to prove anything either way, is there?
      - dagw 16y ago
        I've met a couple of people who actually deal with computer forensics for the police and they are seriously smart people and totally on top of their game. So while you're average cop might not understand the details, they have forensics guy who certainly do. As to proving anything, my understanding is that it is theoretically impossible to prove, but sometimes bugs in the implementation or various user mistakes mean that you can, in practice, sometimes get a good indication that something is hidden,
- kiba 16y ago
  The police will just beat you up until the secret come out. They're not going to say "Drats! Our evil plans are foiled!" http://xkcd.com/538/ http://xkcd.com/538/
  - camiller 16y ago
    nah, the police can't torture you for your password. Only the evil criminals can do that. The courts can incarcerate you for not revealing a password, it's is up to you the criminal to decide if the punishment for not revealing the password is more/less severe than the punishment for whatever crime your hiding the evidence of with the password. Edit: OK now I have found evidence to prove myself wrong. At some point in the past I though I had read of a court case where a judge ruled that a defendant had to reveal a password. But a more recent case says otherwise: http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encrypted-laptop-child-porn_N.htm http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encr...
    - rdtsc 16y ago
      > Only the evil criminals can do that. Depending on the country, the symmetric set difference between the police and "evil criminals" is quite small. And even then when the police can't torture your officially, they can have ways of torturing you un-officially. They can lock you up with a group of gang members who are on the un-official "payroll" of the police. They rape and torture you until you reveal the password. The case in the media will come out as "my cellmate confessed in a moment of weakness and here is the password".
      - nandemo 16y ago
        It's even easier than that. You don't need actual torture to extract confessions: Pressed by Police, Even Innocent Confess in Japan http://www.nytimes.com/2007/05/11/world/asia/11japan.html http://www.nytimes.com/2007/05/11/world/asia/11japan.html Also: Japan is unique among democratic countries in that confessions are obtained from 95% of all people arrested, and that its courts convict 99.9% of all the suspects brought before them. (...) It is how the police obtain these confessions that troubles human-rights activists. A suspect can be held for 48 hours without legal counsel or contact with the outside world. After that, he or she is turned over to the public prosecutor for another 24 hours of grilling. A judge can then grant a further ten days of detention, which can be renewed for another ten days. http://www.debito.org/?p=217 http://www.debito.org/?p=217
metal 16y ago
They already have this. You can have two levels of passwords: one for the OS and one for a hidden encrypted partition or encrypted file where you keep your truly sensitive info.
squidbot 16y ago
It occurs to me that since this part of a child pornography investigation, 16 weeks in jail for not giving them a password might actually be a far lighter sentence than if the key was provided and illicit material was found. I don't condone the porn, but it does seem like a logical trade-off.
- deleted 16y ago
  [deleted]
- BillGoatse 16y ago
  Wait until they ask him again, 16 weeks from now...
  - dc2k08 16y ago
    Can you be tried for the same crime twice?
    - kscaldef 16y ago
      You can certainly be tried for the same crime twice. You can't be tried twice for the same criminal act. Arguably, if they ask him again after doing his 16 weeks, it's a new action if he refuses to comply.
      - TheCondor 16y ago
        It's not a trial. It's refusal or follow a court issued order, the punishment is contempt of court. They don't need a trial in that case... the judge that issues the order can simply judge whether or not you're complying with it. In all these scenarios, you're screwed the moment you find yourself in court (actually probably long before then when you convince some law enforcer that you're doing something wrong) Judges and lawyers aren't going to be hip to this hypothetical plausible deniability game. A drive isn't an extension of your brain or your relationship with your wife. It's physical evidence. The only thing that makes it different than say a really big lock on the door of your house or a safe is the effort it takes to circumvent when a court agrees to admit the evidence. Almost never is that evidence used alone. There are subtle issues to the meaning of the evidence provided, like you might not need to give up the password and thus decrypt everything else encrypted with it, you might just need to decrypt the data in question in a convincing manner to the court. Being able to decrypt the drive doesn't have to prove that you are responsible for the contents.
malandrew 16y ago
This Star Wars quote seems appropriate here, especially given the hidden volume feature of TrueCrypt: Princess Leia: "The more you tighten your grip, Tarkin, the more star systems will slip through your fingers."
varjag 16y ago
It's the modern alternative to pulling fingernails.
xenophanes 16y ago
I realize this story is in the UK, but could it happen in the US or would the 5th amendment protect you? As an American, it seems a bit insane to me for someone to be jailed for refusing to help convict himself.
- moxiemk1 16y ago
  I thought remembered a court precedent in the US that ruled being compelled to divulge encryption keys was equivalent to being compelled to hand over keys to locked places (like a safe), which is historically required. That said, I can't find such an article, so hopefully I'm making it up and we are indeed safe in our minds.
  - camiller 16y ago
    I thought that also but then found this from 2008: http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encrypted-laptop-child-porn_N.htm http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encr...
  - Anechoic 16y ago
    There's United States v. Boucher but case had a couple of wrinkles, including the fact that Boucher had previously cooperated with law enforcement so it was thought that providing a password wasn't self-imcrimination since it wouldn't add to the knowledge of what the authorities already had: http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki/United_States_v._Boucher
  - pilom 16y ago
    No legally in the US you are not required to give the keys to the safe, but they can drop your sentence significantly for working with the investigators. For a safe, if you don't give them the key, the get a grinder and hack saw, for an encrypted hard drive in the US they give it to the NSA (though 50 chars would be tough for even them i'd expect).
    - pyre 16y ago
jason_slack 16y ago
Can anyone explain how TrueCrypt works for OS X? Could I have my entire home directory on the hidden partition? What about their hidden operating system feature? So I can have my normal OS as the decoy OS and then have a hidden Linux OS (as example) that I use for sys adm type stuff and boot to it when I need to? Can VMWare or Parallels see this partition and create a VM based on it?
- Groxx 16y ago
  Essentially, you can't true-crypt anything that can't run TrueCrypt before you need access to it. So you wouldn't be able to run TC and enter your password prior to logging in, which requires your home directory. Perhaps this could be sidestepped, but I'd think it'd be a mega-hack unless you can boot to a USB drive which can decrypt things and then boot OSX. I haven't heard of anyone doing that though, probably because Macs are a bit different with their bootup. You're essentially stuck making a file-as-a-volume or a hidden partition, though I don't know how / how well hidden partitions work in OSX. Once your file / hidden partition is mounted, it's just another mounted volume. Anything which can read / write to a volume it's not on shouldn't notice a thing. Also, it looks like it might just be Windows which gets the hidden-OS capability, as it requires a TC boot-loader on-disk or on an external booting device. Which means it should be possible for others as well, but it sounds like they haven't done it yet. http://www.truecrypt.org/docs/?s=hidden-operating-system http://www.truecrypt.org/docs/?s=hidden-operating-system
- elai 16y ago
  Truecrypt doesn't work, but you have the FileVault feature built into OSX and PGP whole disk encryption: http://paulstamatiou.com/review-pgp-whole-disk-encryption-for-mac-os-x http://paulstamatiou.com/review-pgp-whole-disk-encryption-fo...
ck2 16y ago
In the USA can you be compelled to testify against yourself by being coerced into giving a password to law enforcement? Has this been tested yet, out of curiosity? I remember reading they can deny you entry/exit to the USA if customs can't read your laptop but never heard anything like local/FBI. If not, I hope it doesn't go before this particular supreme court.
- camiller 16y ago
  Apparently not, although I though I had read of an earlier case where there was a judge that ruled that a password had to be revealed. http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encrypted-laptop-child-porn_N.htm http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encr...
  - ck2 16y ago
    Yeah that's the border - slightly different, though they also set up border checks hundreds of miles "inland" around the country which makes their intentions suspect. What I hate about all these cases is it comes down to child porn which makes it impossible to defend. Why can't it be something mundane that actually shows why this is a REALLY bad idea. I just saw a scary university lecture on youtube on why you should NEVER talk to to the police, even to "explain things", even if you know you are 1000% not guilty of whatever they are after. So now it makes perfect sense to me that if they want to go trolling across your hard drive, they are doing exactly that - you are testifying against yourself for whatever charges they want to invent afterwards.
  - evgen 16y ago
    In the US there are conflicting precedents at the moment, so it really depends on where the case is being heard. At the moment the case that seems to have the strongest route to the Supremes is the one involving child porn at the border, allowing the court to address both the "are passwords protected" question and the legality of laptop border searches. Unfortunately for the cyberliberty crowd this particular case is the last one they want to see before the court, the facts are not good and it provides an easy excuse for a "law and order" majority on the court to significantly extend the government's reach.
awakeasleep 16y ago
As great as hidden volumes are, traces showing the inconsistency between the fake and real volume will be left on your system unless you take heroic measures to erase them. Things like logs of all the external drives you connect, and links to recently opened files.
- CGamesPlay 16y ago
  Your entire operating system can be a hidden volume. I don't know how "heroic" this is.
- ciupicri 16y ago
  Regarding recently opened files, you can always say that you deleted them.
fbcocq 16y ago
I've been resetting people's 8 character passwords lost due to Post-Vacation-Insomnia for ages, I'd really like to see them expect me to remember a 50 character password under stress conditions.
- brettmjohnson 16y ago
  I have a 12 character password and it is a pain in the ass to type it several times a day. I couldn't imagine using a 50 character password.
  - voxxit 16y ago
    It is probably just a concatenated string of his credit card number or social security number and random words. I wonder if they are currently trying to crack it using some kind of dictionary brute force mechanism, or if there is some kind of lock out enabled after five tries.
    - aidenn0 16y ago
      If they have physical access, then there is no effective lock-out mechanism. Presumably they can determine which encryption software is used, and can use the algorithm as many times as they want.
  - ataggart 16y ago
    One way to have long, but memorable passwords is to construct them using the first letter of each word a rather long, but memorable quote/phrase. E.g., The opening of the Gettysburg Address yields: fsasyaofbfutcannciladttptamwce. And if you forget the exact words, you can always look them up.
- swolchok 16y ago
  Did you mean: Post-Vacation-Amnesia?
  - fbcocq 16y ago
vic_nyc 16y ago
I wonder why he didn't say he "forgot the password". Although it may seem implausible, how could they prove it's not true?
- omh 16y ago
  I think that the law is worded so that it's an offence to have encrypted files and not be able to decrypt them. Whether it's deliberate or just forgotten isn't relevant (though I'd hope it would make a difference in sentencing).
  - points 16y ago
    How can you even prove that a file is encrypted? The whole law is baloney.
    - 16s 16y ago
      Use TrueCrypt to do whole disk encryption on your Windows XP hard drive. Then boot your computer with a Linux Live CD and dd the first 512 bytes to stdout. This is what you'll see in plain text ASCII: "TrueCrypt Boot Loader" No expert is needed to prove that you are using TrueCrypt whole disk encryption. It has a huge stamp right up front.
      - barrkel 16y ago
        That's certainly true for that particular instance, in that particular implementation. But it's not necessarily the case. Take some random file and encrypt it with gpg; there's nothing obvious in the contents to mark it out as encrypted data.
        16s 16y ago
        tom@ubuntu:~$ gpg -c flag.png tom@ubuntu:~$ gpg -v --list-packets flag.png.gpg :symkey enc packet: version 4, cipher 3, s2k 3, hash 2 salt eae60ad4255dc4e2, count 65536 (96) gpg: CAST5 encrypted data OpenPGP encrypted data is easy to find too. It even tells you the algo used. The example is symmetrically encrypted, but it works the same with asymmetric keys. Even shows who it is encrypted for. Edit: formatting.
gunmetal 16y ago
"It sends a robust message out to those intent on trying to mask their online criminal activities that they will be taken before the courts with the ultimate sanction, as in this case, being a custodial sentence." seems like a good reason to have "innocent until proven guilty". drive could contain anything, or nothing.
NathanKP 16y ago
It seems like a bad idea to store anything incriminating on your local hard drive. Why not keep your encrypted files on a flash drive? If the police show up destroy the flash drive using a hammer, ensuring that the flash memory chip is thoroughly pulverized and completely unreadable. Likewise, if you are going to be using the internet for devious purposes drive around and use a neighbor's open wireless network access point, which highly reduces the chances that anything can be traced back to you. Or set up your own unsecured wireless network point and suggest to officers that illegal use came from an outside source. Not that I want to condone illegal activities, or condone lying to police officers, but to the hacker in me these seem like simple, sensible steps to take that will be more dependable than even a 50 character password.
- tjarratt 16y ago
  I understand that in some areas, not only is it illegal to operate an insecure wireless access point (in the UK at least), you can be held accountable for the actions of people that use the access point.
  - deleted 16y ago
    [deleted]
  - Delts 16y ago
    Unless I'm mistaken you can currently still operate an unsecured access point in the UK. The legislation was originally part of the Digital Economy Act however I can't spot anything expressly forbidding operating one.
  - sswam 16y ago
    that's amusing, considering that every wireless access point is insecure
    - elai 16y ago
      WPA2 with authentication or WPA2 with a 64-character line-noise password?
- 16y ago
boredguy8 16y ago
Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. So, for instance, say you had encrypted files of plans to build a bomb and detailed schematics of the White House. The judge can order you to decrypt the files without forcing you to reveal that the password was "K1llt3hPr3zn0w!" As a practical matter, I've wondered what would happen if someone simply claimed they couldn't remember the password. Especially if one could make it look like the encrypted files hadn't been accessed in over a year. TrueCrypt's Plausible Deniability (http://www.truecrypt.org/docs/?s=plausible-deniability http://www.truecrypt.org/docs/?s=plausible-deniability) makes these issues even more complicated. But yeah: by simply refusing, you'd be thrown in jail for contempt and your only way out would be appellate review of the order. You'd have to challenge the contempt citation on the basis that the original order was unlawful.
- jemfinch 16y ago
  Can you provide some citations for your claims here? I'd really like to review them.
  - deleted 16y ago
    [deleted]
  - alextgordon 16y ago
    Wikipedia has this to say: http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki/United_States_v._Boucher On February 19, 2009, Judge Sessions reversed the magistrate's ruling and directed Boucher "to provide an unencrypted version of the Z drive viewed by the ICE agent.
    - kgo 16y ago
      That case was goofy because he initially typed in his password in front of law enforcement and provided them access, which nullified any claims of self incrimination. It'd be similar to confessing to murder, telling the cops where the body is, and then invoking your right to remain silent, and expecting them not to look for the body under "fruit of the poisonous tree" logic.
eiji 16y ago
"50-character encryption password" - nice! I'm wondering ... Person A refuses for - pure principle (and maybe some ripped DvD's) Person B refuses for - let's say child pornography and a dirty bomb manual Both will get the same jail time?
- araneae 16y ago
  There are other legitimate reasons to not want to reveal the contents of your hard-drive besides principle or self incrimination. For instance, if you had the private information of any other people. My SO works with HIV, and recently got access to sensitive data that had to be sent on DVD via courier. Who here trusts the police to not disclose their HIV status?
  - aperiodic 16y ago
    Disclaimer: IANAL If you're in the Unites States, the data is probably protected by HIPAA, the Health Insurance Portability and Accountability Act[1]. HIPAA includes a clause stating that the Attorney General or their designee may issue a subpoena compelling your SO to disclose that information, but only to someone investigating a Federal health care offense. I've searched through the rest of HIPAA for keywords such as "law enforcement", "criminal", and "disclosure", but I couldn't find anything about being compelled to disclose HIPAA-protected information to law enforcement in any other circumstance than investigation of a Federal health care offense. However, I did not thoroughly read HIPAA, and there might be something in another section of the US Code that's relevant. Hopefully someone more knowledgeable about this can let me know if I've missed something. [1]: http://www.legalarchiver.org/hipaa.htm http://www.legalarchiver.org/hipaa.htm
    - araneae 16y ago
      Yup, that's the case. The question is whether or your hard drive is protected from a criminal charges subpoena. The data is kept encrypted on the hard drive, but of course the authorities don't know what's on the hard drive until it's decrypted.
deleted 16y ago
[deleted]
- jrockway 16y ago
  Absolutely. I think this is a great win for crypto; this guy is truly free from the prying eyes of the government. It's good for society, too -- instead of convicting someone based on evidence on the guy's own computer (bringing into question context, chain of custody issues, and so on), the cops will have to build a solid case to convict him. When the police are forced to cross their ts and dot their is, society wins. So I see this as good for everyone, even the children he may be abusing. They will get a fair trial that leaves no question about this guy's guilt. (If he is really guilty, of course.)
omh 16y ago
This has happened before, although the details aren't clear. It was reported last year (http://www.theregister.co.uk/2009/08/11/ripa_iii_figures/ http://www.theregister.co.uk/2009/08/11/ripa_iii_figures/) that two people had been convicted for similar offences. It seems that most people don't comply, but not all of them are charged: "Of the 15 individuals served, 11 did not comply with the notices. Of the 11, seven were charged and two convicted."
thedjpetersen 16y ago
If they are unable to crack the pass code, does he go free on lack of evidence?
- pyre 16y ago
  I imagine so seeing as they gave him a finite sentence. Presumably he'll never get his equipment back though.
- yardie 16y ago
  If they base the case entirely on one piece of evidence than they have already lost. Through programs like CSI, people are convinced that most of the evidence for a case comes from a lab and all they need is that one piece of evidence. What really happens is the investigators have to answer the 5-Ws (who,what,etc) and they "build" a case against you. If they have one piece, then they can go fishing for the rest. This is why it's important to shut your month when talking to the police. Anything you say at this point can really open you up to all types of crap later. They'll twist your words around, become your friend, good cop/bad cop, mention friends and family and all other types of tricks to get you to talk. Believe it or not, criminals willingly give up testimony about themselves. Some guy in a lab with half a shoeprint isn't what wins the case, you do. If all the prosecution has is one piece of evidence then a competent barrister can shred it to pieces. This guy's job is to create FUD, and lots of it. The less evidence the prosecution has the easier his job is. But what he/she can't do is fix anything you say in front of the police while he isn't there. This is why it's important to shut up and ask a lawyer first.
eof 16y ago
How do they know it's a 50 character password?
- tyree731 16y ago
  He probably volunteered that information.
  - eof 16y ago
    Seems a silly thing to offer
- tyree731 16y ago
  He probably volunteered that information.
mathgladiator 16y ago
In the US, how does the fifth amendment work in this type of issue? If he complies, then he is testifying against himself.
mirkules 16y ago
Would it be possible to have one password for accessing the system, and a separate password for permanently wiping sensitive parts (in the background, even)? What would be the legal implications (other than the obvious obstruction of justice charges if the authorities catch on)?
- CGamesPlay 16y ago
  The problem there is that any evidence should have been copied and should be accessed from a read-only media at that point.
bl4k 16y ago
I am surprised that they didn't keylog his machine - as having a warrant to search/seize means a warrant to keylog probably could have been obtained. The police will learn from this and avoid these 'oh dammit' moments by just keylogging everybody from now (or at least those suspected of having encrypted volumes). Keylogging is the one real weakness of all the TrueCrypt/other encryption schemes (that and your password is in memory in the clear while the volume is mounted, and even afterwards depending on your settings).
- gregable 16y ago
  Could you defeat that somehow by having rotating keys?
  - ElliotH 16y ago
    Wouldn't that take a very long time to re-encrypt a whole drive with a new key?
    - SapphireSun 16y ago
      Use two drives and have them switch over every night.
    - kd5bjo 16y ago
      You wouldn't re-encrypt the whole drive; usually, the master key is stored in the first few sectors of the disk, encrypted with the login key. That way, you only have to re-encrypt a small amount of data to effectively change the entire disk's key.
- weavejester 16y ago
  Adding a keylogger (presumably hardware) is not without its risks. If the suspect discovers it, they have a window of opportunity to cover their tracks.
mattm 16y ago
A friend of mine flew back home to Canada. After clearing customs, he was one of the random people chosen to have their luggage inspected. He had his laptop on him and the customs agent booted up the computer, asked him to enter his password and then took his laptop away before bringing it back without telling him anything about it. I wondered what would have happened if he refused to type in the password.
- nkassis 16y ago
  I've been wondering about this for a while, my current idea is to wipe my computer before every trip. I keep a backup on a desktop computer that I access to while away. If this happened while coming back to canada, I'd probably still argue and see what I can do. Not sure if I'd go all the way to letting them take my laptop away for ever. They can't refuse to let you back into the country so.. at least on that point you are safe.
- Deestan 16y ago
  Customs aren't law enforcement, they just like to think so. The request to enter a password should be treated as a impolite request, which you should politely deny.
  - GBond 16y ago
    Not sure why your were upvoted (probably for the sentiment that freely entering one's password without reason should not happen) because that is not correct. In the US, "customs" typically refer to ICE and TSA, both are enforcement functions of the United States Department of Homeland Security.
    - Deestan 16y ago
      checking facts... You are correct. I incorrectly assumed they were equivalent to UK and Norwegian customs, where customs and border protection are separate entities.
iuguy 16y ago
It's about time this happened. In the UK we have a law called the Regulation of Investigatory Powers Act (RIPA) which allows access to certain data held by ISPs or can compel people in certain cases to not only hand over encryption material but prohibits them from acknowledging that they had been charged under such a law. As you can imagine, that last bit results in some very complicated situations. The laws governing paedophilia are quite different, with paedophiles having to sign a sex offenders register. In the case of a sex offender being caught, it's easier to just take the RIPA sentence instead. This is what appears to have happened. I hope the guy's password is long enough otherwise regardless of his crime he's in for a world of pain.
rwmj 16y ago
Not the first one: http://www.theregister.co.uk/2009/11/24/ripa_jfl/ http://www.theregister.co.uk/2009/11/24/ripa_jfl/
abalashov 16y ago
I am not sure I understand the basis on which this person was jailed. If the court order to search his computer was provided on the basis of probable cause, what was that probable cause? If law enforcement already had evidence of some kind of misdeed, why do they need access to his computer? If the evidence of his misdeeds is on the computer, wouldn't providing it be a) self-incrimination of some description, as mentioned extensively elsewhere here and b) law enforcement's inability to get access to the information get the case dismissed due to lack of evidence?
loewenskind 16y ago
It sounds to me like TrueCrypt needs a new feature: a password that just destroys all data.
- cracki 16y ago
  would be fast too. just zap the headers.
nervechannel 16y ago
Steganography.
confuzatron 16y ago
If the Police have a warrant to search a safe, presumably you can be required to hand over the combination or be in contempt of court. Even if the combination for the safe 'lives in your brain'. ISTM a virtual 'locked container of documents' would have the same legal status. I'm not sure why so many techies go down the Walter-Mittyesque 'Enemy of the State' route when discussing this sort of thing. Mention the police in conjunction with encryption and suddenly everyone's a paranoid compound-dweller... Let's be clear here - it is unlikely that this guy is making a stand for paranoid techies - it is much more likely that he's got pics and videos on his HDD of kids getting raped that he doesn't want the police to see.

271 points by alexandros 16y ago

Just thought of a feature idea for TrueCrypt and other similar packages: encrypted files or partitions can have multiple passwords, which reveal different things. So you could have a password that reveals something embarrassing but not incriminating. If the police or border nazis threaten you with prosecution unless you reveal your password, you give them this one. Meanwhile, you hide anything really confidential behind a password that you never give out. Or maybe they already have this?

tynan 16y ago
They already have this, It's called plausible deniability. What are the laws in the US on this?
- pilom 16y ago
  In the US the current rules for personal hard drives are bound by the 5th amendment which has been interpreted as "a reasonable expectation for privacy." What happens is the police say "Give us your password and we'll drop whatever sentence by 75% for helping the investigation." You don't have to give your password but the NSA works pretty extensively with law enforcement and the FBI (most US cases that require password cracks are federal cases but thats a separate issue). Anything that ever touches an ISP is a totally separate issue though. In that case, in the US, any information stored by an ISP can be retrieved without a warrant 6 months (I'd need to confirm its not 120 days) after the incident. Those cases fall under the interpretation of a message overheard. In 5th Amendment cases, if you say a message in a crowded room, you don't have a reasonable expectation of privacy and this is how any message on the internet is interpreted legally. There was also a court case this spring where the DoD sued an ISP to give over IP addresses sooner than the 6 month (120 days?) limit (anyone got a link?). The DoD dropped the case though.
  - jrockway 16y ago
    Do you think the NSA is going to reveal to foreign governments that they've broken AES by going after some guy with child porn on his laptop? I personally doubt it. Could the NSA cooperate with the FBI? Yes. Will they? Not if it means they can't spy on Russia anymore.
    - alextgordon 16y ago
      "Breaking AES" is not at all necessary. All it takes is one implementation hole, or some plaintext unknowingly cached by a program. The NSA don't merely employ scores of cryptanalysts to sit around all day to try to break ciphers (though I expect they do this too). Exploiting mistakes is their bread and butter.
      - jrockway 16y ago
        And "hey guys, stop using that broken software" is not what they want to tell the people they are spying on. Can anyone name one case where the NSA has ever testified for the prosecution?
    - pilom 16y ago
      It has nothing to do with holes in AES, NSA just has better brute force capabilities than the FBI or any other law enforcement. And while you sit in jail awaiting trial, they take the months it takes to brute force a key.
    - rdtsc 16y ago
      They could just provide the password without divulging how they did it. The best way would be for them to get the drive, if they crack the password, and the password looks like it could have been guessed or generated from some contextual info about the subject or the case, then they return it the police. If they do crack it but the password is actually a random string and disclosing it would betray NSA's abilities, they they simply refuse to disclose it. On the other hand maybe it would be better to create disinformation that they have cracked all kinds of ciphers or at least their popular implementations? Maybe it will lead enemies to try to implement their own or use alternate implementations that are actually less secure. This will be similar to Airforce's disinformation related to captured UFO tech in the 50s and 60s...
digitallogic 16y ago
TrueCrypt already has this feature: http://www.truecrypt.org/hiddenvolume http://www.truecrypt.org/hiddenvolume
- ryanwaggoner 16y ago
  Ah well...at least I thought of something worth doing :)
  - edanm 16y ago
    More people should learn from this attitude. This is what I say every time I have an idea, and I later found out someone already built a startup around it (happens quite a lot, since I spend half my waking time thinking of startups).
    - InclinedPlane 16y ago
      Indeed. It means you possibly have a head for good ideas. You should be far, far more worried if nobody else has beaten you to the punch on any of your ideas, because that would tend to indicate that your ideas are either impractical or of low quality.
- omh 16y ago
  Presumably the UK police are aware of this feature, which could lead to a more interesting situation when you can't prove that you've really unlocked to the deepest level.
  - ryanwaggoner 16y ago
    Seems like you're giving the police a lot of credit, but maybe not. Regardless, there's really no way to prove anything either way, is there?
    - dagw 16y ago
      I've met a couple of people who actually deal with computer forensics for the police and they are seriously smart people and totally on top of their game. So while you're average cop might not understand the details, they have forensics guy who certainly do. As to proving anything, my understanding is that it is theoretically impossible to prove, but sometimes bugs in the implementation or various user mistakes mean that you can, in practice, sometimes get a good indication that something is hidden,
kiba 16y ago
The police will just beat you up until the secret come out. They're not going to say "Drats! Our evil plans are foiled!" http://xkcd.com/538/ http://xkcd.com/538/
- camiller 16y ago
  nah, the police can't torture you for your password. Only the evil criminals can do that. The courts can incarcerate you for not revealing a password, it's is up to you the criminal to decide if the punishment for not revealing the password is more/less severe than the punishment for whatever crime your hiding the evidence of with the password. Edit: OK now I have found evidence to prove myself wrong. At some point in the past I though I had read of a court case where a judge ruled that a defendant had to reveal a password. But a more recent case says otherwise: http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encrypted-laptop-child-porn_N.htm http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encr...
  - rdtsc 16y ago
    > Only the evil criminals can do that. Depending on the country, the symmetric set difference between the police and "evil criminals" is quite small. And even then when the police can't torture your officially, they can have ways of torturing you un-officially. They can lock you up with a group of gang members who are on the un-official "payroll" of the police. They rape and torture you until you reveal the password. The case in the media will come out as "my cellmate confessed in a moment of weakness and here is the password".
    - nandemo 16y ago
      It's even easier than that. You don't need actual torture to extract confessions: Pressed by Police, Even Innocent Confess in Japan http://www.nytimes.com/2007/05/11/world/asia/11japan.html http://www.nytimes.com/2007/05/11/world/asia/11japan.html Also: Japan is unique among democratic countries in that confessions are obtained from 95% of all people arrested, and that its courts convict 99.9% of all the suspects brought before them. (...) It is how the police obtain these confessions that troubles human-rights activists. A suspect can be held for 48 hours without legal counsel or contact with the outside world. After that, he or she is turned over to the public prosecutor for another 24 hours of grilling. A judge can then grant a further ten days of detention, which can be renewed for another ten days. http://www.debito.org/?p=217 http://www.debito.org/?p=217

metal 16y ago

They already have this. You can have two levels of passwords: one for the OS and one for a hidden encrypted partition or encrypted file where you keep your truly sensitive info.

squidbot 16y ago

It occurs to me that since this part of a child pornography investigation, 16 weeks in jail for not giving them a password might actually be a far lighter sentence than if the key was provided and illicit material was found. I don't condone the porn, but it does seem like a logical trade-off.

deleted 16y ago
[deleted]
BillGoatse 16y ago
Wait until they ask him again, 16 weeks from now...
- dc2k08 16y ago
  Can you be tried for the same crime twice?
  - kscaldef 16y ago
    You can certainly be tried for the same crime twice. You can't be tried twice for the same criminal act. Arguably, if they ask him again after doing his 16 weeks, it's a new action if he refuses to comply.
    - TheCondor 16y ago
      It's not a trial. It's refusal or follow a court issued order, the punishment is contempt of court. They don't need a trial in that case... the judge that issues the order can simply judge whether or not you're complying with it. In all these scenarios, you're screwed the moment you find yourself in court (actually probably long before then when you convince some law enforcer that you're doing something wrong) Judges and lawyers aren't going to be hip to this hypothetical plausible deniability game. A drive isn't an extension of your brain or your relationship with your wife. It's physical evidence. The only thing that makes it different than say a really big lock on the door of your house or a safe is the effort it takes to circumvent when a court agrees to admit the evidence. Almost never is that evidence used alone. There are subtle issues to the meaning of the evidence provided, like you might not need to give up the password and thus decrypt everything else encrypted with it, you might just need to decrypt the data in question in a convincing manner to the court. Being able to decrypt the drive doesn't have to prove that you are responsible for the contents.

malandrew 16y ago

This Star Wars quote seems appropriate here, especially given the hidden volume feature of TrueCrypt: Princess Leia: "The more you tighten your grip, Tarkin, the more star systems will slip through your fingers."

varjag 16y ago

It's the modern alternative to pulling fingernails.

xenophanes 16y ago

I realize this story is in the UK, but could it happen in the US or would the 5th amendment protect you? As an American, it seems a bit insane to me for someone to be jailed for refusing to help convict himself.

moxiemk1 16y ago
I thought remembered a court precedent in the US that ruled being compelled to divulge encryption keys was equivalent to being compelled to hand over keys to locked places (like a safe), which is historically required. That said, I can't find such an article, so hopefully I'm making it up and we are indeed safe in our minds.
- camiller 16y ago
  I thought that also but then found this from 2008: http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encrypted-laptop-child-porn_N.htm http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encr...
- Anechoic 16y ago
  There's United States v. Boucher but case had a couple of wrinkles, including the fact that Boucher had previously cooperated with law enforcement so it was thought that providing a password wasn't self-imcrimination since it wouldn't add to the knowledge of what the authorities already had: http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki/United_States_v._Boucher
- pilom 16y ago
  No legally in the US you are not required to give the keys to the safe, but they can drop your sentence significantly for working with the investigators. For a safe, if you don't give them the key, the get a grinder and hack saw, for an encrypted hard drive in the US they give it to the NSA (though 50 chars would be tough for even them i'd expect).
  - pyre 16y ago

jason_slack 16y ago

Can anyone explain how TrueCrypt works for OS X? Could I have my entire home directory on the hidden partition? What about their hidden operating system feature? So I can have my normal OS as the decoy OS and then have a hidden Linux OS (as example) that I use for sys adm type stuff and boot to it when I need to? Can VMWare or Parallels see this partition and create a VM based on it?

Groxx 16y ago
Essentially, you can't true-crypt anything that can't run TrueCrypt before you need access to it. So you wouldn't be able to run TC and enter your password prior to logging in, which requires your home directory. Perhaps this could be sidestepped, but I'd think it'd be a mega-hack unless you can boot to a USB drive which can decrypt things and then boot OSX. I haven't heard of anyone doing that though, probably because Macs are a bit different with their bootup. You're essentially stuck making a file-as-a-volume or a hidden partition, though I don't know how / how well hidden partitions work in OSX. Once your file / hidden partition is mounted, it's just another mounted volume. Anything which can read / write to a volume it's not on shouldn't notice a thing. Also, it looks like it might just be Windows which gets the hidden-OS capability, as it requires a TC boot-loader on-disk or on an external booting device. Which means it should be possible for others as well, but it sounds like they haven't done it yet. http://www.truecrypt.org/docs/?s=hidden-operating-system http://www.truecrypt.org/docs/?s=hidden-operating-system
elai 16y ago
Truecrypt doesn't work, but you have the FileVault feature built into OSX and PGP whole disk encryption: http://paulstamatiou.com/review-pgp-whole-disk-encryption-for-mac-os-x http://paulstamatiou.com/review-pgp-whole-disk-encryption-fo...

ck2 16y ago

In the USA can you be compelled to testify against yourself by being coerced into giving a password to law enforcement? Has this been tested yet, out of curiosity? I remember reading they can deny you entry/exit to the USA if customs can't read your laptop but never heard anything like local/FBI. If not, I hope it doesn't go before this particular supreme court.

camiller 16y ago
Apparently not, although I though I had read of an earlier case where there was a judge that ruled that a password had to be revealed. http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encrypted-laptop-child-porn_N.htm http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encr...
- ck2 16y ago
  Yeah that's the border - slightly different, though they also set up border checks hundreds of miles "inland" around the country which makes their intentions suspect. What I hate about all these cases is it comes down to child porn which makes it impossible to defend. Why can't it be something mundane that actually shows why this is a REALLY bad idea. I just saw a scary university lecture on youtube on why you should NEVER talk to to the police, even to "explain things", even if you know you are 1000% not guilty of whatever they are after. So now it makes perfect sense to me that if they want to go trolling across your hard drive, they are doing exactly that - you are testifying against yourself for whatever charges they want to invent afterwards.
- evgen 16y ago
  In the US there are conflicting precedents at the moment, so it really depends on where the case is being heard. At the moment the case that seems to have the strongest route to the Supremes is the one involving child porn at the border, allowing the court to address both the "are passwords protected" question and the legality of laptop border searches. Unfortunately for the cyberliberty crowd this particular case is the last one they want to see before the court, the facts are not good and it provides an easy excuse for a "law and order" majority on the court to significantly extend the government's reach.

awakeasleep 16y ago

As great as hidden volumes are, traces showing the inconsistency between the fake and real volume will be left on your system unless you take heroic measures to erase them. Things like logs of all the external drives you connect, and links to recently opened files.

CGamesPlay 16y ago
Your entire operating system can be a hidden volume. I don't know how "heroic" this is.
ciupicri 16y ago
Regarding recently opened files, you can always say that you deleted them.

fbcocq 16y ago

I've been resetting people's 8 character passwords lost due to Post-Vacation-Insomnia for ages, I'd really like to see them expect me to remember a 50 character password under stress conditions.

brettmjohnson 16y ago
I have a 12 character password and it is a pain in the ass to type it several times a day. I couldn't imagine using a 50 character password.
- voxxit 16y ago
  It is probably just a concatenated string of his credit card number or social security number and random words. I wonder if they are currently trying to crack it using some kind of dictionary brute force mechanism, or if there is some kind of lock out enabled after five tries.
  - aidenn0 16y ago
    If they have physical access, then there is no effective lock-out mechanism. Presumably they can determine which encryption software is used, and can use the algorithm as many times as they want.
- ataggart 16y ago
  One way to have long, but memorable passwords is to construct them using the first letter of each word a rather long, but memorable quote/phrase. E.g., The opening of the Gettysburg Address yields: fsasyaofbfutcannciladttptamwce. And if you forget the exact words, you can always look them up.
swolchok 16y ago
Did you mean: Post-Vacation-Amnesia?
- fbcocq 16y ago

vic_nyc 16y ago

I wonder why he didn't say he "forgot the password". Although it may seem implausible, how could they prove it's not true?

omh 16y ago
I think that the law is worded so that it's an offence to have encrypted files and not be able to decrypt them. Whether it's deliberate or just forgotten isn't relevant (though I'd hope it would make a difference in sentencing).
- points 16y ago
  How can you even prove that a file is encrypted? The whole law is baloney.
  - 16s 16y ago
    Use TrueCrypt to do whole disk encryption on your Windows XP hard drive. Then boot your computer with a Linux Live CD and dd the first 512 bytes to stdout. This is what you'll see in plain text ASCII: "TrueCrypt Boot Loader" No expert is needed to prove that you are using TrueCrypt whole disk encryption. It has a huge stamp right up front.
    - barrkel 16y ago
      That's certainly true for that particular instance, in that particular implementation. But it's not necessarily the case. Take some random file and encrypt it with gpg; there's nothing obvious in the contents to mark it out as encrypted data.
      - 16s 16y ago
        tom@ubuntu:~$ gpg -c flag.png tom@ubuntu:~$ gpg -v --list-packets flag.png.gpg :symkey enc packet: version 4, cipher 3, s2k 3, hash 2 salt eae60ad4255dc4e2, count 65536 (96) gpg: CAST5 encrypted data OpenPGP encrypted data is easy to find too. It even tells you the algo used. The example is symmetrically encrypted, but it works the same with asymmetric keys. Even shows who it is encrypted for. Edit: formatting.

gunmetal 16y ago

"It sends a robust message out to those intent on trying to mask their online criminal activities that they will be taken before the courts with the ultimate sanction, as in this case, being a custodial sentence." seems like a good reason to have "innocent until proven guilty". drive could contain anything, or nothing.

NathanKP 16y ago

It seems like a bad idea to store anything incriminating on your local hard drive. Why not keep your encrypted files on a flash drive? If the police show up destroy the flash drive using a hammer, ensuring that the flash memory chip is thoroughly pulverized and completely unreadable. Likewise, if you are going to be using the internet for devious purposes drive around and use a neighbor's open wireless network access point, which highly reduces the chances that anything can be traced back to you. Or set up your own unsecured wireless network point and suggest to officers that illegal use came from an outside source. Not that I want to condone illegal activities, or condone lying to police officers, but to the hacker in me these seem like simple, sensible steps to take that will be more dependable than even a 50 character password.

tjarratt 16y ago
I understand that in some areas, not only is it illegal to operate an insecure wireless access point (in the UK at least), you can be held accountable for the actions of people that use the access point.
- deleted 16y ago
  [deleted]
- Delts 16y ago
  Unless I'm mistaken you can currently still operate an unsecured access point in the UK. The legislation was originally part of the Digital Economy Act however I can't spot anything expressly forbidding operating one.
- sswam 16y ago
  that's amusing, considering that every wireless access point is insecure
  - elai 16y ago
    WPA2 with authentication or WPA2 with a 64-character line-noise password?
16y ago

boredguy8 16y ago

Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. So, for instance, say you had encrypted files of plans to build a bomb and detailed schematics of the White House. The judge can order you to decrypt the files without forcing you to reveal that the password was "K1llt3hPr3zn0w!" As a practical matter, I've wondered what would happen if someone simply claimed they couldn't remember the password. Especially if one could make it look like the encrypted files hadn't been accessed in over a year. TrueCrypt's Plausible Deniability (http://www.truecrypt.org/docs/?s=plausible-deniability http://www.truecrypt.org/docs/?s=plausible-deniability) makes these issues even more complicated. But yeah: by simply refusing, you'd be thrown in jail for contempt and your only way out would be appellate review of the order. You'd have to challenge the contempt citation on the basis that the original order was unlawful.

jemfinch 16y ago
Can you provide some citations for your claims here? I'd really like to review them.
- deleted 16y ago
  [deleted]
- alextgordon 16y ago
  Wikipedia has this to say: http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki/United_States_v._Boucher On February 19, 2009, Judge Sessions reversed the magistrate's ruling and directed Boucher "to provide an unencrypted version of the Z drive viewed by the ICE agent.
  - kgo 16y ago
    That case was goofy because he initially typed in his password in front of law enforcement and provided them access, which nullified any claims of self incrimination. It'd be similar to confessing to murder, telling the cops where the body is, and then invoking your right to remain silent, and expecting them not to look for the body under "fruit of the poisonous tree" logic.

eiji 16y ago

"50-character encryption password" - nice! I'm wondering ... Person A refuses for - pure principle (and maybe some ripped DvD's) Person B refuses for - let's say child pornography and a dirty bomb manual Both will get the same jail time?

araneae 16y ago
There are other legitimate reasons to not want to reveal the contents of your hard-drive besides principle or self incrimination. For instance, if you had the private information of any other people. My SO works with HIV, and recently got access to sensitive data that had to be sent on DVD via courier. Who here trusts the police to not disclose their HIV status?
- aperiodic 16y ago
  Disclaimer: IANAL If you're in the Unites States, the data is probably protected by HIPAA, the Health Insurance Portability and Accountability Act[1]. HIPAA includes a clause stating that the Attorney General or their designee may issue a subpoena compelling your SO to disclose that information, but only to someone investigating a Federal health care offense. I've searched through the rest of HIPAA for keywords such as "law enforcement", "criminal", and "disclosure", but I couldn't find anything about being compelled to disclose HIPAA-protected information to law enforcement in any other circumstance than investigation of a Federal health care offense. However, I did not thoroughly read HIPAA, and there might be something in another section of the US Code that's relevant. Hopefully someone more knowledgeable about this can let me know if I've missed something. [1]: http://www.legalarchiver.org/hipaa.htm http://www.legalarchiver.org/hipaa.htm
  - araneae 16y ago
    Yup, that's the case. The question is whether or your hard drive is protected from a criminal charges subpoena. The data is kept encrypted on the hard drive, but of course the authorities don't know what's on the hard drive until it's decrypted.

deleted 16y ago

[deleted]

jrockway 16y ago
Absolutely. I think this is a great win for crypto; this guy is truly free from the prying eyes of the government. It's good for society, too -- instead of convicting someone based on evidence on the guy's own computer (bringing into question context, chain of custody issues, and so on), the cops will have to build a solid case to convict him. When the police are forced to cross their ts and dot their is, society wins. So I see this as good for everyone, even the children he may be abusing. They will get a fair trial that leaves no question about this guy's guilt. (If he is really guilty, of course.)

omh 16y ago

This has happened before, although the details aren't clear. It was reported last year (http://www.theregister.co.uk/2009/08/11/ripa_iii_figures/ http://www.theregister.co.uk/2009/08/11/ripa_iii_figures/) that two people had been convicted for similar offences. It seems that most people don't comply, but not all of them are charged: "Of the 15 individuals served, 11 did not comply with the notices. Of the 11, seven were charged and two convicted."

thedjpetersen 16y ago

If they are unable to crack the pass code, does he go free on lack of evidence?

pyre 16y ago
I imagine so seeing as they gave him a finite sentence. Presumably he'll never get his equipment back though.
yardie 16y ago
If they base the case entirely on one piece of evidence than they have already lost. Through programs like CSI, people are convinced that most of the evidence for a case comes from a lab and all they need is that one piece of evidence. What really happens is the investigators have to answer the 5-Ws (who,what,etc) and they "build" a case against you. If they have one piece, then they can go fishing for the rest. This is why it's important to shut your month when talking to the police. Anything you say at this point can really open you up to all types of crap later. They'll twist your words around, become your friend, good cop/bad cop, mention friends and family and all other types of tricks to get you to talk. Believe it or not, criminals willingly give up testimony about themselves. Some guy in a lab with half a shoeprint isn't what wins the case, you do. If all the prosecution has is one piece of evidence then a competent barrister can shred it to pieces. This guy's job is to create FUD, and lots of it. The less evidence the prosecution has the easier his job is. But what he/she can't do is fix anything you say in front of the police while he isn't there. This is why it's important to shut up and ask a lawyer first.

eof 16y ago

How do they know it's a 50 character password?

tyree731 16y ago
He probably volunteered that information.
- eof 16y ago
  Seems a silly thing to offer
tyree731 16y ago
He probably volunteered that information.

mathgladiator 16y ago

In the US, how does the fifth amendment work in this type of issue? If he complies, then he is testifying against himself.

mirkules 16y ago

Would it be possible to have one password for accessing the system, and a separate password for permanently wiping sensitive parts (in the background, even)? What would be the legal implications (other than the obvious obstruction of justice charges if the authorities catch on)?

CGamesPlay 16y ago
The problem there is that any evidence should have been copied and should be accessed from a read-only media at that point.

bl4k 16y ago

I am surprised that they didn't keylog his machine - as having a warrant to search/seize means a warrant to keylog probably could have been obtained. The police will learn from this and avoid these 'oh dammit' moments by just keylogging everybody from now (or at least those suspected of having encrypted volumes). Keylogging is the one real weakness of all the TrueCrypt/other encryption schemes (that and your password is in memory in the clear while the volume is mounted, and even afterwards depending on your settings).

gregable 16y ago
Could you defeat that somehow by having rotating keys?
- ElliotH 16y ago
  Wouldn't that take a very long time to re-encrypt a whole drive with a new key?
  - SapphireSun 16y ago
    Use two drives and have them switch over every night.
  - kd5bjo 16y ago
    You wouldn't re-encrypt the whole drive; usually, the master key is stored in the first few sectors of the disk, encrypted with the login key. That way, you only have to re-encrypt a small amount of data to effectively change the entire disk's key.
weavejester 16y ago
Adding a keylogger (presumably hardware) is not without its risks. If the suspect discovers it, they have a window of opportunity to cover their tracks.

mattm 16y ago

A friend of mine flew back home to Canada. After clearing customs, he was one of the random people chosen to have their luggage inspected. He had his laptop on him and the customs agent booted up the computer, asked him to enter his password and then took his laptop away before bringing it back without telling him anything about it. I wondered what would have happened if he refused to type in the password.

nkassis 16y ago
I've been wondering about this for a while, my current idea is to wipe my computer before every trip. I keep a backup on a desktop computer that I access to while away. If this happened while coming back to canada, I'd probably still argue and see what I can do. Not sure if I'd go all the way to letting them take my laptop away for ever. They can't refuse to let you back into the country so.. at least on that point you are safe.
Deestan 16y ago
Customs aren't law enforcement, they just like to think so. The request to enter a password should be treated as a impolite request, which you should politely deny.
- GBond 16y ago
  Not sure why your were upvoted (probably for the sentiment that freely entering one's password without reason should not happen) because that is not correct. In the US, "customs" typically refer to ICE and TSA, both are enforcement functions of the United States Department of Homeland Security.
  - Deestan 16y ago
    checking facts... You are correct. I incorrectly assumed they were equivalent to UK and Norwegian customs, where customs and border protection are separate entities.

iuguy 16y ago

It's about time this happened. In the UK we have a law called the Regulation of Investigatory Powers Act (RIPA) which allows access to certain data held by ISPs or can compel people in certain cases to not only hand over encryption material but prohibits them from acknowledging that they had been charged under such a law. As you can imagine, that last bit results in some very complicated situations. The laws governing paedophilia are quite different, with paedophiles having to sign a sex offenders register. In the case of a sex offender being caught, it's easier to just take the RIPA sentence instead. This is what appears to have happened. I hope the guy's password is long enough otherwise regardless of his crime he's in for a world of pain.

rwmj 16y ago

Not the first one: http://www.theregister.co.uk/2009/11/24/ripa_jfl/ http://www.theregister.co.uk/2009/11/24/ripa_jfl/

abalashov 16y ago

I am not sure I understand the basis on which this person was jailed. If the court order to search his computer was provided on the basis of probable cause, what was that probable cause? If law enforcement already had evidence of some kind of misdeed, why do they need access to his computer? If the evidence of his misdeeds is on the computer, wouldn't providing it be a) self-incrimination of some description, as mentioned extensively elsewhere here and b) law enforcement's inability to get access to the information get the case dismissed due to lack of evidence?

loewenskind 16y ago

It sounds to me like TrueCrypt needs a new feature: a password that just destroys all data.

cracki 16y ago
would be fast too. just zap the headers.

nervechannel 16y ago

Steganography.

confuzatron 16y ago

If the Police have a warrant to search a safe, presumably you can be required to hand over the combination or be in contempt of court. Even if the combination for the safe 'lives in your brain'. ISTM a virtual 'locked container of documents' would have the same legal status. I'm not sure why so many techies go down the Walter-Mittyesque 'Enemy of the State' route when discussing this sort of thing. Mention the police in conjunction with encryption and suddenly everyone's a paranoid compound-dweller... Let's be clear here - it is unlikely that this guy is making a stand for paranoid techies - it is much more likely that he's got pics and videos on his HDD of kids getting raped that he doesn't want the police to see.