8 ms·

Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what

Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. So, for instance, say you had encrypted files of plans to build a bomb and detailed schematics of the White House. The judge can order you to decrypt the files without forcing you to reveal that the password was "K1llt3hPr3zn0w!" As a practical matter, I've wondered what would happen if someone simply claimed they couldn't remember the password. Especially if one could make it look like the encrypted files hadn't been accessed in over a year. TrueCrypt's Plausible Deniability (http://www.truecrypt.org/docs/?s=plausible-deniability http://www.truecrypt.org/docs/?s=plausible-deniability) makes these issues even more complicated. But yeah: by simply refusing, you'd be thrown in jail for contempt and your only way out would be appellate review of the order. You'd have to challenge the contempt citation on the basis that the original order was unlawful.

jemfinch 16y ago
Can you provide some citations for your claims here? I'd really like to review them.
- deleted 16y ago
  [deleted]
- alextgordon 16y ago
  Wikipedia has this to say: http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki/United_States_v._Boucher On February 19, 2009, Judge Sessions reversed the magistrate's ruling and directed Boucher "to provide an unencrypted version of the Z drive viewed by the ICE agent.
  - kgo 16y ago
    That case was goofy because he initially typed in his password in front of law enforcement and provided them access, which nullified any claims of self incrimination. It'd be similar to confessing to murder, telling the cops where the body is, and then invoking your right to remain silent, and expecting them not to look for the body under "fruit of the poisonous tree" logic.
    - fluidcruft 16y ago
      Did he? I thought he drove through the checkpoint with the machine turned on/suspended in his back seat with the drive mounted.
      - kgo 16y ago
        You might be right. The wikipedia page said "the laptop was powered-up", which is a little ambiguous ("was [already?] powered-up"). But I think the principal is the same in either case. He already volunteered the information once.
kgo 16y ago
bbc.co.UK
- boredguy8 16y ago
  But some people are ASKING about the US, and everything I've said above is as it pertains to US law. Which is a worthwhile discussion anyway, as US readers are the largest single group of HN readers.
  - kgo 16y ago
    Apologies... If you had replied to a question, I wouldn't have felt compelled to post that. But in the UK, it's illegal to refuse to give up your password.
    - boredguy8 16y ago
      What happens if you say you forgot the password, and the files in question haven't been accessed in over a year? This is a question in my initial post that's still relevant to UK jurisprudence; an answer to which could move the conversation forward in a way far more productive than imagining I didn't know the article was about something that happened in the UK.
      - kgo 16y ago
        I apologized man... What more do you want?
        boredguy8 16y ago
        I'm not the one downvoting you. But I want a conversation that's adding information or content to which I wouldn't easily have access. So for instance, an answer to the question I pose above (or, if not a concrete answer, something along the lines of what would probably happen).
        csomar 16y ago
        He's probably bored and thus wants to extend the discussion
stretchwithme 16y ago
just tell 'em you forgot it
- SwellJoe 16y ago
  Lying under oath is a criminal offense. Proving you're lying may be tricky, but if it were to somehow become obvious you were lying, you'd then have to answer for that offense as well as whatever other charges you were dealing with before. This is really common advice, but I'm not sure it's the best option.
  - stretchwithme 16y ago
    it was tongue in cheek. of course you don't have the right to lie to protect yourself from a legitimate investigation where probable cause already exists.
  - tomjen3 16y ago
    Sure it may be criminal, but honestly if they can't prove it - what possible harm could come from it?
smokeyj 16y ago
How easy would it be for an officer to present an encrypted computer and say - if you don't unlock this, you're getting thrown in jail. This is no different than a witch hunt, it's totally unprovable and throwing people in jail over not knowing a piece of information is unethical.
- lkjuhygthyujk 16y ago
  People did that as a protest when the law was introduced - they emailed random numbers to the then home secretary (the minister in charge of the police in the UK)
- jessriedel 16y ago
  In the US, the prosecution is going to have to prove beyond a reasonable doubt that there is, in fact, encrypted information and that the suspect knows the key. Yes, there are going to be gray areas. But if Bob has one computer in his house with his and only his finger prints all over it, wear that indicates that the computer has been used extensively, and the computer hard drive is filled with an encryption scheme wrapped around otherwise useless gigabytes of random data, then I am sure beyond a reasonable doubt that there is encrypted data on the hard drive and Bob has the key.
  - jeromec 16y ago
    To establish reasonable doubt all the defense has to do is come up with some alternative way all of your facts can be true without Bob having the key. I can think of two from the top of my head. 1. Bob has mischievous friends, or worse, enemies at school. He leaves his laptop unattended/exposed where someone installs the encryption then wipes their fingerprints, or perhaps has worn gloves. Bob takes his laptop home and tries to regain access to the computer. 2. Bob unwittingly acquires the laptop from a criminal (he may have bought it, or maybe he fixes computers) who encrypted the drive and wiped away all fingerprints. Bob tries to gain access to the computer. To be free from self-incrimination Bob can simply refuse to answer any questions about the laptop in question at all.
    - 16y ago
baddox 16y ago
The point of plausible deniability is that is simplifies things, at least for you the owner of the data.
lkjuhygthyujk 16y ago
I was a grad student in CS at Cambridge when this law was introduced. A nice man from the police came to lecture us about it. We asked about proving that say the results from a Monte Carlo simulation, or even just a blank disc weren't encrypted - we were told not to worry the law would only be used against terrorists. Since this was before 911 - the 'terrorists' in question were presumably the IRA, not sure they had much of an online presence back then.
- Tycho 16y ago
  A policeman came to visit our social education class in highschool, and my friend asked was it illegal to have an encrypted file that you don't know the password for. The policeman just looked at him like 'WTF are you talking about?'
- MrRage 16y ago
  > Since this was before 911 - the 'terrorists' in question were presumably the IRA, not sure they had much of an online presence back then. You do know that 9/11 was not the first terrorist attack on the US by Islamic extremists, do you?
  - lkjuhygthyujk 16y ago
    Yes, but I'm assuming the UK didn't draft a law in the mid 90s to prevent Islamic attacks on the US. The fact that their plans would be written in a foreign language (never mind a foreign alphabet) would have been more than adequate to keep it secret from British intelligence. ps. You do know that we have been having terrorist attacks for almost a century.
    - billswift 16y ago
      >The fact that their plans would be written in a foreign language (never mind a foreign alphabet) would have been more than adequate to keep it secret from British intelligence. This is one of the stupidest statements I have ever seen.
SageRaven 16y ago
For those seriously interested in this area of law, I highly recommend http://cyb3rcrim3.blogspot.com http://cyb3rcrim3.blogspot.com, as it's a really good source of info on the topic . Susan Brenner is a law prof, and her analysis of current cases is a constant treasure trove of interesting nuggets of insight into the law as it pertains to computers, electronic devices, and digital media. It's broken down enough for the layman to grasp, yet heavy enough in vocabulary and citations/references, that a you'll have a decent understanding of the law and how the justice system works.
- corysama 16y ago
  Thank you. Apparently, this situation is not yet resolved, but is currently being tested. http://cyb3rcrim3.blogspot.com/2009/03/5th-amendment-bummer.html http://cyb3rcrim3.blogspot.com/2009/03/5th-amendment-bummer.... http://cyb3rcrim3.blogspot.com/2010/04/passwords-and-5th-amendment-privilege.html http://cyb3rcrim3.blogspot.com/2010/04/passwords-and-5th-ame...
Marticus 16y ago
Claiming forgetfulness concerning the key would give you a way out unless they could manage to crack it - at that point you would have dodged the self-incrimination bullet but could not be legally bound to simply "decrypt it." I agree though - the entire thing is an absurdly mucky business. Apparently however the English law doesn't have much like that in the way of loopholes, or he simply refused to decrypt it outright.
- jrockway 16y ago
  I believe there is a specific law in the UK that mandates key escrow -- the government must be able to decrypt anything. This has been floated in the US before, but it has not gotten good PR. As it stands now, it is a Constitutional law issue -- does the fifth amendment mean that you can't be compelled to get up in the witness box and talk, or does it mean that you don't have to assist the prosecution in any way? Right now, the courts seem to be split 50/50, but I feel that practicality dictates that you don't have to give up your key. First they have to accuse you of a crime and bring it to trial, then you have to refuse to decrypt the key, then the first trial has to stop, then the government has to prove that you know the key, then you have to be convicted and sentenced, then you can go back to the original trial after analyzing all of the decrypted "evidence". If encryption becomes widespread, this just isn't practical. It's easy to prove that you sell drugs; someone goes up to you and buys them. It's not easy to prove that you didn't forget your encryption key, because we have no way to observe someone's mind. Laws that prohibit crimes that can't be proved tend not to do well.
  - Tyrannosaurs 16y ago
    I believe the law in the UK allows for a jail sentence of up to two years for not revealing a password or encryption key. While it's a dubious law in may ways, when you hear a UK politician calling for longer detention without trial and stating needing to break encryption you can at least point to this law and say that their claims about longer detention are nonsense.
lmkg 16y ago
> The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. This is a really subtle point, but in the US this is not (usually) the case, because this is still self-incrimination. You see, by entering the password, you are demonstrating that you have access to the encrypted information, and demonstrating that you have that power is technically self-incrimination. The password is one piece of information that you can't be compelled to divulge, and the fact that you have the password is a separate piece of information, and you cannot be compelled to reveal either. This is also a really important piece of information too, because in order to stick you with any legal consequences associated with the encrypted information, they generally have to prove that you have control over or access to the information. If a file is encrypted it is still possible to reasonably doubt that you have access to its contents despite having access to the physical drive it is on. While it is (currently, as far as I am aware) untested in the court of law, it may be possible to compel someone to use or divulge their password if this does not incriminate the person to do this. I can think of two ways this could happen: a) access/control to the encrypted information has already been proven, so the testimony is of null value b) the prosecution is not allowed to use the fact that you know the password in court, and takes the gamble that they can prove access/control some other way (possibly by using contents of the information). This is, of course, assuming that passwords are classified as "testimony" and therefore protected by the 5th Amendment. If the password is ever recorded on a physical medium such as a piece of paper, that piece of paper is probably not testimony, but rather evidence. This means that, like the key to a safe, it is protected by the 4th Amendment rather than the 5th, and you can be compelled to give up the paper via a warrant. This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick? (IANAL, but I've studied the topic as a layman)
- jeromec 16y ago
  This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick? Considering that the record for number of decimal places memorized for Pi appears to be 67,890 I'd argue memorizing a 128-character random sequence would be both possible and most secure. ;)

jemfinch 16y ago

Can you provide some citations for your claims here? I'd really like to review them.

deleted 16y ago
[deleted]
alextgordon 16y ago
Wikipedia has this to say: http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki/United_States_v._Boucher On February 19, 2009, Judge Sessions reversed the magistrate's ruling and directed Boucher "to provide an unencrypted version of the Z drive viewed by the ICE agent.
- kgo 16y ago
  That case was goofy because he initially typed in his password in front of law enforcement and provided them access, which nullified any claims of self incrimination. It'd be similar to confessing to murder, telling the cops where the body is, and then invoking your right to remain silent, and expecting them not to look for the body under "fruit of the poisonous tree" logic.
  - fluidcruft 16y ago
    Did he? I thought he drove through the checkpoint with the machine turned on/suspended in his back seat with the drive mounted.
    - kgo 16y ago
      You might be right. The wikipedia page said "the laptop was powered-up", which is a little ambiguous ("was [already?] powered-up"). But I think the principal is the same in either case. He already volunteered the information once.

kgo 16y ago

bbc.co.UK

boredguy8 16y ago
But some people are ASKING about the US, and everything I've said above is as it pertains to US law. Which is a worthwhile discussion anyway, as US readers are the largest single group of HN readers.
- kgo 16y ago
  Apologies... If you had replied to a question, I wouldn't have felt compelled to post that. But in the UK, it's illegal to refuse to give up your password.
  - boredguy8 16y ago
    What happens if you say you forgot the password, and the files in question haven't been accessed in over a year? This is a question in my initial post that's still relevant to UK jurisprudence; an answer to which could move the conversation forward in a way far more productive than imagining I didn't know the article was about something that happened in the UK.
    - kgo 16y ago
      I apologized man... What more do you want?
      - boredguy8 16y ago
        I'm not the one downvoting you. But I want a conversation that's adding information or content to which I wouldn't easily have access. So for instance, an answer to the question I pose above (or, if not a concrete answer, something along the lines of what would probably happen).
      - csomar 16y ago
        He's probably bored and thus wants to extend the discussion

stretchwithme 16y ago

just tell 'em you forgot it

SwellJoe 16y ago
Lying under oath is a criminal offense. Proving you're lying may be tricky, but if it were to somehow become obvious you were lying, you'd then have to answer for that offense as well as whatever other charges you were dealing with before. This is really common advice, but I'm not sure it's the best option.
- stretchwithme 16y ago
  it was tongue in cheek. of course you don't have the right to lie to protect yourself from a legitimate investigation where probable cause already exists.
- tomjen3 16y ago
  Sure it may be criminal, but honestly if they can't prove it - what possible harm could come from it?

smokeyj 16y ago

How easy would it be for an officer to present an encrypted computer and say - if you don't unlock this, you're getting thrown in jail. This is no different than a witch hunt, it's totally unprovable and throwing people in jail over not knowing a piece of information is unethical.

lkjuhygthyujk 16y ago
People did that as a protest when the law was introduced - they emailed random numbers to the then home secretary (the minister in charge of the police in the UK)
jessriedel 16y ago
In the US, the prosecution is going to have to prove beyond a reasonable doubt that there is, in fact, encrypted information and that the suspect knows the key. Yes, there are going to be gray areas. But if Bob has one computer in his house with his and only his finger prints all over it, wear that indicates that the computer has been used extensively, and the computer hard drive is filled with an encryption scheme wrapped around otherwise useless gigabytes of random data, then I am sure beyond a reasonable doubt that there is encrypted data on the hard drive and Bob has the key.
- jeromec 16y ago
  To establish reasonable doubt all the defense has to do is come up with some alternative way all of your facts can be true without Bob having the key. I can think of two from the top of my head. 1. Bob has mischievous friends, or worse, enemies at school. He leaves his laptop unattended/exposed where someone installs the encryption then wipes their fingerprints, or perhaps has worn gloves. Bob takes his laptop home and tries to regain access to the computer. 2. Bob unwittingly acquires the laptop from a criminal (he may have bought it, or maybe he fixes computers) who encrypted the drive and wiped away all fingerprints. Bob tries to gain access to the computer. To be free from self-incrimination Bob can simply refuse to answer any questions about the laptop in question at all.
  - 16y ago

baddox 16y ago

The point of plausible deniability is that is simplifies things, at least for you the owner of the data.

lkjuhygthyujk 16y ago

I was a grad student in CS at Cambridge when this law was introduced. A nice man from the police came to lecture us about it. We asked about proving that say the results from a Monte Carlo simulation, or even just a blank disc weren't encrypted - we were told not to worry the law would only be used against terrorists. Since this was before 911 - the 'terrorists' in question were presumably the IRA, not sure they had much of an online presence back then.

Tycho 16y ago
A policeman came to visit our social education class in highschool, and my friend asked was it illegal to have an encrypted file that you don't know the password for. The policeman just looked at him like 'WTF are you talking about?'
MrRage 16y ago
> Since this was before 911 - the 'terrorists' in question were presumably the IRA, not sure they had much of an online presence back then. You do know that 9/11 was not the first terrorist attack on the US by Islamic extremists, do you?
- lkjuhygthyujk 16y ago
  Yes, but I'm assuming the UK didn't draft a law in the mid 90s to prevent Islamic attacks on the US. The fact that their plans would be written in a foreign language (never mind a foreign alphabet) would have been more than adequate to keep it secret from British intelligence. ps. You do know that we have been having terrorist attacks for almost a century.
  - billswift 16y ago
    >The fact that their plans would be written in a foreign language (never mind a foreign alphabet) would have been more than adequate to keep it secret from British intelligence. This is one of the stupidest statements I have ever seen.

SageRaven 16y ago

For those seriously interested in this area of law, I highly recommend http://cyb3rcrim3.blogspot.com http://cyb3rcrim3.blogspot.com, as it's a really good source of info on the topic . Susan Brenner is a law prof, and her analysis of current cases is a constant treasure trove of interesting nuggets of insight into the law as it pertains to computers, electronic devices, and digital media. It's broken down enough for the layman to grasp, yet heavy enough in vocabulary and citations/references, that a you'll have a decent understanding of the law and how the justice system works.

corysama 16y ago
Thank you. Apparently, this situation is not yet resolved, but is currently being tested. http://cyb3rcrim3.blogspot.com/2009/03/5th-amendment-bummer.html http://cyb3rcrim3.blogspot.com/2009/03/5th-amendment-bummer.... http://cyb3rcrim3.blogspot.com/2010/04/passwords-and-5th-amendment-privilege.html http://cyb3rcrim3.blogspot.com/2010/04/passwords-and-5th-ame...

Marticus 16y ago

Claiming forgetfulness concerning the key would give you a way out unless they could manage to crack it - at that point you would have dodged the self-incrimination bullet but could not be legally bound to simply "decrypt it." I agree though - the entire thing is an absurdly mucky business. Apparently however the English law doesn't have much like that in the way of loopholes, or he simply refused to decrypt it outright.

jrockway 16y ago
I believe there is a specific law in the UK that mandates key escrow -- the government must be able to decrypt anything. This has been floated in the US before, but it has not gotten good PR. As it stands now, it is a Constitutional law issue -- does the fifth amendment mean that you can't be compelled to get up in the witness box and talk, or does it mean that you don't have to assist the prosecution in any way? Right now, the courts seem to be split 50/50, but I feel that practicality dictates that you don't have to give up your key. First they have to accuse you of a crime and bring it to trial, then you have to refuse to decrypt the key, then the first trial has to stop, then the government has to prove that you know the key, then you have to be convicted and sentenced, then you can go back to the original trial after analyzing all of the decrypted "evidence". If encryption becomes widespread, this just isn't practical. It's easy to prove that you sell drugs; someone goes up to you and buys them. It's not easy to prove that you didn't forget your encryption key, because we have no way to observe someone's mind. Laws that prohibit crimes that can't be proved tend not to do well.
- Tyrannosaurs 16y ago
  I believe the law in the UK allows for a jail sentence of up to two years for not revealing a password or encryption key. While it's a dubious law in may ways, when you hear a UK politician calling for longer detention without trial and stating needing to break encryption you can at least point to this law and say that their claims about longer detention are nonsense.

lmkg 16y ago

> The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. This is a really subtle point, but in the US this is not (usually) the case, because this is still self-incrimination. You see, by entering the password, you are demonstrating that you have access to the encrypted information, and demonstrating that you have that power is technically self-incrimination. The password is one piece of information that you can't be compelled to divulge, and the fact that you have the password is a separate piece of information, and you cannot be compelled to reveal either. This is also a really important piece of information too, because in order to stick you with any legal consequences associated with the encrypted information, they generally have to prove that you have control over or access to the information. If a file is encrypted it is still possible to reasonably doubt that you have access to its contents despite having access to the physical drive it is on. While it is (currently, as far as I am aware) untested in the court of law, it may be possible to compel someone to use or divulge their password if this does not incriminate the person to do this. I can think of two ways this could happen: a) access/control to the encrypted information has already been proven, so the testimony is of null value b) the prosecution is not allowed to use the fact that you know the password in court, and takes the gamble that they can prove access/control some other way (possibly by using contents of the information). This is, of course, assuming that passwords are classified as "testimony" and therefore protected by the 5th Amendment. If the password is ever recorded on a physical medium such as a piece of paper, that piece of paper is probably not testimony, but rather evidence. This means that, like the key to a safe, it is protected by the 4th Amendment rather than the 5th, and you can be compelled to give up the paper via a warrant. This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick? (IANAL, but I've studied the topic as a layman)

jeromec 16y ago
This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick? Considering that the record for number of decimal places memorized for Pi appears to be 67,890 I'd argue memorizing a 128-character random sequence would be both possible and most secure. ;)