11 ms·

I won't believe this ruling is safe until it goes thru higher levels. The Executive Branch has over the past 2 decades has shown a large propensity for attempt

I won't believe this ruling is safe until it goes thru higher levels. The Executive Branch has over the past 2 decades has shown a large propensity for attempts to disregard the 4th and 5th amendments, and I see no change in this posture or the attempts to subvert them with the current political climate.

lgleason 8y ago
There is a high probability that this will be challenged at a higher level.
- gigatexal 8y ago
  Let’s hope the Supreme Court hears it and it stands.
  - trumped 8y ago
    I hope that it doesn't so that hopefully people will stop using their body as a password (it should only be used as a login name if you absolutely need to use it)
  - sonnyblarney 8y ago
    It won't stand because it's not pragmatic. The issue around 'passwords being in your mind' is interesting, but they'll move past it. If you have evidence of a crime on your phone, it must be part of the process. There's nothing remotely unlawful about search of property so long as there is merit, oversight, warrant etc.. Ultimately, this will be no different than searching your car. Now, the cops doing it without a warrant, shenanigans at the border, searchings stuff they should not be - this is all another matter entirely. There will be some weird scenarios around people 'forgetting' passwords etc. but otherwise, it's just a new angle on the same old thing. Those who would like to see better judicial reform I think should look elsewhere, into such issues as why/how warrants are issued, the transparency around them, etc..
    - chii 8y ago
      If the police can force you to unlock a safe, they should also be allowed to force you to unlock a phone. But, unlocking a phone should come with a lot of paper work and checks and balances to ensure that it's done only when really required?
      - manfredo 8y ago
        My understanding is that if you are in possession of a key to a safe then law enforcement or the court can compel you to produce the key. But if the safe has a combination, then the court cannot make you give up the combination as that may be self incriminating. Not to mention the practical aspects of trying to compel someone to give up a secret. What if they claim to have forgotten the combination? What if they actually _did_ forget? I imagine the situation with electronics will be similar. If a key to, say, an encrypted volume is stored on a flash drive then they may compel someone to produce it (analogous to a safe key). But if the drive is protected by a password, then the government cannot compel someone to provide the secret.
        dahfizz 8y ago
        I think that's why the article mentions finger prints and faceid. Those are the 'keys' to your phone.
    - richardthered 8y ago
      The problem with forcing someone to reveal a secret (e.g. a password), is that ultimately, there's no way to prove that someone actually knows the password. If I say that I forgot the password, and a judge throws me in jail for contempt of court, I could rot there forever. There is absolutely no way for me to ever prove that I truly forgot the password. You can't prove a negative. With fingerprints or face scanning, neither of these is an issue. You put your fingerprint on the device, or you scan your face. So, I think that forcing someone to reveal a secret that is purely in their head is fundamentally different than compelling other forms of access (physical keys, fingerprint scans, face scans, etc.). The physical access methods can be verified to either work or not. That's not true for mental secrets.
  - gammateam 8y ago
    The only way for this to stand is if the 9th circuit upholds the ruling and the Supreme Court declines to hear it Another circuit will disagree with the 9th circuit and the supreme is forced to take the case, they wont uphold a novel 9th circuit ruling There isnt an interpretation of the constitution possible for them to, and a the composition of the court makes this even more unlikely to pluck from thin air
ataturk 8y ago
Try 1-10, well maybe not 3, but don't give them any ideas.
AmericanChopper 8y ago
The judicial branch and the legislature have also been quite hostile to the 4th during that period. Its absolutely not a problem isolated to the executive.
- lukifer 8y ago
  Thank you, Antonin "Emails aren't Papers" Scalia.
  - nerdponx 8y ago
    What's the "emails aren't papers" thing in reference to?
    - AmericanChopper 8y ago
      Scalia had a pretty narrow interpretation of the 4th, and believed that ‘conversations’ in general were not ‘persons, houses, papers [or] effects’, meaning wiretaps were not within the scope of the amendment.
  - deleted 8y ago
    [deleted]
burtonator 8y ago
Bio identification is for usernames... not passwords. NEVER use a fingerprint or an iris scan for a password. That's insane! Just don't do it.
- Joky 8y ago
  What about a second factor for TFA?
  - spaceribs 8y ago
    I have a simple test for if I should use biometrics for something: Replace every instance of "New Biometric Tech" with "Social Security Number".
    - 77pt77 8y ago
      So it will become ubiquitous.
- parent5446 8y ago
  Most people don't have attackers going after them who are harvesting fingerprints to get into their devices.
  - mLuby 8y ago
    Am I wrong that an (inevitable) biometric data breach would mean this can be done on the cheap (if you were unlucky enough to have given your data to a third party)?
    - Godel_unicode 8y ago
      Yes, at least for finger prints. Getting the print is easy, especially with glass back phones, it's making a good enough fake that's non-trivial.
      - 8y ago
ransom1538 8y ago
"I won't believe this ruling is safe until it goes thru higher levels." Yes - right now, there are people being held indefinitely for not decrypting hard drives the US [1]. The law used is: "All Writs Act (28 U.S.C. § 1651)". As one judge said, "We don't want your password - we just want the hard drives in unencrypted state." https://www.bleepingcomputer.com/news/legal/man-who-refused-to-decrypt-hard-drives-still-in-prison-after-two-years/ https://www.bleepingcomputer.com/news/legal/man-who-refused-...
- 5ML 8y ago
  I fear I'll be barbecued for asking, but I must: What's the alternative? I am a privacy advocate and understand that the law can (and likely will) abuse a forced decryption law. However, the story you linked is about a _police officer_ who was suspected of child pornography. His sister reported him to the police and 'content stored on the encrypted hard drive matched file hashes for known child pornography content'. How can you look in the mirror and think he should go free without the evidence being examined? I couldn't live in a world where a suspect could say "Well, I forgot the password" and walk away Scott-free on such an ugly crime.
  - MapleWalnut 8y ago
    That's the cost of liberty.
  - vxNsr 8y ago
    > How can you look in the mirror and think he should go free without the evidence being examined? I couldn't live in a world where a suspect could say "Well, I forgot the password" and walk away Scott-free on such an ugly crime. This is the price we pay for an imperfect world, I'd rather a few murderers walk than many innocent men be imprisoned. Your balanced, nuanced idealism simply doesn't work at scale, you cannot assume that every judge, jury, and LEO will be good, so you've got to give the criminals rights even if you're pretty sure they're criminals. As a judge or LEO I'd have a much harder time looking in the mirror knowing I stole an innocent man's life than knowing that I might not have stopped every criminal.
rayiner 8y ago
It’s okay if you think we should not force people to unlock their phones pursuant to a criminal investigation. But it’s disingenuous to paint this as an attempt to “disregard” the 4th and 5th amendments. The Supreme Court in the 1950s and 1960s expanded the scope of those amendments far beyond the text. They turned the 4th amendment into a general purpose “privacy” amendment, even though the amendment doesn’t use that word or anything nearly as expansive. And they took the 5th amendment, which refers only to forcing someone to testify against themselves in a criminal case, and turned it into a broad protection against self incrimination. But that amendment doesn’t use the phrase “self incrimination” or anything nearly as broad. This is not novel. It’s always been the rule that the police can force you to turn over evidence in your possession, even though they can’t force you to serve as a “witness” against yourself. The idea that turning over a password is like forcing someone to testify against himself because it involves a mental recollection is already a very stretchy interpretation of the 5th amendment. Extending that even further to situations that aren’t testimonial in any way (Face ID or Touch ID) is hard to defend as a matter of Constitutional interpretation (even if you think it is good policy). The background principle of the law is that courts are entitled to all the evidence so they can find the truth. The amendments are exceptions to those rules created for specific purposes. But they are exceptions; they are not the rule. To the extent that anyone is trying to “bypass” something, folks reading those amendments unreasonably broadly are trying to bypass the general rule in favor of discovering evidence.
- foxhill 8y ago
  bear in mind that whilst the scope of those ammendments may have been, for want of a better term, “extended” (SC sets precedent for interpretation, as far as i’m aware, i.e. the amendments do not actually change), you must also bear in mind that the scope and power of the government has expanded incredibly since they were written. the concept of privacy, outside of say, what a married couple do in the bedroom, didn’t really exist when the constitution was created. devices that are essentially extensions to ones “self” in the digital world couldn’t even have been imagined, let alone the rights required to make that one as as free as the america that was being created.
  - 8y ago

lgleason 8y ago

There is a high probability that this will be challenged at a higher level.

gigatexal 8y ago
Let’s hope the Supreme Court hears it and it stands.
- trumped 8y ago
  I hope that it doesn't so that hopefully people will stop using their body as a password (it should only be used as a login name if you absolutely need to use it)
- sonnyblarney 8y ago
  It won't stand because it's not pragmatic. The issue around 'passwords being in your mind' is interesting, but they'll move past it. If you have evidence of a crime on your phone, it must be part of the process. There's nothing remotely unlawful about search of property so long as there is merit, oversight, warrant etc.. Ultimately, this will be no different than searching your car. Now, the cops doing it without a warrant, shenanigans at the border, searchings stuff they should not be - this is all another matter entirely. There will be some weird scenarios around people 'forgetting' passwords etc. but otherwise, it's just a new angle on the same old thing. Those who would like to see better judicial reform I think should look elsewhere, into such issues as why/how warrants are issued, the transparency around them, etc..
  - chii 8y ago
    If the police can force you to unlock a safe, they should also be allowed to force you to unlock a phone. But, unlocking a phone should come with a lot of paper work and checks and balances to ensure that it's done only when really required?
    - manfredo 8y ago
      My understanding is that if you are in possession of a key to a safe then law enforcement or the court can compel you to produce the key. But if the safe has a combination, then the court cannot make you give up the combination as that may be self incriminating. Not to mention the practical aspects of trying to compel someone to give up a secret. What if they claim to have forgotten the combination? What if they actually _did_ forget? I imagine the situation with electronics will be similar. If a key to, say, an encrypted volume is stored on a flash drive then they may compel someone to produce it (analogous to a safe key). But if the drive is protected by a password, then the government cannot compel someone to provide the secret.
      - dahfizz 8y ago
        I think that's why the article mentions finger prints and faceid. Those are the 'keys' to your phone.
  - richardthered 8y ago
    The problem with forcing someone to reveal a secret (e.g. a password), is that ultimately, there's no way to prove that someone actually knows the password. If I say that I forgot the password, and a judge throws me in jail for contempt of court, I could rot there forever. There is absolutely no way for me to ever prove that I truly forgot the password. You can't prove a negative. With fingerprints or face scanning, neither of these is an issue. You put your fingerprint on the device, or you scan your face. So, I think that forcing someone to reveal a secret that is purely in their head is fundamentally different than compelling other forms of access (physical keys, fingerprint scans, face scans, etc.). The physical access methods can be verified to either work or not. That's not true for mental secrets.
- gammateam 8y ago
  The only way for this to stand is if the 9th circuit upholds the ruling and the Supreme Court declines to hear it Another circuit will disagree with the 9th circuit and the supreme is forced to take the case, they wont uphold a novel 9th circuit ruling There isnt an interpretation of the constitution possible for them to, and a the composition of the court makes this even more unlikely to pluck from thin air

ataturk 8y ago

Try 1-10, well maybe not 3, but don't give them any ideas.

AmericanChopper 8y ago

The judicial branch and the legislature have also been quite hostile to the 4th during that period. Its absolutely not a problem isolated to the executive.

lukifer 8y ago
Thank you, Antonin "Emails aren't Papers" Scalia.
- nerdponx 8y ago
  What's the "emails aren't papers" thing in reference to?
  - AmericanChopper 8y ago
    Scalia had a pretty narrow interpretation of the 4th, and believed that ‘conversations’ in general were not ‘persons, houses, papers [or] effects’, meaning wiretaps were not within the scope of the amendment.
- deleted 8y ago
  [deleted]

burtonator 8y ago

Bio identification is for usernames... not passwords. NEVER use a fingerprint or an iris scan for a password. That's insane! Just don't do it.

Joky 8y ago
What about a second factor for TFA?
- spaceribs 8y ago
  I have a simple test for if I should use biometrics for something: Replace every instance of "New Biometric Tech" with "Social Security Number".
  - 77pt77 8y ago
    So it will become ubiquitous.
parent5446 8y ago
Most people don't have attackers going after them who are harvesting fingerprints to get into their devices.
- mLuby 8y ago
  Am I wrong that an (inevitable) biometric data breach would mean this can be done on the cheap (if you were unlucky enough to have given your data to a third party)?
  - Godel_unicode 8y ago
    Yes, at least for finger prints. Getting the print is easy, especially with glass back phones, it's making a good enough fake that's non-trivial.
    - 8y ago

ransom1538 8y ago

"I won't believe this ruling is safe until it goes thru higher levels." Yes - right now, there are people being held indefinitely for not decrypting hard drives the US [1]. The law used is: "All Writs Act (28 U.S.C. § 1651)". As one judge said, "We don't want your password - we just want the hard drives in unencrypted state." https://www.bleepingcomputer.com/news/legal/man-who-refused-to-decrypt-hard-drives-still-in-prison-after-two-years/ https://www.bleepingcomputer.com/news/legal/man-who-refused-...

5ML 8y ago
I fear I'll be barbecued for asking, but I must: What's the alternative? I am a privacy advocate and understand that the law can (and likely will) abuse a forced decryption law. However, the story you linked is about a _police officer_ who was suspected of child pornography. His sister reported him to the police and 'content stored on the encrypted hard drive matched file hashes for known child pornography content'. How can you look in the mirror and think he should go free without the evidence being examined? I couldn't live in a world where a suspect could say "Well, I forgot the password" and walk away Scott-free on such an ugly crime.
- MapleWalnut 8y ago
  That's the cost of liberty.
- vxNsr 8y ago
  > How can you look in the mirror and think he should go free without the evidence being examined? I couldn't live in a world where a suspect could say "Well, I forgot the password" and walk away Scott-free on such an ugly crime. This is the price we pay for an imperfect world, I'd rather a few murderers walk than many innocent men be imprisoned. Your balanced, nuanced idealism simply doesn't work at scale, you cannot assume that every judge, jury, and LEO will be good, so you've got to give the criminals rights even if you're pretty sure they're criminals. As a judge or LEO I'd have a much harder time looking in the mirror knowing I stole an innocent man's life than knowing that I might not have stopped every criminal.

rayiner 8y ago

It’s okay if you think we should not force people to unlock their phones pursuant to a criminal investigation. But it’s disingenuous to paint this as an attempt to “disregard” the 4th and 5th amendments. The Supreme Court in the 1950s and 1960s expanded the scope of those amendments far beyond the text. They turned the 4th amendment into a general purpose “privacy” amendment, even though the amendment doesn’t use that word or anything nearly as expansive. And they took the 5th amendment, which refers only to forcing someone to testify against themselves in a criminal case, and turned it into a broad protection against self incrimination. But that amendment doesn’t use the phrase “self incrimination” or anything nearly as broad. This is not novel. It’s always been the rule that the police can force you to turn over evidence in your possession, even though they can’t force you to serve as a “witness” against yourself. The idea that turning over a password is like forcing someone to testify against himself because it involves a mental recollection is already a very stretchy interpretation of the 5th amendment. Extending that even further to situations that aren’t testimonial in any way (Face ID or Touch ID) is hard to defend as a matter of Constitutional interpretation (even if you think it is good policy). The background principle of the law is that courts are entitled to all the evidence so they can find the truth. The amendments are exceptions to those rules created for specific purposes. But they are exceptions; they are not the rule. To the extent that anyone is trying to “bypass” something, folks reading those amendments unreasonably broadly are trying to bypass the general rule in favor of discovering evidence.

foxhill 8y ago
bear in mind that whilst the scope of those ammendments may have been, for want of a better term, “extended” (SC sets precedent for interpretation, as far as i’m aware, i.e. the amendments do not actually change), you must also bear in mind that the scope and power of the government has expanded incredibly since they were written. the concept of privacy, outside of say, what a married couple do in the bedroom, didn’t really exist when the constitution was created. devices that are essentially extensions to ones “self” in the digital world couldn’t even have been imagined, let alone the rights required to make that one as as free as the america that was being created.
- 8y ago