3 ms·

If you don't want this to happen to you, PIN-lock your phone. They'll ask you for the PIN. You'll refuse. They'll get a warrant almost instantly, and then you w

If you don't want this to happen to you, PIN-lock your phone. They'll ask you for the PIN. You'll refuse. They'll get a warrant almost instantly, and then you won't be able to refuse anymore. I was under the impression that in the US you can't be compelled to disclose your password or encryption key, even with a warrant. http://en.wikipedia.org/wiki/Key_disclosure_law http://en.wikipedia.org/wiki/Key_disclosure_law

tptacek 16y ago
It looks like you're totally right to point this out, but the situation is not "you have the right to refuse to disclose a key"; its, "you may or may not also be charged with obstruction if you refuse a warrant that demands a key, and the case law isn't settled". Since we're talking about PINs here, by the way, this is a moot point; presumably any major LEO can contract out "recover data on PIN-protected phone".
- phuff 16y ago
  Having worked for a computer forensic software company I can tell you that these days they most likely don't have to contract it out even... It's cheap enough that a lot of departments have people on staff who can recover data easily from all kinds of devices.
  - gst 16y ago
    If you use the SIM cards SMS storage (on a GSM phone) it's not that trivial to obtain the PIN. However, it's very likely that your mobile provider is able to gain access to the card (e.g., by using the PUK code to reset your PIN code). Other means would be to use an application such as TextSecure (for Android) that uses public key encryption to immediately enrypt all incoming SMS and that requires a password to unlock the private key needed to decrypt the SMS. In the long-term what I'm waiting for is some open-source Android fork that provides full-root encryption using LUKS. This should suffice in preventing others from reading your messages.
  - naner 16y ago
    Digital data is easy to fake, though. Wouldn't it be more prudent to have the analysis done by a third party?
- fleitz 16y ago
  Probably the best idea is to create a personal data policy wherein you document a standard practice to delete unnecessary electronic data at specified intervals and change your PIN at other intervals. Given the amount of identity theft it's a very prudent practice that prevents criminals and other unauthorized parties from accessing your data.
mcritz 16y ago
You have a fifth amendment right not to say anything that might incriminate you. Police can’t force you to reveal your accomplices, what bank deposit box you hid the cash in, or where you dumped the body. The smartest thing to say to police is “I want my lawyer present.”

tptacek 16y ago

It looks like you're totally right to point this out, but the situation is not "you have the right to refuse to disclose a key"; its, "you may or may not also be charged with obstruction if you refuse a warrant that demands a key, and the case law isn't settled". Since we're talking about PINs here, by the way, this is a moot point; presumably any major LEO can contract out "recover data on PIN-protected phone".

phuff 16y ago
Having worked for a computer forensic software company I can tell you that these days they most likely don't have to contract it out even... It's cheap enough that a lot of departments have people on staff who can recover data easily from all kinds of devices.
- gst 16y ago
  If you use the SIM cards SMS storage (on a GSM phone) it's not that trivial to obtain the PIN. However, it's very likely that your mobile provider is able to gain access to the card (e.g., by using the PUK code to reset your PIN code). Other means would be to use an application such as TextSecure (for Android) that uses public key encryption to immediately enrypt all incoming SMS and that requires a password to unlock the private key needed to decrypt the SMS. In the long-term what I'm waiting for is some open-source Android fork that provides full-root encryption using LUKS. This should suffice in preventing others from reading your messages.
- naner 16y ago
  Digital data is easy to fake, though. Wouldn't it be more prudent to have the analysis done by a third party?
fleitz 16y ago
Probably the best idea is to create a personal data policy wherein you document a standard practice to delete unnecessary electronic data at specified intervals and change your PIN at other intervals. Given the amount of identity theft it's a very prudent practice that prevents criminals and other unauthorized parties from accessing your data.

mcritz 16y ago

You have a fifth amendment right not to say anything that might incriminate you. Police can’t force you to reveal your accomplices, what bank deposit box you hid the cash in, or where you dumped the body. The smartest thing to say to police is “I want my lawyer present.”