17 ms·
Suspect can’t be compelled to reveal “64-character” password, court rules
- beatgammit 7y agoNice. This is yet another reason why I avoid biometrics for authentication, and I'm glad that the court backed up my assumption that it is more secure. In this particular case, I hope this perpetrator is convicted regardless (assuming he's guilty, that is), but I'm glad the courts agree that nobody should be compelled to give up information. This is a big win for privacy.
- seibelj 7y agoAnother good point is that biometrics aren’t secure. They invest millions and billions in fingerprint and eye scanner systems that get fooled by scotch tape. Just not effective security.
- rhinoceraptor 7y agoIt's better than no security. Most people aren't going to use a secure pin code on their phone.
- pshc 7y agoExactly. I have accidentally witnessed so many 4-digit PINs typed into phones by friends and casual acquaintances. It’s kind of unavoidable if you spend any reasonable amount of time in person with them. Very few people in my experience go the extra mile to set a long fulltext passphrase on their phone.
- anoncake 7y agoIt's effective against nosy people which is probably the main threat for most people.
- saagarjha 7y agoDepends on the device.
- lstodd 7y agoIt doesn't.
- andyv 7y agoBiometrics are a userid, not a password.
- smt88 7y agoNot on iOS or Android phones. On most recent phones, they're both.
- djsumdog 7y agoWhich is why I will never enable fingerprint or face unlocking ever. I'm fine with physically typing in my password. I like real security.
- dannyw 7y agoFor the average user whose password is 0000, maybe face unlocking IS more secure for them.
- luxuryballs 7y agounfortunately for that user, face unlock doesn’t disable passcode unlock
- leokennis 7y agoI have an iPhone with Face ID and an 8 digit passcode. If I were to be arrested or whatever, all I need to do is press the power button 5 times in quick succession and Face ID is disabled and my passcode is required. So I can choose: - Unlock my phone with ease for 10’s of years and then quickly lock it once - Struggle to unlock it for 10’s of years to avoid having to quickly lock it once
- Crosseye_Jack 7y agoIf you enable voice control in accessibility you can reboot the device using a voice command “reboot this device”. After which you will need your passcode/word to unlock the device. Handy if you foresee a time you won’t be able to reach your device and tap the unlock button 5 times.
- jonstewart 7y agoHow will he be convicted if the primary evidence is on his computer? My geek half that believes in strong 4th and 5th Amendment tights and crypto thinks this is a fine decision. My forensics half bets this guy has gigabytes of atrocious child pornography on his system and that CP cases are the motivating factor for the police wanting to decrypt your hard drive in 99 out of 100 cases with a search warrant. These cases are not abstractions; every pic is of a child who was abused and the perpetrators organize themselves into networks that include distributors and abusers/“content producers.” How is justice served if these networks can’t be rolled up due to full disk encryption? I like encryption. I don’t want to be compelled to give up my password to a tyrannical government. But I think the tech community is quick to take an absolutist view of the right to strong crypto, and quick to discount that harm can happen as a result. I also don’t think that view is shared by most people... so it seems like a problem worth solving.
- ClumsyPilot 7y agoDon't we have other forms of surveillance, installing of cameras/microphones in people's homes and sting operations that could help catch people? I think that demanding citizens incriminate themselves is an especially lazy form of justice.
- jonstewart 7y agoI don’t think such techniques are readily and cheaply available to most police departments.
- vunie 7y agoThat's a good thing. It forces the police to actually do their homework rather than invade people's privacy whenever they want.
- nickpsecurity 7y agoSchneier et. al.'s Keys Under Dormats paper tackles that problem from many angles. You might find it interesting. https://www.schneier.com/academic/paperfiles/paper-keys-under-doormats-CSAIL.pdf https://www.schneier.com/academic/paperfiles/paper-keys-unde...
- dependenttypes 7y agoI hope he doesn't. We don't need more lives ruined for victimless crimes/thought crimes.
- tzs 7y agoChild porn is victimless?
- cuvzxvcmew 7y agoTo me the possession of child porn is victim-less, just as the possession of media of murders is victim-less, or the possession of media of any other crime is victim-less. The purchasing of media of a crime is dubious, as it may serve to reward people who commit that crime, and the committing of these crimes almost always has a victim (excluding cases for example someone wanting to be murdered or something). The prosecution of these cases seems to look a lot like crimes of morality than crimes that directly impact someone else's life and happiness. Sometimes I've heard people say that the mere fact of media existing of a crime that they were in hurts them, and hurts them more when people watch it. But to me, prosecution of these cases, if anything makes one more aware of people watching media of these things, not less. The thing that bugs me the most about these sorts of prosecutions of "thought crimes" is that the trail from the "thought criminal" to the actual crime is always hazy, and definitely not 1-1. E.g Imagine someone who was really into collecting child porn as some kind of bizarre stamp collecting type of thing. They were never into it per-se, it was just some kind of messed up hobby. They'd trawl forums on the dark web and download every image they see, maybe write a script to do it. It would be very hard to trace a direct line to a victim there. More likely than not, particularly if no money ever changed hands, there probably wasn't a direct victim. Someone may have paid for it at some time in the past, but not the stamp-collector. It seems like these are crimes that convict people who hurt others, but also those who do not hurt others.
- Veedrac 7y agoI don't understand what's being defended here. The guy already admitted what's on the computer. Like, the EFF saying > "We store a wealth of deeply personal information on our electronic devices. The government simply should not put individuals in the no-win situation of choosing between disclosing a password—and turning over everything on these devices—or instead defying a court order to do so." This is deeply baffling to me as applied to this case. The personal information being ‘protected’ is not his property.
- deleted 7y ago[deleted]
- sebow 7y ago>The personal information being ‘protected’ is not his property. Care to explain a little bit further?What exactly is not his property? I might be wrong but it clearly says it was his computer,thus his property.Information is not something magical,it has a technical basis in reality and can be attributed to something that exists and has an owner. The password exists both in the suspect's head and in his computer.Him giving his password would be comparable to giving the keys to his property,which from what i understand legally falls under the protection of the stated amendment.
- mirimir 7y agoYeah, this is an extreme case. I mean, he reportedly said: > It’s 64 characters and why would I give that to you. We both know what’s on there. It’s only going to hurt me. No fucking way I’m going to give it to you. It seems like a totally dumbass thing to say. The standard advice is politely declining to answer, and requesting an attorney. But at least he didn't lie. And yes, it's true that the content isn't likely his, in the sense that he generated it or that it's about him. But it would -- as he admitted -- incriminate him. And the court affirmed that he has the right to not incriminate himself. What's especially interesting is that the court didn't agree that "We both know what’s on there." didn't moot protection against self-incrimination.
- mkoryak 7y agoI bet he did lie and its not 64 characters. He was probably saying that to make them not try to break his password12345.
- ballenf 7y agoWe need to change the analogy on these topics from “a passcode to a wall safe” to the encrypted computing device being seen as an extension of the person’s mind. When we encrypt information with a key known only within our mind, we are creating a cyborg like extension of our own mind.
- FakeComments 7y agoHow is that not analogous to a wall safe with my journal in it?
- michaelmrose 7y agoThere is nothing that is similar. The journal is a physical thing you can lay your hands on and the password exists only in the individuals mind. The act of producing it is both inherently testimonial and testimony to ownership of the contents of the data on the machine which is distinct from ownership of the machine. It is further impossible to distinguish between won't and can't unlock. Even if believed that you can subpoena the content of your skull you arrive at a situation where every criminal "can't remember"
- nine_k 7y agoIsn't there a right to not testimony against oneself?
- notimetorelax 7y agoThis was the point of the article.
- yxhuvud 7y agoNo, the point was that there was a ruling on it from a highly divided court that only applies to Pennsylvania. The article didn't really argue something like that. It only reported on a court case and really didn't say if they agree with the decision or not.
- jerezzprime 7y agoWhat would happen in the case where the perpetrator does not know the password? For example, I don't know the passwords to most of my accounts because they are random and stored in my password store. If I lost access to my password store, what would happen if the court demanded I provide the password to one of my accounts or encrypted files on my computer?
- djsumdog 7y agoHeld in contempt indefinitely?
- busterarm 7y agohttps://news.ycombinator.com/item?id=18907924 https://news.ycombinator.com/item?id=18907924 Francis Rawls has been for years now.
- wehrkeoruw 7y agoThey'd get you access to your password store, I assume.
- newguy1234 7y agoThey are talking about in situations where the password is so strong it cannot be bruteforced.
- celeritascelery 7y agoThough it does make me wonder if online password managers like lastpass or 1Password could hand that info over if authorities demanded it.
- Mirioron 7y agoI hope not. If they demonstrate that capability and word gets out then that will end their business. If they can give law enforcement access to your passwords then the employees of the company have access to the passwords too.
- Gatsky 7y agoThat quote where the self-avowed pedophile says ‘No fucking way’ is going to appear in every bill to increase law enforcement’s powers from now on. It’s an irresistible soundbite. The scumbag would have done better to just shut the hell up.
- Aeolun 7y agoOf course he would have. This is a fantastic example of how everything you say, can and will be used against you. But I think criminals being interrogated aren’t really of sound mind.
- XorNot 7y agoThey're not proven to be criminals at that stage. They're suspects, maybe, but no court has convicted them.
- Aeolun 7y agoFair enough. But that doesn’t really change my argument?
- vageli 7y ago> Fair enough. But that doesn’t really change my argument? I think the point (which bears repeating) is that suspects are not criminals until proven so in a court, and it's important to be careful in our language, especially in our modern times where the court of public opinion operates swiftly and without due process.
- Aeolun 7y agoIt’s one thing if they deny the accusations, but if they agree with them...
- PopePompus 7y agoWhich is always true, at least in the US. The police are allowed to lie to you during questioning. They are allowed to claim they have evidence that they do not have. No amount of lying on their part will invalidate any "confession" they obtain from you. But if you even inadvertently tell the police something that is untrue, you can end up in prison for that, even if you committed no other crime. NEVER talk to the police, if there is any chance they suspect you are involved with a crime.
- mindslight 7y agoJust as there are signs of the "drug war" finally faltering, "child pornography" is primed to continue the erosion of generally held rights in service of a moral panic. This case itself is good news, but the everpresent problem is that the attackers are paid with public funds to try again and again until they succeed. Criminalizing mind altering substances seems downright practical compared to criminalizing patterns of bits.
- edjroot 7y agoTo play devil's advocate, aren't drugs just “patterns of molecules”? And can't patterns of bits be used for “mind-altering” purposes (broadly speaking, such as in this case)?
- mindslight 7y agoDevils advocate would be to engage with the core of an argument, rather than nitpicking my characterizations. The larger point there is that both of those actions don't themselves have any effect outside of some isolated context. This necessitates using invasive methods to police them and also uneven enforcement ultimately based on other circumstances. Each of these aspects causes terrible results that undermine the rule of law itself.
- JoeSmithson 7y agoThis "yOu cAn't mAkE nUmBeRS iLlEgAl" thing is one of the most annoying memes I've ever encountered. It's literally self defeating - you could just as easily say that he has no right to privacy for the contents of the harddrive because the contents of his harddrive is "jUsT aN iNtEgEr" and no integers are secret. Some patterns of bits are clearly and rightfully illegal.
- mindslight 7y ago> This "yOu cAn't mAkE nUmBeRS iLlEgAl" thing is one of the most annoying memes I've ever encountered. If you take any reference to a concrete phenomenon - the extreme difficulty of policing private data storage and communications - and pigeonhole it into a simplistic caricature, then it's no wonder you see that everywhere?
- einrealist 7y agoI wonder what would happen, if a criminal picks a passphrase that admits his crime. Since the defendant cannot be forced to self-incriminate himself, wouldn't that be a perfect defense?
- pas 7y agoCourts and the law doesn't work like that. (See the funny problem of which court would have jurisdiction if a murder would happen in some strange part of a forest, which happens to be Federal land, and also intersect some state borders, and at first glance the currently valid statutes say that the trial should be held somewhere where there's no judge because of some lines on a map.) But could you give an example of what kind of string could self-incriminate someone?
- jsjohnst 7y ago> But could you give an example of what kind of string could self-incriminate someone? You can conjure up the previous scenario but not one for this simple case? “I am guilty of XYZ offense” Seems like a pretty obvious example.
- pas 7y agoHow would that mean anything? It's just a password. A testimony is not anything you utter without context.
- jsjohnst 7y ago> A testimony is not anything you utter without context. Go ahead and get arrested and say incriminating statements without context. Let us all know how it goes!
- pas 7y agoIf you get to trial and the judge orders you to produce the password, then and there is the time to say it. It becomes a matter of public record, you don't even have to say it continuously, you can spell it, or whatever.
- Havoc 7y agoMeanwhile politicians regularly go with "I don't remember" if challenged in court.
- deleted 7y ago[deleted]
- fao_ 7y agoI would probably agree with the verdict if the defendant wasn't in a child pornography case and hadn't stated (FTA) "we both know what's on it, why would I [reveal my password]".
- JustSomeNobody 7y ago> Nevertheless, this constitutional right is firmly grounded in the “realization that the privilege, while sometimes ‘a shelter to the guilty,’ is often ‘a protection to the innocent.’” Moreover, there are serious questions about applying the foregone conclusion exception to information that manifests through the usage of one’s mind. I think they got it right. And as long a prosecution didn’t base their whole case on getting the password, they probably will still prevail.
- jonstewart 7y agoI’ve worked in the digital forensics space for many years and am not so confident. How do you prove possession of child pornography when there’s no evidence of possession?
- JustSomeNobody 7y agoThe defendant made the remark “we both know what’s on there”. I assume the prosecution has evidence.
- jonstewart 7y agoThey likely have probable cause that they used for a search warrant. I doubt there's much evidence for possession.
- UncleEntity 7y ago> I would probably agree with the verdict if the defendant wasn't in a child pornography case and hadn't stated (FTA) "we both know what's on it, why would I [reveal my password]". Which is the problem, they only try to push the boundaries on "indefensible" cases (because nobody cares about a pedophile) but then use their newly minted powers on everyone else.
- jhanschoo 7y agoThe perp can't reveal the password, but would the "foregone conclusion" doctrine still empower prosecutors to have him unlock his device?