11 ms·
EFF: forced disclosure of encryption password violates 5th Amendment
- RexRollman 15y agoI support the EFF in this case because the government is trying to compel this woman to assist in her own prosecution and I feel that is just plain wrong.
- tlrobinson 15y agoThis seems obvious to me. Why is it up for debate?
- bpd1069 15y agoUntil there is a law on the books or a judicial precedent it's debatable. The state/prosecution understands this process and will move forward until the above debate is settled. I understand it as providing your passphrase/word is providing what you 'know', one of the three tiers of authentication. This in it self is testimony.
- ams6110 15y agoThe counter argument is that the encrypted hard drive is like a locked filing cabinet in your house, which can be searched if a proper warrant is obtained.
- cft 15y agoDo you need to provide a key for a locked filing cabinet to the authorities though? They are free to break the lock with a proper warrant.
- karzeem 15y agoYou don't need to provide the key, just access to the contents. Or they can break the lock. But an encrypted drive is like an unbreakable lock.
- tlrobinson 15y agoIf you had an uncrackable safe could they compel you to open it though?
- karzeem 15y agoYes. They can't compel you to give them the means to open it (e.g. tell them the combination), but you can be forced to open it for them.
- jdhopeunique 15y agoOne could also say an encrypted hard drive is like the GPS location of a coffin containing a dead body. Can the authorities compel you to reveal the GPS coordinates of the body? If you deny any knowledge or reveal that you "forgot" the coordinates, could you be compelled to provide access to the evidence? What about GPS coordinates to a stash of drugs? At what point does revealing incriminating information become protected by the 5th amendment?
- karzeem 15y agoSuppose you've been charged with a crime and the police have obtained a warrant to seize the contents of a safe you keep in your house. American courts have ruled that the 5th Amendment does not protect you from being compelled to open the safe. That precedent doesn't bode well for this case. I don't see a qualitative difference between the contents of a safe and those of an encrypted drive. One workaround: fail-deadly. Automatically wipe the encrypted data if the password isn't entered every n days. With a small enough n, the courts can't move fast enough to get the data before it's gone. (Whether this scheme constitutes obstruction of justice, I have no idea.)
- epochwolf 15y ago> Whether this scheme constitutes obstruction of justice, I have no idea. Not a lawyer but... Courts seem to treat programs as proxies for their owners so if it's a program actively doing some kind of destruction then it probably would be. If you could ensure passively, that the data would become unusable after a certain time period it wouldn't. A physical example would be an briefcase rigged with small explosives. Opening it without the code or waiting to long to enter the code would trigger it to destroy the contents. I imagine this would be considered willful destruction of the contents. On the other hand, if the materials inside could decay into ash in a short time peroid, then it's not willful destruction.
- karzeem 15y agoThat would probably be the best defense. If the destruction was carried out as part of a regularly scheduled program instead of as a specific response to law enforcement's demand for the data, you might be alright. Lots of companies automatically delete all email older than six months for this exact reason, actually.
- lurchpop 15y agoi think they could argue obstruction/destruction of evidence with the dead-man's switch thing. although a legit counter argument is the wipe is a general security measure to protect the data. if we saw phones as if they were our credit/debit cards that would be a perfectly reasonable security measure to prevent against theft.
- Sapient 15y agoI am not an American, but I can't imagine that this will ever hold up. In a world where filing cabinets and office safes are vanishing, the courts would be cutting off access to a major source of evidence they need for successful prosecutions. Financial crimes would become much harder to prosecute, and many "digital" crimes could become impossible. I just cant imagine your government allowing that. The only alternative I can imagine is them making unbreakable encryption illegal for civilian use.
- ajross 15y agoIllegal strong encryption was, in fact, the law for many years. It was changed only when it was realized that the lack of robust security was harming the emerging "e-commerce" markets. Certainly it wasn't due to a concern about 4th and 5th amendment rights.
- jdhopeunique 15y agoCertainly the export of strong encryption technology was illegal, but the domestic use was not as far as I'm aware. Which law made strong encryption illegal?
- deleted 15y ago[deleted]
- nl 15y agoStrong encryption was never illegal, but there was speculation that the Clipper chip[1] was the first step towards making it so. [1] http://en.wikipedia.org/wiki/Clipper_chip http://en.wikipedia.org/wiki/Clipper_chip
- vonSeckendorff 15y agoI was under the impression that previous rulings with regards to safes and keys did not carry over to combinations, i.e. one could be compelled to surrender a key but not the combination to a safe. Whatever the case, I think it's foolish to argue by analog. Do you think the government ought to have the right to invade a person's mind and analyze its contents? I find that idea repugnant - under no circumstance should the mind be available to third party scrutiny. Personally, I consider my laptop as an extension of my mind. Much in the same way I don't go around sharing every errant thought I have with the world, I have password protected my laptop and encrypted its contents. I concede that my personal feelings do not make for a convincing argument, so instead consider this: In the future, probably in the very near future, computers will directly interface with the brain and will provide all sorts of computational assistance - information search, number crunching, memory storage and lookup, communication we can hardly dream of... Cybernetic implants would indeed be an extension of one's mind, and I think most of you here would argue for its protection. The users of these devices would be living in a dystopia if they had to censor their thoughts and usage of their cybernetic brains! And well, frankly, I don't see much of a difference between a neural interface and a digital (fingers) interface.
- nl 15y agoDo you think the government ought to have the right to invade a person's mind and analyze its contents? I find that idea repugnant - under no circumstance should the mind be available to third party scrutiny. Government are already doing that. There are already numerous precedents for compulsory polygraph tests[1], which would provide a precedent to use a more effective mind interface. [1] eg: http://en.wikipedia.org/wiki/Polygraph#Use_with_sex_offenders http://en.wikipedia.org/wiki/Polygraph#Use_with_sex_offender...
- hncommenter13 15y agoI am not a lawyer, but note that the original article (describing an amicus brief filed by the EFF, which is essentially an argument submitted by a party not involved directly in the case) is talking about 5th amendment rights, not 4th amendment. The 4th amendment covers search and seizure (the case of a locked file cabinet inside a home for which a proper search warrant has been obtained), while the brief is focused on the 5th amendment question--is providing a password testimonial? The key question is not whether the information on the laptop must be disclosed to the government (we assume the subpoena is proper and if the laptop were unencrypted, the government would have the right to use it at trial), but whether the act of providing the password demonstrates a key element of the crime: that the defendant had control over the laptop and can therefore be assumed to been aware of/responsible for the creation of its contents. In other words, is providing the password a neutral fact--as in Hiibel vs. 6th Judicial District of Nevada, where the Supreme Court found a law requiring individuals to provide a name when stopped legally by law enforcement--or is it self-incriminatory? The Supreme Court has ruled on similar questions in several instances. See http://volokh.com/posts/1197763604.shtml http://volokh.com/posts/1197763604.shtml for a discussion from a law professor who specializes in 4th/5th amendment issues.
- linuxhansl 15y agoI am somewhat on the fence with this one. If the police comes to your house with a warrant, they have the right to search your house. You cannot actively stop them, but do you have to help them searching your place? I.e. do you have to open the door or hand over the keys to the house? Or - maybe more to the point - show them where your hiding places are? IANAL, but my gut reaction would be that on ethical grounds you do not have to help in the collection of evidence against you. If the police cannot decrypt your drive that is their problem, not yours.
- teeray 15y agoEncryption is not like a safe. In a safe, you close the door, lock it, and the contents remain unaffected. Cutting through the back of the safe would yield the same contents. In this way, safes are more like BIOS passwords. The password is written to the hard drive and the BIOS acts as a gatekeeper. However, there's no reason you couldn't use a BIOS designed to ignore the presence of a password. If we were to design a physical analog to encryption, it would be more like a matter scrambler. You place your diamonds, jewels, insurance papers, etc. (or, in this case, incriminating evidence) onto a platform and enter a password. The contents of the platform are TRANSFORMED into a pile of pebbles, dirt, and dust which you sweep into a bag. The bag's contents are indistinguishable from anything else in your yard (Remember, GOOD encryption is indistinguishable from randomness as both encrypted data and random numbers do not compress well). The proper password will cause the matter scrambler to reproduce the valuables but otherwise will just yield more dirt, dust, and pebbles. It is therefore an ACTIVE process to reproduce incriminating evidence in a case by decrypting data. One is not providing access to already existing evidence, one is PRODUCING it from pure garbage. Ordo ad chao ac ordo ab chao.
- biot 15y agoAnd TrueCrypt's plausible deniability lets you provide a password that reconstitutes the scrambled matter back into a McDonald's Happy Meal.
- boredguy8 15y agoThe only way the password itself can be self-incrimination is if it's something along the lines of "fraudrealestateisfun". The government said, "Fine, don't tell us the content of the password: enter the password so that we can access the contents of what's behind it." People's arguments that you have an expectation of privacy are irrelevant: you have a genuine expectation of privacy in your home. If the state shows there's a compelling interest to enter your home (i.e. obtains a warrant), you can't stop them. Similarly, you can't stop them from decrypting your data. Well, you can, but you're going to suffer as a result. Similarly, you don't have to show your hiding places. Suppose you had an encrypted folder structure and one of the folders was hidden to someone who doesn't understand how to see hidden folders. You don't have to say "there's a hidden folder", just like you don't have to say, "There's a false floor." Encryption isn't a 'hiding place': they've found the data. Encryption is a locked door. The state wants to know what's behind it. Opening your front door to the police holding a warrant isn't self-incrimination (i.e. it in no way points to your guilt or innocence). Similarly, entering the password to your encrypted drive isn't self incrimination if the state has proved you're the sole possessor of the device. Although the only way the password content can be incriminating is via the language of the password, the fact that a password works on a particular machine may be incriminating. This is the only line of argument that could work, for what it's worth, and none of these 'privacy' lines of argument. "Your honor, the state has no compelling basis for thinking my client had possession or knowledge of the drive in question. Compelling my client to enter a password on the chance it could unlock the files would prove that they did have possession or knowledge of the drive." &c. But once the state can show it's your encrypted data, it's game over. Fortunately, it's this "foregone conclusion" line of argument that the EFF actually pursues, and not the 'Privacy' line that seems to be popular in these replies.
- RyanKearney 15y agoSo why can't everyone just claim they forgot their password? Additionally, what stops you from setting up some kind of hard drive degausser inside your case that is set to go off if the case is moved? Would you be responsible if the police officer removing your computer from your home inadvertently set off the degausser?
- blhack 15y agoWould it be totally ridiculous to argue that the encryption key is more like instructions for constructing data? "Take these raw materials, and run the machine according to these instrctions:" seems functionally equivalent to "take this chunk of useless data, and run the machine according to this decryption key:". An incorrect decryption key produces data, it just produces garbage data, yes? This would be the same as providing poor instructions to the machine. In this way, the court isn't asking you to reveal evidence, they're asking you to construct if for them. Once it's been encrypted, it's been destroyed. "Decrypting" is analogous to "rebuilding".
- dreamdu5t 15y agoThe purpose of encryption is to obscure and prevent access to data, not store it.
- Jarred 15y agoThat's all a matter of perception though, no? Encryption is capable of storing data, therefore it can be used legitimately to do that. Just like most people use fans to cool people down during the summer, but people also use fans on large semi-rectangular pieces of metal to create hovercars.
- ojilles 15y agoUnder that definition encryption equals /dev/null. It's a way to store data while limiting access to said data.
- mahadri 15y agoThe decryption key doesn't construct data anymore than the combination to a safe constructs the papers inside it. The data exist independently of anyone's ability to read them.
- Groxx 15y agoWhat does that mean for XORing your data with an equal-sized chunk of truly random data (pulled from, say, http://www.random.org/ http://www.random.org/ )? From an information standpoint, the data is gone because the result is also truly random, and doesn't exist any more except in the combination of the output and the key.
- spoondan 15y agoEncryption is not just something computers can do. You can encrypt your handwritten notes. If you do so, can the government compel you to tell them what you have written? If they cannot, how is this different from having a machine act as your agent in the encryption?
- hammock 15y agoGreat point. I am reminded of organized crime outfits who keep two ledgers, the real one being encrypted. There has to be some case law on that somewhere.
- cookiecaper 15y agoI agree that this is the best analog. I posed the same question in a similar discussion a couple of weeks ago. Can the government compel a defendant to decode a handwritten note or provide the key to the cipher? If so, this is the applicable precedent, much more than safes or doors. As a sibling comment states, there has to be case law on this. I'd be interested in the comments from any HN users in the know.
- ldar15 15y agoIANAL, but the 5th circuit appeals court has ruled that the 5th amendment means that a person cannot be forced to give up the combination to a lock. It is informational, and it is testimony. Any discussion of a physical key is without merit. A physical key, is not the same as a "encryption key". For the purpose of law, an "encryption key" is the same as a combination to a safe. There's actually a ton of precedents on this. Google 5th amendment and combination lock. The reason it is testimony is because if you provide a password and it works then you've just proven that the contents are yours: you have incriminated yourself. If the prosecution can prove that the contents are yours without the password, then at that point you can be forced to give up the password. Takeway: your encrypted drive had better have a different password than your login, and you'd better be able to deny that it is yours. EFF will win.
- tzs 15y agoKnowing the password to encrypted data does NOT prove that the data is yours. People often know other people's passwords.
- WettowelReactor 15y agoIf the data is incriminating then you may be just as liable under the law.
- molecule 15y ago"Enter Passphrase for /Devices/DOOMSDAY/:"
- dchest 15y agoMost of comments and articles about this issue focus on encryption, but I'd argue that authentication is far more important part for this discussion. When using stream ciphers you have two pieces of data of exactly the same length, which you merge (XOR) together to get a third piece of data. (Stream ciphers are essentially just a way to extend your short piece of random data into the longer piece of data -- keystream -- of the message length). Thinking this way, "key" is not at all like door key, not a combination lock, and not instructions for constructing data -- it's just another piece of data, which you possess, maybe in your mind only. It's called "key" only for convenience. Now, after encryption, you own two pieces of information -- keystream and encrypted text. There is no right way to produce the original data unless you know what the original data is: any way of combining encrypted texts with any other data will produce correct results, but not always the original data. The meaning of the result depends only on interpretation; and the only way to learn with 100% certainty that the decrypted data is really the original data is to ask you (provided that you don't lie). For example, it is theoretically possible that "I love US" encrypted with one keystream and decrypted with a different keystream will produce "I'm a spy", but only you can certify that this interpretation is wrong, because you know what the original said. And the only way to learn this, is to ask you to testify against yourself. In order to have an interpretation that the decrypted data is the original data with less than 100% certainty, but without having to ask you, is to use authentication. You have authenticated data, for example, by applying some authentication function, and providing the result of the authentication function along the encrypted text. What do authentication functions do? They tell, with some limited but high probability, that you used this keystream and/or that plaintext to produce encrypted text. Let's say, you used HMAC for authentication. By applying HMAC with your "key" (it can be derived from the encryption key or just a new piece of data), for example, to encrypted text, you certified that this "key" was used to encrypt original data. Is it an act of testifying against yourself to provide the piece of information (authentication key) that will tell with high probability that the original data is the decrypted data (or the keystream is the one used for encryption)? (PS I know that courts don't deal with 100% certainties, but forget about it for a moment :)
- ataggart 15y agoIn the a whirlwind of broken analogies and broken precedent, one question seems to be largely missing: what grants the federal government the power to compel someone to assist in their own prosecution? The 4th Amendment, via the warrant provision, grants the power to search places and seize persons or things. It does not grant the power to compel individuals to open their doors or put on their manacles. The 5th states in part: "nor shall [any person] be compelled in any criminal case to be a witness against himself". Many act as if the existence of a specific prohibition is a grant of power in every other area. Alexander Hamilton's objections in Federalist No. 84 seem quite prescient: I go further, and affirm that bills of rights, in the sense and to the extent in which they are contended for, are not only unnecessary in the proposed Constitution, but would even be dangerous. They would contain various exceptions to powers not granted; and, on this very account, would afford a colorable pretext to claim more than were granted. For why declare that things shall not be done which there is no power to do? Why, for instance, should it be said that the liberty of the press shall not be restrained, when no power is given by which restrictions may be imposed? I will not contend that such a provision would confer a regulating power; but it is evident that it would furnish, to men disposed to usurp, a plausible pretense for claiming that power. The great unintended consequence of modern constitutional arguments has been to change the perception of the federal government from one defined by a closed set of powers, into one defined by a closed set of prohibitions.