10 ms·

DOJ: We can force you to decrypt that laptop

148 points by d0ne 15y ago

chopsueyar 15y ago
Begin the off-base analogies. Is the government's whole case dependent on the hypothetical contents of her laptop? I have to disagree with the Obama adminsitration's stance on this, and other "electronic" civil liberty positions.
chrisjsmith 15y ago
Does it matter? Governments are bullies. http://www.vvsss.com/grid/xkcd-on-crypto.gif http://www.vvsss.com/grid/xkcd-on-crypto.gif Here in the UK, we already have to hand over our keys or be chucked in jail.
- someone13 15y ago
  Original XKCD page, for posterity: http://xkcd.com/538/ http://xkcd.com/538/ And a direct image link from XKCD: http://imgs.xkcd.com/comics/security.png http://imgs.xkcd.com/comics/security.png
- lotharbot 15y ago
  Is there any reason you linked to a third-party site instead of xkcd itself? http://xkcd.com/538/ http://xkcd.com/538/ (easily googled -- xkcd crypto, first hit.)
  - chrisjsmith 15y ago
    Oh pedant, I thoroughly apologise for my ignorance. May my vegetables all die, my breath smell for eternity and my armpits flood with hair and engulf the earth.
    - cfaubell 15y ago
      It's not pedantry. Linking directly to the content's author makes sure that he is properly credited and gets the exposure.
quellhorst 15y ago
It is cases like this that makes me glad to donate to EFF.
- deleted 15y ago
  [deleted]
roc 15y ago
The truly interesting bit, will be when a case of (real or alleged) multiple hidden encrypted volumes is publicized. If the government feels the information they want is on a laptop, the laptop's owner would suddenly find themselves forced to prove a negative (there are no more hidden volumes), lest they be held in contempt. If they can seemingly compel you to reveal something they can't proven even exists and lock you up until you can prove that it doesn't, the door for abuses isn't even wide open; it'll have been removed from its hinges along with most of the wall.
- DavidSJ 15y ago
  US v Hubbell makes clear that the government cannot compel production of documents (except under immunity to prosecution) which it does not know, ahead of time, to exist.
  - roc 15y ago
    Then how can they compel someone to unlock a laptop to enable arbitrary access? Wouldn't they be limited to requesting specific documents?
    - sorbus 15y ago
      The legal system allows them to do things analogous to that, such as compelling someone to open a safe to enable arbitrary access to the contents (as mentioned in the article). Presumably they must suspect that the safe contains documents relevant to the case.
    - bhousel 15y ago
      Every case is a little different, but investigators do need probable cause to search a laptop. This is a mortgage fraud case involving years of criminal activity, so I'm guessing that it's probably not too hard for the prosecution to produce witnesses who can say "yes, she sold me that crappy mortgage and used her laptop when I went to meet with her.", or direct information of her internet usage (ISP, or logs from cable modem), or observation of her using the laptop by police during the investigation.
djackson 15y ago
It's easy to see why you wouldn't want someone to decrypt your laptop. What about Bernie Madoff? Wouldn't you be furious if all data produced by a corrupt hedge fund manager was encrypted? Wouldn't you want the DOJ to be able to hold them in contempt of court? If you hamstring your government, you aren't allowed to complain that it is ineffective.
- muuh-gnu 15y ago
  "The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all." -- H.L.Mencken
  - djackson 15y ago
    Yeah... no. There's a line, and past that line, law enforcement has no power to enforce laws at all. Removing the DOJ's ability to collect evidence is, in some cases, the equivalent to denying a detective access to a crime scene. If all productions of electronic evidence can be encrypted, and the defense is not forced to decrypt those files, then dirty corporations only need to encrypt everything to defend themselves in court. Defense: "We produced everything you asked for." Prosecution: "We can't even verify that statement. Decrypt it" Defense: "We don't have to." Case closed.
    - andrewcooke 15y ago
      rights are rights because they allow you to do what would otherwise be illegal. for example, there's no need for a right to free speech if you're only going to say things that everyone thinks should be said. rights exist because some things are so important they are worth the cost of abuse. At first blush it may be thought surprising that one should have a right to do that which one ought not. Is it not better to confine rights to that which it is right or at least permissible to do? But to say this is to misunderstand the nature of rights. One needs no right to be entitled to do the right thing. That it is right gives one all the title one needs. But one needs a right to be entitled to do that which one should not. It is an essential element of rights to action that they entitle one to do that which one should not. To say this is not, of course, to say that the purpose or justification of rights of action is to increase wrongdoing. Their purpose is to develop and protoect the autonomy of the agent. They entitle him to choose for himself rightly or wrongly. But they cannot do that unless they entitle him to choose wrongly. - Joseph Raz, The Authority of Law (p 266) the final sentence of the quote above is hugely important.
naner 15y ago
What happens to her if she doesn't know the password?
- bhousel 15y ago
  An obstruction of justice charge, probably. Here's a pretty decent page about the charge: http://www.federalcriminallawyer.us/2011/01/12/federal-law-on-obstructing-justice-a-summary/ http://www.federalcriminallawyer.us/2011/01/12/federal-law-o... tl;dr: "18 USC 1503 is a felony offense for which the sentence can be 10 years imprisonment."
  - naner 15y ago
    That seems to be imply that she is lying, though. What if she actually doesn't know the password? For example if it isn't her laptop or the password was written down and lost or it is an old encrypted volume which she doesn't use anymore, etc.
    - someone13 15y ago
      This is one of the reasons that I find the Fifth Amendment to be important. Without it, the DOJ could simply ask any murder suspect to reveal where they stashed the body and murder weapon, charging them with obstruction of justice or contempt of court if they didn't answer. This, of course, would be a serious problem if the accused didn't actually commit the crime.
      - tedunangst 15y ago
        There is a difference between the DOJ asking you to provide access to information and asking you to provide the information itself.
        mahyarm 15y ago
        There is a difference between the DOJ asking you to provide access to / the location of the body and asking you to provide the body itself.
d0ne 15y ago
IANAL ( Edit to include a reference for my opinions[1] ) The general argument for forcing someone to turn over the key to a door once compelled by the court is that it is commonly known there are other reasonable means by which to access the content the door protects that do not require the key: 1) Locksmith 2) Break the door down 3) Use a different door if one exist These are reasonable methods as neither of them take a considerable amount of time, in many cases a reasonably consistent amount of time between unique cases, and are methods that are readily available in all markets and jurisdictions. This makes the case that the contents behind the door can be accessed through various methods, some of which do not require my involvement, therefor my not turning over the key is only nominally delaying the inevitable. In the case of an encryption key that protects data, which once protected is only in the possession of the individual who also posses the key, this is very different IMHO. It is very different for this simple reason: If proper procedures have been followed, and certain encryption methods have been utilized, there is no reasonably consistent method for acquiring the original data other than information I posses in my mind. I say reasonably consistent because if you had limitless resources and limitless time you could try every possible combination and at some point gain access. That is, however, unless the mechanism that relays the encryption key is not designed in a way as to destroy the data after N failed attempts. In either case, no court can be reasonably certain of the time it would take to access the original data or if they would ever gain access at all. This directly conflicts with my right to a speedy trial and certainly conflicts with my right not to incriminate myself as I'm the only one who can provide access within a reasonable amount of time. [1] http://news.cnet.com/8301-13578_3-9834495-38.html http://news.cnet.com/8301-13578_3-9834495-38.html
- OzzyB 15y ago
  Right, so the Government's demand of my encryption key to unlock the contents of my "digital brain" is no less different than the Government forcing me to take some truth serum to force me to reveal something I don't wish too... because it would incriminate me. And as far as I'm concerned, the 5th protects me from incriminating myself.
- nodata 15y ago
  I think this was discussed here the other day (can't find the link, sorry). The thinking went something like this: a passphrase is equivalent to a combination wall safe and not to a lock with key: one requires a physical thing to open it, the other requires something within your head. The something within your head is equivalent to testimony.
shareme 15y ago
What we are actually seeing is how far behind the DOJ and FBI are behind in having competent computer forensics professionals as part of their human resources.. We saw the same thing with the Patriot Act..do not have proper staff? than by God make sure that the US constitution suddenly does not apply if traveling outside the US..
- 16s 15y ago
  They have plenty of competent computer forensics guys and equipment. But even with all of that, proper encryption with a strong passphrase is infeasible to attack. Forcing the key holder to disclose the key is the easy, inexpensive first step.
deleted 15y ago
[deleted]
hammock 15y ago
Thorough and detailed commentary here in yesterday's thread: http://news.ycombinator.com/item?id=2744688 http://news.ycombinator.com/item?id=2744688
hippich 15y ago
"Decrypting the data on the laptop can be, in and of itself, a testimonial act--revealing control over a computer and the files on it," said EFF Senior staff attorney Marcia Hofmann. I believe this is enough to get protection under 5th amendment. Giving password or providing decrypted content is already testimony against yourself saying that you control these files..
grecy 15y ago
It's pretty astounding to me that if you write sometime in "code" (read: another language) you have to provide a way to "translate it" (into English I presume). It's not my problem if others can't read my brain dumps.
Shenglong 15y ago
Prosecutors stressed that they don't actually require the passphrase itself, meaning Fricosu would be permitted to type it in and unlock the files without anyone looking over her shoulder. I wonder if anyone has thought of using more than one keys as a decryption possibility. I've always considered it, but never figured there'd be too much use. Say, have one correct key to decrypts data stored in one way, and another key to either "decrypts" into a pre-generated text, or another variation of what's stored. I guess it latter might be too content dependent.
- jarin 15y ago
  Truecrypt has supported that kind of plausible deniability for a while.
  - themenace 15y ago
    And there is a system called Deniable Video extends that concept of plausible deniability to live audio & video. It's like TrueCrypt for real-time data.
- a3_nm 15y ago
  Systems like PhoneBookFS, rubberhose and StegFS exist (or used to exist). They allow you to create volumes which can provide different data for different passwords, with no way to know the number of available passwords in advance. (You can look at the volume size, but there is some variability relative to the total amount of data stored, so that you can't really be sure.) See http://en.wikipedia.org/wiki/Deniable_encryption http://en.wikipedia.org/wiki/Deniable_encryption.
losethos 15y ago
God says... childbearing violets kept Fear hearsay consumption confuted exceedeth depend blowing restlessly troublesome god entangle stated occupying adding next plain disciple custom unhesitatingly valley empire University remission prosperity winked withdrawn fresh redeemed God's falls sex attracts
phlux 15y ago
So, assuming the DOJ can force one to decrypt a laptop, then wouldnt it be wise to make all your sensitive informarmation in a cloud-mounted encrypted partition such that nothing actually lives on the laptop of value? Think of the laptop, again, as a dumb terminal. Make sure that the mounting of said partition is an always manual event and no command logging/local logging occurs. Here! take the laptop! Here's the password! When working, data gets brought to a local, ram based, cache - all evidence of anything running on the machine dies with power loss.
daimyoyo 15y ago
Will she need to be convicted first or can she go to the Supreme Court on what's happened so far? This seems like the perfect case to test the boundaries of electronic security.
- gnosis 15y ago
  IANAL, but from what I understand there have to be rulings from the lower courts first before a case can make it to the Supreme Court level. And even then the Supreme Court chooses which cases they want to hear and which they don't. So just because the case makes it to the Supreme Court, doesn't mean they'll decide to hear it. What's even more frustrating is that the Supreme Court doesn't have to state any reasons for refusing to hear a case. They could just do it on a whim, or for some completely biased reasons and no one would ever know.
ChuckMcM 15y ago
Here's hoping this case gets to a published ruling so that we can move the debate forward. :-)
jergason 15y ago
I thought this quote by the DOJ was pretty ridiculous: Public interests will be harmed absent requiring defendants to make available unencrypted contents in circumstances like these. Failing to compel Ms. Fricosu amounts to a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) I don't like how they bring out the bogey-men of child pornography and terrorism to justify making her decrypt the drive.
- raganwald 15y ago
  Laying aside the emotional rhetoric, the point being debated is whether public interests will be harmed or not. What's clear is that prosecutorial interests will be harmed, but the entire point of constitutional rights is that sometimes there is conflict between the interests of those who prosecute crimes and the public interest. For example, you could easily argue that having a lawyer present during interrogation harms public interests for exactly the same reasons: Child molesters, terrorists, and just plain naughty people will clam up and not give investigators information that could lead to a conviction. We had that discussion, and south of the border you decided that public interests were harmed by not allowing a lawyer to be present and were further harmed by not warning suspects of their rights. (Canada takes a different view with respect to the right to a lawyer for complex reasons.)
- rbanffy 15y ago
  I can imagine that, like child pornographers, terrorists and drug traffickers, white-collar criminals leave a lot of incriminating evidence outside their own computers. If Ms. Fricosu is so dangerous, if her crimes are so serious and widespread, sure there is evidence beyond the encrypted volumes in her computer. There is no crime without evidence. The DoJ should find the missing evidence and then, with a strong case, offer Ms. Fricosu a deal in that she gets some slack for revealing the exact extent and methods of her misdeeds.
- dkokelley 15y ago
  As soon as I saw "...be it in child exploitation..." I skipped the entire content in parenthesis. Whoever said that was not attempting to provide a logical argument, but to elicit an emotional response in the audience. The point would have (and should have) been made without the references to all manner of boogie-men.
TheCondor 15y ago
There is a certain romantic man against the world sort of idea where I support this kind of privacy. Some kind of 1984 like scenario.. I'm thinking like someone writes some particular brand fiction for his own enjoyment, somehow it becomes illegal and he's now a criminal for his private thoughts or the contents of his private writings. Or practicing an outlawed religion in private or something. The reality of the most recent cases regarding this stuff is you've got some fairly petty thefts, child porn, and similar crimes. An investigation reached the point where a computer was seized, they drew suspicion,crimes may have been observed and recorded, it's not like they were randomly going through customs or pulled over by a police officer and the contents of their computer were requested. Are there any cases of note where the suspect or defendant has some sort of cause to champion? If we accept that this encrypted space is protected by the fifth amendment, then why won't we just regulate that encryption needs a "law enforcement access key" or make such encryption just illegal? You can make a very compelling case that it's not serving any public good if you can list off criminals and crimes that have gone free because of it. That would make the very use of encryption potentially becomes a crime regardless of the encrypted information content. Is that not the logical next step? I'll assert what I've asserted many times, here and other places: if you're breaking the law for some ideological reason and keep encrypted electronic records of it, you're way better not going to court and not being on any police or prosecution's radar than just banking on the encryption holding. Pirating movies on bit torrent isn't exactly civil disobedience either, that would mean doing so openly and publicly.
- pyre 15y ago
  > it's not like they were randomly going through customs > or pulled over by a police officer and the contents of > their computer were requested That happened in one case. The problem with that case, is that the guy unlocked the computer for customs, customs found child porn, they turned off the computer, and later on the guy refused to unlock the computer of them again. The issue with this is that the border agent already saw that there was incriminating evidence in the encrypted volume, which muddies the waters a bit. Granted, if he mentioned child porn in passing to the border agent, they couldn't force him to testify against himself and make that same statement later on (e.g. in court, or on video).
- 15y ago
asciilifeform 15y ago
This is why you must give out the password. The one that sets off the thermite, that is. You will still be imprisoned, but it will be a sentence of known length, rather than "at the king's pleasure." And be sure to compare the penalty with the one you were originally trying to escape from.
- marshray 15y ago
  I suppose you were referring to the thermite used to burn up the documents in high-security safes rather than as a general bomb. That's not a plausible scenario with general-purpose computer parts. The lab would obviously have made backup copies of the drive first.
  - asciilifeform 15y ago
    Yes, and yes. Use general-purpose computer parts, with some imagination. One simple example: Modify the power pins (in a USB keychain drive and a dedicated USB socket, naturally) such that +5v and ground are connected backwards. Connect a diode in such a way that should the stick ever be plugged into an ordinary USB socket, power is applied to a small piece of nichrome igniter wire (model rocket store, or cannibalize any electrical heating appliance.) The igniter wire is wrapped around a small magnesium ribbon glued to the exposed (use nitric acid) EEPROM die. Make sure that the package still looks like a normal USB key from the outside, and is well-sealed to avoid unsightly smoke and light (if you do not take care to do this, you may well find "endangering a law enforcement official using an illegal pyrotechnic device" or the like added to the charges against you.) And of course none of this will help if the enemy expects it. The above is merely an example.
    - marshray 15y ago
      OMG. With that much knowledge and creativity clearly you must be a terrorist. Or someone who grew up way back when the official US government policy was that kids should learn hands-on Science and Math. In any case, you do something like that today you will frighten the living daylights out of enough technically-illiterate-but-powerful people that you will not get out of jail for a long long time, regardless of whether or not there is any reasonable justification for it.
cookiecaper 15y ago
Again, the best analog is a document handwritten in a made-up cipher. If someone finds a paper in a notebook that looks like it contains useful information but the actual glyphs used are unreadable to the masses, or the order of the letters are scrambled, or whatever other personal encryption scheme the defendant used when he wrote that note, can the government compel the defendant to reveal the key to his personal cipher? Can the government compel the defendant to not hand over the key to the cipher but provide a decoded interpretation of the message? That is the correct analogy for this situation much more than safes or doors. Computer encryption is the same thing, just uses a common cipher and the information is encrypted millions of times faster than a human could crypt by hand.
- RexRollman 15y ago
  I totally agree with you. And as I said in the other article about this, I simply don't believe it is the duty of citizens to help the government make their case.
twalker 15y ago
Has anyone developed anything that would completely delete a disk when a decoy password is typed in, whilst displaying a fake OS instance filled with a legit looking my docs, internet history etc? In that case you give them the decoy password and they clear your machine for you
- gnosis 15y ago
  This idea sounds nice, but in practice it will only be useful when the investigators are completely incompetent. Any competent investigator will make backups of your disk, and work only on the backup. They'll probably also use their own tools to decrypt any content on the disk, rather than booting up the suspect's OS and relying on the suspect's tools. Also, for trying something like this, you'll probably face additional destruction of evidence and obstruction of justice charges.
JustinHoffman 15y ago
This law is doomed to fail. Why? Because nobody can prove whether I simply don't want to disclose my password, or if I really forgot it.
mckoss 15y ago
The DOJ claims that allowing defendants to exercise their 5th amendment rights against self-incrimination would "make their prosecution impossible." To which I say: 1. Your prosecutors are lazy and want to force criminals to prosecute themselves. 2. If the only external evidence of a crime is a private file on a hard drive, it seems to me that not much harm was done to society and we should leave these people alone.
- Canada 15y ago
  #2 is the best point. It's worth it to trade letting some guilty people get away with it in order to have the freedom of conscience to write whatever we like in our computers and not be compelled to turn over our private writings. If something bad was done to someone else, there's going to be evidence of it elsewhere: Contracts must be held by some other party, bank records, etc. Is the prosecutor trying to claim the government needs access to the accused computer to convict her of a commercial crime? Are there no third parties involved who are in possession of useful records? No banks were involved in this mortgage fraud? Really???
yason 15y ago
Well, they can't force anything if only she knows the password. For what I've read they can only threaten with and convict for obstruction of justice, a felony. So, depending on her mindset she can choose whether to become a convicted fraudster or a convicted but potentially innocent freedom and privacy fighter (with that 10-year sentence). I'm not saying that doing time isn't easy but...
maeon3 15y ago
What worries me about this precedent that your computer can be immediately taken from you and interrogated against your will, the computer will not be given any rights. The computer needs the right to plead the 5th. One day far in the future, computers will be part of who we are. Basic Human rights was designed to protect humans, not the computers. When the computers integrate with us, I hope we can take back all the rights the courts have stolen. Pleading the 5th will be futile, as all the courts have to do is download your computer module and then scan the logs of what you did, where you did it, and what you were thinking when you did it. This stuff is important, and needs a creative solution that stops the criminals while not making everyone a criminal.

148 points by d0ne 15y ago

Begin the off-base analogies. Is the government's whole case dependent on the hypothetical contents of her laptop? I have to disagree with the Obama adminsitration's stance on this, and other "electronic" civil liberty positions.

chrisjsmith 15y ago

Does it matter? Governments are bullies. http://www.vvsss.com/grid/xkcd-on-crypto.gif http://www.vvsss.com/grid/xkcd-on-crypto.gif Here in the UK, we already have to hand over our keys or be chucked in jail.

someone13 15y ago
Original XKCD page, for posterity: http://xkcd.com/538/ http://xkcd.com/538/ And a direct image link from XKCD: http://imgs.xkcd.com/comics/security.png http://imgs.xkcd.com/comics/security.png
lotharbot 15y ago
Is there any reason you linked to a third-party site instead of xkcd itself? http://xkcd.com/538/ http://xkcd.com/538/ (easily googled -- xkcd crypto, first hit.)
- chrisjsmith 15y ago
  Oh pedant, I thoroughly apologise for my ignorance. May my vegetables all die, my breath smell for eternity and my armpits flood with hair and engulf the earth.
  - cfaubell 15y ago
    It's not pedantry. Linking directly to the content's author makes sure that he is properly credited and gets the exposure.

quellhorst 15y ago

It is cases like this that makes me glad to donate to EFF.

deleted 15y ago
[deleted]

roc 15y ago

The truly interesting bit, will be when a case of (real or alleged) multiple hidden encrypted volumes is publicized. If the government feels the information they want is on a laptop, the laptop's owner would suddenly find themselves forced to prove a negative (there are no more hidden volumes), lest they be held in contempt. If they can seemingly compel you to reveal something they can't proven even exists and lock you up until you can prove that it doesn't, the door for abuses isn't even wide open; it'll have been removed from its hinges along with most of the wall.

DavidSJ 15y ago
US v Hubbell makes clear that the government cannot compel production of documents (except under immunity to prosecution) which it does not know, ahead of time, to exist.
- roc 15y ago
  Then how can they compel someone to unlock a laptop to enable arbitrary access? Wouldn't they be limited to requesting specific documents?
  - sorbus 15y ago
    The legal system allows them to do things analogous to that, such as compelling someone to open a safe to enable arbitrary access to the contents (as mentioned in the article). Presumably they must suspect that the safe contains documents relevant to the case.
  - bhousel 15y ago
    Every case is a little different, but investigators do need probable cause to search a laptop. This is a mortgage fraud case involving years of criminal activity, so I'm guessing that it's probably not too hard for the prosecution to produce witnesses who can say "yes, she sold me that crappy mortgage and used her laptop when I went to meet with her.", or direct information of her internet usage (ISP, or logs from cable modem), or observation of her using the laptop by police during the investigation.

djackson 15y ago

It's easy to see why you wouldn't want someone to decrypt your laptop. What about Bernie Madoff? Wouldn't you be furious if all data produced by a corrupt hedge fund manager was encrypted? Wouldn't you want the DOJ to be able to hold them in contempt of court? If you hamstring your government, you aren't allowed to complain that it is ineffective.

muuh-gnu 15y ago
"The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all." -- H.L.Mencken
- djackson 15y ago
  Yeah... no. There's a line, and past that line, law enforcement has no power to enforce laws at all. Removing the DOJ's ability to collect evidence is, in some cases, the equivalent to denying a detective access to a crime scene. If all productions of electronic evidence can be encrypted, and the defense is not forced to decrypt those files, then dirty corporations only need to encrypt everything to defend themselves in court. Defense: "We produced everything you asked for." Prosecution: "We can't even verify that statement. Decrypt it" Defense: "We don't have to." Case closed.
  - andrewcooke 15y ago
    rights are rights because they allow you to do what would otherwise be illegal. for example, there's no need for a right to free speech if you're only going to say things that everyone thinks should be said. rights exist because some things are so important they are worth the cost of abuse. At first blush it may be thought surprising that one should have a right to do that which one ought not. Is it not better to confine rights to that which it is right or at least permissible to do? But to say this is to misunderstand the nature of rights. One needs no right to be entitled to do the right thing. That it is right gives one all the title one needs. But one needs a right to be entitled to do that which one should not. It is an essential element of rights to action that they entitle one to do that which one should not. To say this is not, of course, to say that the purpose or justification of rights of action is to increase wrongdoing. Their purpose is to develop and protoect the autonomy of the agent. They entitle him to choose for himself rightly or wrongly. But they cannot do that unless they entitle him to choose wrongly. - Joseph Raz, The Authority of Law (p 266) the final sentence of the quote above is hugely important.

naner 15y ago

What happens to her if she doesn't know the password?

bhousel 15y ago
An obstruction of justice charge, probably. Here's a pretty decent page about the charge: http://www.federalcriminallawyer.us/2011/01/12/federal-law-on-obstructing-justice-a-summary/ http://www.federalcriminallawyer.us/2011/01/12/federal-law-o... tl;dr: "18 USC 1503 is a felony offense for which the sentence can be 10 years imprisonment."
- naner 15y ago
  That seems to be imply that she is lying, though. What if she actually doesn't know the password? For example if it isn't her laptop or the password was written down and lost or it is an old encrypted volume which she doesn't use anymore, etc.
  - someone13 15y ago
    This is one of the reasons that I find the Fifth Amendment to be important. Without it, the DOJ could simply ask any murder suspect to reveal where they stashed the body and murder weapon, charging them with obstruction of justice or contempt of court if they didn't answer. This, of course, would be a serious problem if the accused didn't actually commit the crime.
    - tedunangst 15y ago
      There is a difference between the DOJ asking you to provide access to information and asking you to provide the information itself.
      - mahyarm 15y ago
        There is a difference between the DOJ asking you to provide access to / the location of the body and asking you to provide the body itself.

d0ne 15y ago

IANAL ( Edit to include a reference for my opinions[1] ) The general argument for forcing someone to turn over the key to a door once compelled by the court is that it is commonly known there are other reasonable means by which to access the content the door protects that do not require the key: 1) Locksmith 2) Break the door down 3) Use a different door if one exist These are reasonable methods as neither of them take a considerable amount of time, in many cases a reasonably consistent amount of time between unique cases, and are methods that are readily available in all markets and jurisdictions. This makes the case that the contents behind the door can be accessed through various methods, some of which do not require my involvement, therefor my not turning over the key is only nominally delaying the inevitable. In the case of an encryption key that protects data, which once protected is only in the possession of the individual who also posses the key, this is very different IMHO. It is very different for this simple reason: If proper procedures have been followed, and certain encryption methods have been utilized, there is no reasonably consistent method for acquiring the original data other than information I posses in my mind. I say reasonably consistent because if you had limitless resources and limitless time you could try every possible combination and at some point gain access. That is, however, unless the mechanism that relays the encryption key is not designed in a way as to destroy the data after N failed attempts. In either case, no court can be reasonably certain of the time it would take to access the original data or if they would ever gain access at all. This directly conflicts with my right to a speedy trial and certainly conflicts with my right not to incriminate myself as I'm the only one who can provide access within a reasonable amount of time. [1] http://news.cnet.com/8301-13578_3-9834495-38.html http://news.cnet.com/8301-13578_3-9834495-38.html

OzzyB 15y ago
Right, so the Government's demand of my encryption key to unlock the contents of my "digital brain" is no less different than the Government forcing me to take some truth serum to force me to reveal something I don't wish too... because it would incriminate me. And as far as I'm concerned, the 5th protects me from incriminating myself.
nodata 15y ago
I think this was discussed here the other day (can't find the link, sorry). The thinking went something like this: a passphrase is equivalent to a combination wall safe and not to a lock with key: one requires a physical thing to open it, the other requires something within your head. The something within your head is equivalent to testimony.

shareme 15y ago

What we are actually seeing is how far behind the DOJ and FBI are behind in having competent computer forensics professionals as part of their human resources.. We saw the same thing with the Patriot Act..do not have proper staff? than by God make sure that the US constitution suddenly does not apply if traveling outside the US..

16s 15y ago
They have plenty of competent computer forensics guys and equipment. But even with all of that, proper encryption with a strong passphrase is infeasible to attack. Forcing the key holder to disclose the key is the easy, inexpensive first step.

deleted 15y ago

[deleted]

hammock 15y ago

Thorough and detailed commentary here in yesterday's thread: http://news.ycombinator.com/item?id=2744688 http://news.ycombinator.com/item?id=2744688

hippich 15y ago

"Decrypting the data on the laptop can be, in and of itself, a testimonial act--revealing control over a computer and the files on it," said EFF Senior staff attorney Marcia Hofmann. I believe this is enough to get protection under 5th amendment. Giving password or providing decrypted content is already testimony against yourself saying that you control these files..

grecy 15y ago

It's pretty astounding to me that if you write sometime in "code" (read: another language) you have to provide a way to "translate it" (into English I presume). It's not my problem if others can't read my brain dumps.

Shenglong 15y ago

Prosecutors stressed that they don't actually require the passphrase itself, meaning Fricosu would be permitted to type it in and unlock the files without anyone looking over her shoulder. I wonder if anyone has thought of using more than one keys as a decryption possibility. I've always considered it, but never figured there'd be too much use. Say, have one correct key to decrypts data stored in one way, and another key to either "decrypts" into a pre-generated text, or another variation of what's stored. I guess it latter might be too content dependent.

jarin 15y ago
Truecrypt has supported that kind of plausible deniability for a while.
- themenace 15y ago
  And there is a system called Deniable Video extends that concept of plausible deniability to live audio & video. It's like TrueCrypt for real-time data.
a3_nm 15y ago
Systems like PhoneBookFS, rubberhose and StegFS exist (or used to exist). They allow you to create volumes which can provide different data for different passwords, with no way to know the number of available passwords in advance. (You can look at the volume size, but there is some variability relative to the total amount of data stored, so that you can't really be sure.) See http://en.wikipedia.org/wiki/Deniable_encryption http://en.wikipedia.org/wiki/Deniable_encryption.

losethos 15y ago

God says... childbearing violets kept Fear hearsay consumption confuted exceedeth depend blowing restlessly troublesome god entangle stated occupying adding next plain disciple custom unhesitatingly valley empire University remission prosperity winked withdrawn fresh redeemed God's falls sex attracts

phlux 15y ago

So, assuming the DOJ can force one to decrypt a laptop, then wouldnt it be wise to make all your sensitive informarmation in a cloud-mounted encrypted partition such that nothing actually lives on the laptop of value? Think of the laptop, again, as a dumb terminal. Make sure that the mounting of said partition is an always manual event and no command logging/local logging occurs. Here! take the laptop! Here's the password! When working, data gets brought to a local, ram based, cache - all evidence of anything running on the machine dies with power loss.

daimyoyo 15y ago

Will she need to be convicted first or can she go to the Supreme Court on what's happened so far? This seems like the perfect case to test the boundaries of electronic security.

gnosis 15y ago
IANAL, but from what I understand there have to be rulings from the lower courts first before a case can make it to the Supreme Court level. And even then the Supreme Court chooses which cases they want to hear and which they don't. So just because the case makes it to the Supreme Court, doesn't mean they'll decide to hear it. What's even more frustrating is that the Supreme Court doesn't have to state any reasons for refusing to hear a case. They could just do it on a whim, or for some completely biased reasons and no one would ever know.

ChuckMcM 15y ago

Here's hoping this case gets to a published ruling so that we can move the debate forward. :-)

jergason 15y ago

I thought this quote by the DOJ was pretty ridiculous: Public interests will be harmed absent requiring defendants to make available unencrypted contents in circumstances like these. Failing to compel Ms. Fricosu amounts to a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) I don't like how they bring out the bogey-men of child pornography and terrorism to justify making her decrypt the drive.

raganwald 15y ago
Laying aside the emotional rhetoric, the point being debated is whether public interests will be harmed or not. What's clear is that prosecutorial interests will be harmed, but the entire point of constitutional rights is that sometimes there is conflict between the interests of those who prosecute crimes and the public interest. For example, you could easily argue that having a lawyer present during interrogation harms public interests for exactly the same reasons: Child molesters, terrorists, and just plain naughty people will clam up and not give investigators information that could lead to a conviction. We had that discussion, and south of the border you decided that public interests were harmed by not allowing a lawyer to be present and were further harmed by not warning suspects of their rights. (Canada takes a different view with respect to the right to a lawyer for complex reasons.)
rbanffy 15y ago
I can imagine that, like child pornographers, terrorists and drug traffickers, white-collar criminals leave a lot of incriminating evidence outside their own computers. If Ms. Fricosu is so dangerous, if her crimes are so serious and widespread, sure there is evidence beyond the encrypted volumes in her computer. There is no crime without evidence. The DoJ should find the missing evidence and then, with a strong case, offer Ms. Fricosu a deal in that she gets some slack for revealing the exact extent and methods of her misdeeds.
dkokelley 15y ago
As soon as I saw "...be it in child exploitation..." I skipped the entire content in parenthesis. Whoever said that was not attempting to provide a logical argument, but to elicit an emotional response in the audience. The point would have (and should have) been made without the references to all manner of boogie-men.

TheCondor 15y ago

There is a certain romantic man against the world sort of idea where I support this kind of privacy. Some kind of 1984 like scenario.. I'm thinking like someone writes some particular brand fiction for his own enjoyment, somehow it becomes illegal and he's now a criminal for his private thoughts or the contents of his private writings. Or practicing an outlawed religion in private or something. The reality of the most recent cases regarding this stuff is you've got some fairly petty thefts, child porn, and similar crimes. An investigation reached the point where a computer was seized, they drew suspicion,crimes may have been observed and recorded, it's not like they were randomly going through customs or pulled over by a police officer and the contents of their computer were requested. Are there any cases of note where the suspect or defendant has some sort of cause to champion? If we accept that this encrypted space is protected by the fifth amendment, then why won't we just regulate that encryption needs a "law enforcement access key" or make such encryption just illegal? You can make a very compelling case that it's not serving any public good if you can list off criminals and crimes that have gone free because of it. That would make the very use of encryption potentially becomes a crime regardless of the encrypted information content. Is that not the logical next step? I'll assert what I've asserted many times, here and other places: if you're breaking the law for some ideological reason and keep encrypted electronic records of it, you're way better not going to court and not being on any police or prosecution's radar than just banking on the encryption holding. Pirating movies on bit torrent isn't exactly civil disobedience either, that would mean doing so openly and publicly.

pyre 15y ago
> it's not like they were randomly going through customs > or pulled over by a police officer and the contents of > their computer were requested That happened in one case. The problem with that case, is that the guy unlocked the computer for customs, customs found child porn, they turned off the computer, and later on the guy refused to unlock the computer of them again. The issue with this is that the border agent already saw that there was incriminating evidence in the encrypted volume, which muddies the waters a bit. Granted, if he mentioned child porn in passing to the border agent, they couldn't force him to testify against himself and make that same statement later on (e.g. in court, or on video).
15y ago

asciilifeform 15y ago

This is why you must give out the password. The one that sets off the thermite, that is. You will still be imprisoned, but it will be a sentence of known length, rather than "at the king's pleasure." And be sure to compare the penalty with the one you were originally trying to escape from.

marshray 15y ago
I suppose you were referring to the thermite used to burn up the documents in high-security safes rather than as a general bomb. That's not a plausible scenario with general-purpose computer parts. The lab would obviously have made backup copies of the drive first.
- asciilifeform 15y ago
  Yes, and yes. Use general-purpose computer parts, with some imagination. One simple example: Modify the power pins (in a USB keychain drive and a dedicated USB socket, naturally) such that +5v and ground are connected backwards. Connect a diode in such a way that should the stick ever be plugged into an ordinary USB socket, power is applied to a small piece of nichrome igniter wire (model rocket store, or cannibalize any electrical heating appliance.) The igniter wire is wrapped around a small magnesium ribbon glued to the exposed (use nitric acid) EEPROM die. Make sure that the package still looks like a normal USB key from the outside, and is well-sealed to avoid unsightly smoke and light (if you do not take care to do this, you may well find "endangering a law enforcement official using an illegal pyrotechnic device" or the like added to the charges against you.) And of course none of this will help if the enemy expects it. The above is merely an example.
  - marshray 15y ago
    OMG. With that much knowledge and creativity clearly you must be a terrorist. Or someone who grew up way back when the official US government policy was that kids should learn hands-on Science and Math. In any case, you do something like that today you will frighten the living daylights out of enough technically-illiterate-but-powerful people that you will not get out of jail for a long long time, regardless of whether or not there is any reasonable justification for it.

cookiecaper 15y ago

Again, the best analog is a document handwritten in a made-up cipher. If someone finds a paper in a notebook that looks like it contains useful information but the actual glyphs used are unreadable to the masses, or the order of the letters are scrambled, or whatever other personal encryption scheme the defendant used when he wrote that note, can the government compel the defendant to reveal the key to his personal cipher? Can the government compel the defendant to not hand over the key to the cipher but provide a decoded interpretation of the message? That is the correct analogy for this situation much more than safes or doors. Computer encryption is the same thing, just uses a common cipher and the information is encrypted millions of times faster than a human could crypt by hand.

RexRollman 15y ago
I totally agree with you. And as I said in the other article about this, I simply don't believe it is the duty of citizens to help the government make their case.

twalker 15y ago

Has anyone developed anything that would completely delete a disk when a decoy password is typed in, whilst displaying a fake OS instance filled with a legit looking my docs, internet history etc? In that case you give them the decoy password and they clear your machine for you

gnosis 15y ago
This idea sounds nice, but in practice it will only be useful when the investigators are completely incompetent. Any competent investigator will make backups of your disk, and work only on the backup. They'll probably also use their own tools to decrypt any content on the disk, rather than booting up the suspect's OS and relying on the suspect's tools. Also, for trying something like this, you'll probably face additional destruction of evidence and obstruction of justice charges.

JustinHoffman 15y ago

This law is doomed to fail. Why? Because nobody can prove whether I simply don't want to disclose my password, or if I really forgot it.

mckoss 15y ago

The DOJ claims that allowing defendants to exercise their 5th amendment rights against self-incrimination would "make their prosecution impossible." To which I say: 1. Your prosecutors are lazy and want to force criminals to prosecute themselves. 2. If the only external evidence of a crime is a private file on a hard drive, it seems to me that not much harm was done to society and we should leave these people alone.

Canada 15y ago
#2 is the best point. It's worth it to trade letting some guilty people get away with it in order to have the freedom of conscience to write whatever we like in our computers and not be compelled to turn over our private writings. If something bad was done to someone else, there's going to be evidence of it elsewhere: Contracts must be held by some other party, bank records, etc. Is the prosecutor trying to claim the government needs access to the accused computer to convict her of a commercial crime? Are there no third parties involved who are in possession of useful records? No banks were involved in this mortgage fraud? Really???

yason 15y ago

Well, they can't force anything if only she knows the password. For what I've read they can only threaten with and convict for obstruction of justice, a felony. So, depending on her mindset she can choose whether to become a convicted fraudster or a convicted but potentially innocent freedom and privacy fighter (with that 10-year sentence). I'm not saying that doing time isn't easy but...

maeon3 15y ago

What worries me about this precedent that your computer can be immediately taken from you and interrogated against your will, the computer will not be given any rights. The computer needs the right to plead the 5th. One day far in the future, computers will be part of who we are. Basic Human rights was designed to protect humans, not the computers. When the computers integrate with us, I hope we can take back all the rights the courts have stolen. Pleading the 5th will be futile, as all the courts have to do is download your computer module and then scan the logs of what you did, where you did it, and what you were thinking when you did it. This stuff is important, and needs a creative solution that stops the criminals while not making everyone a criminal.