14 ms·

French court: refusing to disclose mobile passcode to law enforcement is a crime

313 points by miles 4y ago

webmobdev 4y ago
Interesting. Doesn't France have a legal system that leans more towards Civil Law than Common Law? So how much legal validity does this judgement have?
- formerly_proven 4y ago
  This comes from their equivalent of the Supreme Court
  - ohbtvz 4y ago
    No, the cour de cassation is not the equivalent of the supreme court in many ways. * It doesn't judge the constitutionality of laws. That's the constitutional court. * It doesn't judge cases related to complaints against the administration. That's for the council of state. * Its precedents don't bind lower courts, who are free to rule differently. * In France, judges are explicitly forbidden to write a judgement that seems to hold in a general manner (article 5 of the penal procedure code) - we have a much stricter separation between the legislative and judiciary. They always judge specific cases. This applies to the cour de cassation as well. It's just not useful to try and compare the US and French legal systems. They're too different.
    - occamrazor 4y ago
      Article 5 C.p.p. is about jurisdiction ov criminal and civil courts. Did you mean a different article?
      - palsecam 4y ago
        Article 5 of the civil code, I guess: « Il est défendu aux juges de prononcer par voie de disposition générale et réglementaire sur les causes qui leur sont soumises. » https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006419284/2022-10-29 https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI0000...
        ohbtvz 4y ago
        Yep, that's the one I meant, sorry.
    - webmobdev 4y ago
      > we have a much stricter separation between the legislative and judiciary. Could you clarify more? You also said, "In a civil law country, precedent is always subordinate to codified law." That would imply that there is less room for judges to interpret the law more freely. (In India, for example, constitutional courts can even expand or contract the law, by striking down or adding provisions to it through the power of judicial reviews.)
- mytailorisrich 4y ago
  This decision is de facto the Law. Indeed, this is a decision of the "Cour de Cassation", which is the highest court and which does not judge guilt in specific cases (edited to clarify), but whether the law was correctly applied. So by judging that this is a criminal offence (actually they have only confirmed previous legal decisions so it was expected) they have ruled that French Law states that this is a criminal offence, including based on jurisprudence (previous decisions). So that rather settles it.
  - ohbtvz 4y ago
    The cour de cassation does judge specific cases. They don't make the law and lower courts are not bound to their precedent. I wrote a more complete explanation in a sibling comment.
    - mytailorisrich 4y ago
      "En effet, son rôle n’est pas de rejuger les affaires. Elle juge le droit exclusivement. De ce fait, la Cour de cassation ne s’attache pas aux faits d’un arrêt ou d’un jugement, mais elle vérifie la bonne application de la loi à la décision attaquée. Autrement dit, elle ne se prononce pas sur les litiges, mais seulement sur les décisions qui concernent les litiges." [1] It only checks that the law was correctly applied, it is not an appeal where the guilt is re-assessed (that's what I meant, obviously not very clearly). [1] https://juripredis.com/la-jurisprudence-dossier/comment-definir-la-jurisprudence/quelle-est-la-jurisprudence-de-la-cour-de-cassation/#:~:text=Elle%20juge%20le%20droit%20exclusivement,d%C3%A9cisions%20qui%20concernent%20les%20litiges https://juripredis.com/la-jurisprudence-dossier/comment-defi....
- ohbtvz 4y ago
  It doesn't "lean more" towards civil law, it is a civil law legal system. Nevertheless, precedent ("jurisprudence") is still part of the legal framework. The cour de cassation, the highest court of appeals, has rendered a judgement about something which is ambiguous in the law. This is a judgment about a particular case in a particular situation, and judges are explicitly forbidden from writing anything in their judgment that would look like a general statement. Lower courts are independent and can render different judgments in similar cases if they interpret the law and the situation presented to them differently. So why does it matter that the cour de cassation created this precedent? Well, it's the highest court of appeal. Any lower court who judges differently sees clearly the "risk" that their judgment is appealed, passed on to the cour de cassation, overturned, and needed to be judged again. We have professional judges in France, and they recognize there is little point in wasting the State's resources on such things without good reason. But because we are in a civil law country, it is quite likely that the existing law will be clarified and supplant the precedent. In a civil law country, precedent is always subordinate to codified law.
  - webmobdev 4y ago
    Thanks for the clarification. I just recently became aware of how different the French legal system is when I started watching "Murder in Provence" and was confused when a judge himself got involved the investigation of criminal cases.
bvanderveen 4y ago
Super, le pays des droits de l’homme !
- deleted 4y ago
  [deleted]
- ur-whale 4y ago
  > Super, le pays des droits de l’homme ! Only folks who never left France still believe in that worn out trope.
guerby 4y ago
There is an appeal being made to ECHR (1) according to: https://www.nextinpact.com/lebrief/70314/refuser-deverouiller-son-telephone-portable-peut-constituer-delit https://www.nextinpact.com/lebrief/70314/refuser-deverouille... (Also other cases are mentionned in the fairtrials article) (1) https://en.wikipedia.org/wiki/European_Court_of_Human_Rights https://en.wikipedia.org/wiki/European_Court_of_Human_Rights
chetanbhasin 4y ago
Good thing that I keep forgetting my passcode then.
- commandlinefan 4y ago
  Forgetting it is a crime, too.
  - mirekrusin 4y ago
    Is it? Btw. with new iPhone they just need to hold it close to his face while handcuffed.
    - toomuchtodo 4y ago
      Does pressing the power button five times still disable biometrics? Edit from sibling comment link with alternate easier method to hard lock: “Just press and hold the buttons on both sides. Remember that. Try it now. Don’t just memorize it, internalize it, so that you’ll be able to do it without much thought while under duress, like if you’re confronted by a police officer. Remember to do this every time you’re separated from your phone, like when going through the magnetometer at any security checkpoint, especially airports. As soon as you see a metal detector ahead of you, you should think, “Hard-lock my iPhone”.”
      - ljlolel 4y ago
        yes
      - bombcar 4y ago
        Yep, just tested here, 5 clicks and you get the emergency/poweroff screen which then will require passcode afterwards, even if you don't power off.
        rrrrrrrrrrrryan 4y ago
        For those with Android phones, do not try this, as it triggers emergency SOS. (I just made this mistake lol).
mgamache 4y ago
The EU is so protective of consumer rights, but not of personal rights with respect to governments. Seems odd, but is a result of socialist influence. In the US we have more protection against government abuse and less corporate. But it ends up being the worst of all worlds because the government just uses the corporations to provide the data they could/would never have access to.
- mytailorisrich 4y ago
  There always has to be a balance. Some countries have enacted laws to create an obligation to disclose encryption keys, etc. during criminal investigations in response to new technologies because now everyone has access to encryption methods that are essentially unbreakable without knowing the key. So while people have and should have the right not to incriminate themselves it is also reasonable to ensure that criminal investigations can still be (fairly) carried out... It was much easier when people could only hide their secrets in a safe. I believe even in the US one may be obligated to disclose keys. One big question is whether this should require a court order, which implies that the police must convince a judge that this is necessary and useful, or whether (as seems the case here?) the police themselves have that power, which is indeed more contentious.
- deleted 4y ago
  [deleted]
- formerly_proven 4y ago
  The US has uniquely good protections against abuse by government officials. Things like the fruit of the poisonous tree doctrine, explicitly designed to keep prosecutors from overstepping their boundaries, simply don't exist in most of the world. Admissibility is complex and important in the US and basically not a concern outside the US at all, virtually everything is admissible in court. For example, it has been established at the highest level of jurisprudence in the EU that you can torture suspects and you can prosecute them with evidence acquired through their forced confession. That's because at a fundamental level, the prosecutors/court determining the truth far outweighs the right to a fair trial in most of the world. The idea outside the US being that you'll just prosecute investigators and prosecutors who overstep legal boundaries.
otikik 4y ago
Two words: “J’ai oublié”
- knodi123 4y ago
  If the judge believes you: "Okay! Sucks for the cops." If the judge does not believe you: "That's contempt. You can sit in jail until you decide to remember." A better two words would be "hidden volume". https://www.truecrypt71a.com/documentation/plausible-deniability/hidden-volume/ https://www.truecrypt71a.com/documentation/plausible-deniabi...
  - userbinator 4y ago
    ...or "duress password".
  - jeroenhd 4y ago
    It's trivial to find if a hidden volume is in use or not. It's a good defence against an abusive family member who isn't very tech-savvy, but it's useless against law enforcement.
    - martinko 4y ago
      How exactly?
      - malfist 4y ago
        Source: Trust him. In all fairness, there is a lot of documentation in veracrypt's manual about how to properly hide a hidden partition, and how it's circumvented. Most of them rely on knowledge of the encrypted container over time. A single point in time is unlikely to reveal a hidden partition, but if you are being monitored that is possible. Please note that backups or wear leveling on an SSD, or just the TRIM command not deleting stored data can provide those points in time. Hidden partitions work best on magnetic drives. Read them here: https://veracrypt.eu/en/Security%20Requirements%20for%20Hidden%20Volumes.html https://veracrypt.eu/en/Security%20Requirements%20for%20Hidd...
adrian_b 4y ago
In my opinion, one of the most fundamental human rights, maybe even the most important human right, is the right to refuse to answer to a question. Any law that says that there are circumstances when humans must answer to a question otherwise they will be punished is wrong and abusive. Obviously, when people are suspected to have done something illegal, but they refuse to give answers that might dis-incriminate them, then that can be used in conjunction with evidence that makes probable that they are guilty to conclude that they are indeed guilty and sentence them accordingly. However, in such cases any punishment should be for the crime whose authors they are believed to be and not for refusing to answer any question. I do not care if a bunch of mean or stupid people claim to "represent the will of the people" and they make Draconian laws that punish those who do not answer questions. I will never recognize that they have any right to make such laws and I pity the people that are so naive that they accept the existence of such laws. I have been born and I have grown up in a country which was governed by a criminal organization which had received the political power from a foreign invading army, even if they also claimed that they have been elected democratically and they "represent the will of the people". To maintain their power, the government imprisoned and killed any opponents, which were identified through mass surveillance. Any honest citizen did not have any greater wish than to get rid of the government, but it was impossible to organize any kind of opposition, due to the mass surveillance and due to the confidential informers who infiltrated any institution or company. In such a country, answering the truth to any question of a law enforcement officer could lead to grave consequences for other innocent people, from destroying their professional careers, up to even death. A similar history was shared by all the countries in the Eastern Europe, but there are also many other such countries. It worries me that after a decade when it seemed that the political conditions have greatly improved in many countries, after 2000 the actions of the governments from North America, Western Europe and Australia have become each year more and more similar to the actions of the former communist governments that they previously loved to criticize for their disregard of human rights, and the legal rights of the citizens of these countries have become more and more restricted, under various pretexts, such as "war on terror" or "save the children".
- bombolo 4y ago
  Perhaps you're not familiar with this https://www.youtube.com/watch?v=d-7o9xYp7eE https://www.youtube.com/watch?v=d-7o9xYp7eE
greatgib 4y ago
To be noted, there is a subtile nuance with the meaning of this ruling. It does not really says that "it is a crime" but that "it might be a crime under certain Circumstances". In the current case it is like there is a password, it is known, it is needed to unlock a phone, not encrypted data itself. And the guy is plainly refusing to give it. This is the case that was judged. But hundreds of variations of this still might or might not be a crime in a future case.
- gruez 4y ago
  >In the current case it is like there is a password, it is known, it is needed to unlock a phone, not encrypted data itself. I'm not seeing the distinction here. Don't all modern phones have encryption enabled by default, and the encryption keys are partly derived from the passcode?
  - courgette 4y ago
    They do mention that explicitly. But that further confuse me then. The circumstances seems to be “we Know you conducted illegal trade on that phone” ?
  - greatgib 4y ago
    I'm not sure on the technical ruling details, but it looks like something like that: They did not care about the data, officially. As they have already recording, sms, ... They just wanted to access the home of his phone that his restricted by the passcode. And he explicitly refused. Nothing say that once they would accessed, they would have been allowed to access private data or being able to use any of that in the trial. It is like a 2 steps process. First they should be granted access, then there is the question of incriminating data that could encrypted or not. It looks dubious, but it is how it is presented to be able to get such a ruling. As an equivalent, imagine that cops ask you to unlock the steal bar reinforced door of your entrance because they have a warrant and you refuse. And you claim that their might be naked pictures of you inside of your home this is why you refuse.
    - 4y ago
mherdeg 4y ago
A neat question is whether it would be illegal for Apple to refuse to write software to unlock the iPhone of someone who illegally refuses to disclose their passcode.
- lotsofpulp 4y ago
  It would be legal for Apple to refuse, but France can make it a requirement to sell phones in France. And then Apple would have to decide to comply or cease French operations.
  - nilespotter 4y ago
    Well they bent right over on USB-C, so ...
    - egberts1 4y ago
      That ... is a demonstration of making the product fit into the law. Would Not be a stretch for France to do this toward the security alcove portion of Apple iPhones as well.
Barrin92 4y ago
I'm a little bit skeptical about the claim that refusing access to a phone falls under the right of not self incriminating. There is such a thing as a lawful search of property, and when someone comes to you with a warrant to search your car in particular if it involves an ongoing crime you certainly cannot refuse, and pretending you forgot the keys isn't going to do you much good either. I don't think phones are particularly special in that regard. The bigger issue seems to be that phone searches are often attempted in unlawful manner.
- crooked-v 4y ago
  Your analogy actually supports not giving up a password: if you pretend to lose your keys, it's not illegal to avoid helping the cops find them.
  - Barrin92 4y ago
    I'm not convinced that's true because I feel like I'm getting hit with obstruction next, also depending on the country in question of course. But the important point is this isn't about self-incrimination. If you accept that a search of property can be ordered then that implies that authority can compel you to actually see the search through. In the physical world the police would just break your lock. Can't do that with encryption, but that's not a legal argument. If someone was screaming in a trunk and cars had unbreakable locks, that wouldn't be a justification to not compel the driver to open it.
    - crooked-v 4y ago
      > If you accept that a search of property can be ordered then that implies that authority can compel you to actually see the search through. Except, it doesn't. If police present a warrant at your door they can't force you to help them open the bank vault in your basement. > If someone was screaming in a trunk and cars had unbreakable locks, that wouldn't be a justification to not compel the driver to open it. Now you've moved the goalposts from "search and seizure" to "crime actively in progress". These things are not the same, ethically or legally.
breton 4y ago
I am reading a bit more about this. In a similar case, where Fair Trials intervened, they made this submission: https://www.fairtrials.org/app/uploads/2022/03/FT-intervention-Minteh-v-France-21-Feb-2022.pdf https://www.fairtrials.org/app/uploads/2022/03/FT-interventi... . In the submission there are these sentences: > Law enforcement authorities may compel suspects to provide the passcode to their mobile device under threat of a legal sanction pursuant to Article 434-15-2 paragraph 1 of the French Criminal Code, [...]. The request must be sanctioned by a judicial authority. What is this sanction by judicial authority? A court order? Can it be appealed against? Can i get a lawyer participate in the hearing for the sanction?
- simonh 4y ago
  France has investigating judges, maybe one of them would have the authority?
- rtsil 4y ago
  Warning: IANAL. Sanction here does not mean punishment, it means approved (the law itself says "upon request") That article of the Criminal Code refers to two chapters of the Code of Criminal Procedure, which covers the two types of criminal investigations in France and their respective judicial authority: the prosecutor, and the judge of instruction (an investigative magistrate). An order/request by the judge can be appealed against, I don't think the orders/requests of the prosecutor can be appealed.
  - breton 4y ago
    Thanks. I raised the question, because i want to understand, how much police in France needs to do to issue an order to unlock a phone. It does not sound too bad to me, if they have to go through a judge and a hearing to issue the order.
    - rtsil 4y ago
      The problem is that the prosecutor can issue a blanket order that forces any person, company or organization to hand over to the police any and all digital information and data that may be related to the investigation. And as with all blanket orders, this gives a lot of leeway to the police.
nimbius 4y ago
friendly reminder for those in the USA, or visiting it: face, blood, fingerprint, and other biometrics on your mobile device are not protected by the 5th amendment and can be secured from your person by force if necessary and compelled by a warrant. If you fail to submit to a DUI test for example, your blood can be forcibly drawn against your consent in the presence of a warrant. strong passphrases (not passwords) however are vital to your security and protected under the united states 5th amendment. you can be compelled to surrender your device, but not its password. failure to disclose a password cannot be used as reasonable suspicion to detain you for a crime.
- trafnar 4y ago
  Related for iPhone users: if you press and hold the lock and volume up buttons until the "slide to power off" screen appears, FaceID will be disabled until the next successful passcode entry. You can press "cancel" after the "power off" screen appears, or you can power it off, faceID will be disabled regardless. Further discussion: https://daringfireball.net/2022/06/require_a_passcode_to_unlock_your_iphone https://daringfireball.net/2022/06/require_a_passcode_to_unl...
  - derrasterpunkt 4y ago
    One can also press the lock button five times which has the same outcome.
    - 14 4y ago
      iPhone 8 on iOS 13 here. That does not work but holding lock and volume does.
  - Symbiote 4y ago
    Are there any Android phones with a similar feature?
    - rrrrrrrrrrrryan 4y ago
      It's called "lockdown mode" on Android, usually in the power menu. Not quite as good as a pure hardware button flow, but it does exist.
jrvarela56 4y ago
Would be awesome to have another password that on input shows a fresh profile and wipes the 'real' profile in the background.
- deleted 4y ago
  [deleted]
- ewi_ 4y ago
  Ledger, the leader in crypto hardware manufacturer, has a "Plausible Deniability" feature that works a bit like this https://www.ledger.com/ledger-101-part-4-advanced-security-principles https://www.ledger.com/ledger-101-part-4-advanced-security-p...
  - KennyBlanken 4y ago
    > the leader in crypto hardware manufacturer [Citation required]
    - egberts1 4y ago
      They may not be the best but they are pretty damn good for its class, and yes are the leader in its class.
- 1letterunixname 4y ago
  Not exactly the same functionality, but veracrypt/truecrypt supports key files and multiple hidden volumes for plausible deniability. Overwrite a key file used to unlock "your stuff" and there goes the data.
deleted 4y ago
[deleted]
user5994461 4y ago
It seems to me this English article does not reflect the actual decision of the court in French. See judgment here and attached PDF (in French) https://www.courdecassation.fr/toutes-les-actualites/2022/11/07/code-de-deverrouillage-dun-ecran-de-telephone-et-cryptologie https://www.courdecassation.fr/toutes-les-actualites/2022/11... The case was a person who was arrested for drug possession and trafficking, they were requested to give their passcode to unlock 2 phones allegedly used for trafficking, they refused then were further charged for not giving their password. 1) 15th May 2018 - First court ruled on drug trafficking but rejected the charges for not giving the passcode to unlock the phone, considering that a screen passcode is not a cryptographic mean to make the data on the phone unreadable or inaccessible. 2) 11th July 2019 - Escalated to the court of Appeal, same result. 3) 13th October 2020 - Escalated to the cour de cassation, who ruled that the law was incorrectly applied and sent back the case to the court. The cour de cassation doesn't rule cases, it only rules on whether a specific law was correctly applied by the court. (A decision of the court de cassation, like this one, explains how a law is meant to be interpreted and applied by the courts). 4) 20th April 2021 - The court of Appeal, repeated the initial result (home screen passcode is not a cryptographic mean to protect data) and dismissed the charges AGAIN. 5) Yesterday - Escalated to the cour de cassation AGAIN, who ruled that the law was incorrectly applied AGAIN, and sent back the case to the court AGAIN. 6) Future - This is pending another trial, from the court of appeal. My understanding of the cour de cassation explanations, the home screen may or may not constitute a cryptographic mean to make the data unreadable or inaccessible, that depends on the phone. The court needs to rule on whether it is for that specific phone in that specific case. For the HN audience who is technical and some of you actually make the phones. Most modern phones including all Apple and most Android have cryptographic means to protect all the data on the phone, it's effectively not possible to access contacts, messages, photos, storage, etc without having the home screen password. (Please consider that historically, it was often possible to take out the sim card or the storage SD card or use other tools to read the content of the phone, but not anymore) My understanding is that the next ruling will have to consider whether these technical protections render the data inaccessible to the police. If yes and the data is deemed required for a criminal investigation, the suspect is required by law to disclose their passcode, or risk up to 3 year of prison and 270 000 euros.
- 4y ago
courgette 4y ago
It’s not over, the higher court just send it back to the lower one. But still, I find it concerning. If you happen to read French the appeal court publish a good technical summary. https://www.courdecassation.fr/toutes-les-actualites/2022/11/07/code-de-deverrouillage-dun-ecran-de-telephone-et-cryptologie https://www.courdecassation.fr/toutes-les-actualites/2022/11... Par conséquent, en l’espèce, la décision de la cour d’appel est cassée et une autre cour d’appel est désignée pour rejuger l’affaire.
- gobip 4y ago
  As always, the country known for its human rights (or so they advertise themselves as), is gonna get reprimanded by the european court for not respecting the human rights. Good job France.
  - Kuinox 4y ago
    Always first on the start, and always arriving late.
  - wobbly_bush 4y ago
    > As always, the country known for its human rights (or so they advertise themselves as) As someone who wasn't aware of this association, I'm curious where do they advertise themselves for human rights?
    - ramesh31 4y ago
      https://en.wikipedia.org/wiki/Liberté,_égalité,_fraternité https://en.wikipedia.org/wiki/Liberté,_égalité,_fraternité
      - ASalazarMX 4y ago
        "Tell me what you boast of, and I'll tell you what you lack." - Old Hispanic proverb
        4y ago
deleted 4y ago
[deleted]
ispo 4y ago
Sorry I cannot remember it.
19870213 4y ago
Would it be possible to construct a file/system encryption scheme where you have a read-write passcode and a read-only passcode? Such that when given the read-only passcode it would allow (legal/valid) searches by law enforcement, but not (easily) allow fabrication of evidence by planting incriminating files? I suppose you could make it part of a signature scheme for files (file written by passcode X) so that your defense could point to the discrepancy in your favour.
- m00x 4y ago
  Any backdoor made for law enforcement will eventually land in the hands of bad actors, and sometimes those backdoors will be used illegally by law enforcement.
  - oh_my_goodness 4y ago
    The proposal is kind of the opposite. It's a restricted mode intended for use by law enforcement.
    - hnuser123456 4y ago
      It's a practical feature in general, to allow anyone to poke through your phone without installing/posting/reconfiguring anything, occasionally nice to have. Then again, it would also slightly increase the social normalcy of being able to ask to snoop through other people's phones.
      - asvitkine 4y ago
        So they can use the banking app to transfer money away from your account because that's not stored locally on your phone? Or to look at your private photos?
        halper 4y ago
        Surely even banks/countries that do not have a stronger auth method require at least a password for login?
makeitdouble 4y ago
For context, French law doesn’t have a “5th”: you were already required to expose decryption keys of encrypted data if requested (e.g: give a password for a locked zip file) The law: https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000032654251/ https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI00003... This specific ruling is about wether the lock screen of the phone was subjected to this law as well. Basically, is the lockscreen password a decryption key ? The Cassation court judgement comes from the disk encryption mechanism being now attached to the phone locking mechanism: full disc encryption is only unlocked when the phone unlocks, so the passcode screen can be seen as a mean to unlock the disk.
fieryskiff11 4y ago
puffoflogic 4y ago
Apropos of nothing, social media comments often leave me doubtful about how many people truly grok that laws are different in different jurisdictions.
1letterunixname 4y ago
So Chelsea Manning-treatment then. Try as they might, they can't extract something someone knows short of trying rubber-hose cryptanalysis.
qualudeheart 4y ago
What’s the answer to 1300 + 12? I think it has something to do with this french law.
deleted 4y ago
[deleted]

313 points by miles 4y ago

Interesting. Doesn't France have a legal system that leans more towards Civil Law than Common Law? So how much legal validity does this judgement have?

formerly_proven 4y ago
This comes from their equivalent of the Supreme Court
- ohbtvz 4y ago
  No, the cour de cassation is not the equivalent of the supreme court in many ways. * It doesn't judge the constitutionality of laws. That's the constitutional court. * It doesn't judge cases related to complaints against the administration. That's for the council of state. * Its precedents don't bind lower courts, who are free to rule differently. * In France, judges are explicitly forbidden to write a judgement that seems to hold in a general manner (article 5 of the penal procedure code) - we have a much stricter separation between the legislative and judiciary. They always judge specific cases. This applies to the cour de cassation as well. It's just not useful to try and compare the US and French legal systems. They're too different.
  - occamrazor 4y ago
    Article 5 C.p.p. is about jurisdiction ov criminal and civil courts. Did you mean a different article?
    - palsecam 4y ago
      Article 5 of the civil code, I guess: « Il est défendu aux juges de prononcer par voie de disposition générale et réglementaire sur les causes qui leur sont soumises. » https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006419284/2022-10-29 https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI0000...
      - ohbtvz 4y ago
        Yep, that's the one I meant, sorry.
  - webmobdev 4y ago
    > we have a much stricter separation between the legislative and judiciary. Could you clarify more? You also said, "In a civil law country, precedent is always subordinate to codified law." That would imply that there is less room for judges to interpret the law more freely. (In India, for example, constitutional courts can even expand or contract the law, by striking down or adding provisions to it through the power of judicial reviews.)
mytailorisrich 4y ago
This decision is de facto the Law. Indeed, this is a decision of the "Cour de Cassation", which is the highest court and which does not judge guilt in specific cases (edited to clarify), but whether the law was correctly applied. So by judging that this is a criminal offence (actually they have only confirmed previous legal decisions so it was expected) they have ruled that French Law states that this is a criminal offence, including based on jurisprudence (previous decisions). So that rather settles it.
- ohbtvz 4y ago
  The cour de cassation does judge specific cases. They don't make the law and lower courts are not bound to their precedent. I wrote a more complete explanation in a sibling comment.
  - mytailorisrich 4y ago
    "En effet, son rôle n’est pas de rejuger les affaires. Elle juge le droit exclusivement. De ce fait, la Cour de cassation ne s’attache pas aux faits d’un arrêt ou d’un jugement, mais elle vérifie la bonne application de la loi à la décision attaquée. Autrement dit, elle ne se prononce pas sur les litiges, mais seulement sur les décisions qui concernent les litiges." [1] It only checks that the law was correctly applied, it is not an appeal where the guilt is re-assessed (that's what I meant, obviously not very clearly). [1] https://juripredis.com/la-jurisprudence-dossier/comment-definir-la-jurisprudence/quelle-est-la-jurisprudence-de-la-cour-de-cassation/#:~:text=Elle%20juge%20le%20droit%20exclusivement,d%C3%A9cisions%20qui%20concernent%20les%20litiges https://juripredis.com/la-jurisprudence-dossier/comment-defi....
ohbtvz 4y ago
It doesn't "lean more" towards civil law, it is a civil law legal system. Nevertheless, precedent ("jurisprudence") is still part of the legal framework. The cour de cassation, the highest court of appeals, has rendered a judgement about something which is ambiguous in the law. This is a judgment about a particular case in a particular situation, and judges are explicitly forbidden from writing anything in their judgment that would look like a general statement. Lower courts are independent and can render different judgments in similar cases if they interpret the law and the situation presented to them differently. So why does it matter that the cour de cassation created this precedent? Well, it's the highest court of appeal. Any lower court who judges differently sees clearly the "risk" that their judgment is appealed, passed on to the cour de cassation, overturned, and needed to be judged again. We have professional judges in France, and they recognize there is little point in wasting the State's resources on such things without good reason. But because we are in a civil law country, it is quite likely that the existing law will be clarified and supplant the precedent. In a civil law country, precedent is always subordinate to codified law.
- webmobdev 4y ago
  Thanks for the clarification. I just recently became aware of how different the French legal system is when I started watching "Murder in Provence" and was confused when a judge himself got involved the investigation of criminal cases.

bvanderveen 4y ago

Super, le pays des droits de l’homme !

deleted 4y ago
[deleted]
ur-whale 4y ago
> Super, le pays des droits de l’homme ! Only folks who never left France still believe in that worn out trope.

guerby 4y ago

There is an appeal being made to ECHR (1) according to: https://www.nextinpact.com/lebrief/70314/refuser-deverouiller-son-telephone-portable-peut-constituer-delit https://www.nextinpact.com/lebrief/70314/refuser-deverouille... (Also other cases are mentionned in the fairtrials article) (1) https://en.wikipedia.org/wiki/European_Court_of_Human_Rights https://en.wikipedia.org/wiki/European_Court_of_Human_Rights

chetanbhasin 4y ago

Good thing that I keep forgetting my passcode then.

commandlinefan 4y ago
Forgetting it is a crime, too.
- mirekrusin 4y ago
  Is it? Btw. with new iPhone they just need to hold it close to his face while handcuffed.
  - toomuchtodo 4y ago
    Does pressing the power button five times still disable biometrics? Edit from sibling comment link with alternate easier method to hard lock: “Just press and hold the buttons on both sides. Remember that. Try it now. Don’t just memorize it, internalize it, so that you’ll be able to do it without much thought while under duress, like if you’re confronted by a police officer. Remember to do this every time you’re separated from your phone, like when going through the magnetometer at any security checkpoint, especially airports. As soon as you see a metal detector ahead of you, you should think, “Hard-lock my iPhone”.”
    - ljlolel 4y ago
      yes
    - bombcar 4y ago
      Yep, just tested here, 5 clicks and you get the emergency/poweroff screen which then will require passcode afterwards, even if you don't power off.
      - rrrrrrrrrrrryan 4y ago
        For those with Android phones, do not try this, as it triggers emergency SOS. (I just made this mistake lol).

mgamache 4y ago

The EU is so protective of consumer rights, but not of personal rights with respect to governments. Seems odd, but is a result of socialist influence. In the US we have more protection against government abuse and less corporate. But it ends up being the worst of all worlds because the government just uses the corporations to provide the data they could/would never have access to.

mytailorisrich 4y ago
There always has to be a balance. Some countries have enacted laws to create an obligation to disclose encryption keys, etc. during criminal investigations in response to new technologies because now everyone has access to encryption methods that are essentially unbreakable without knowing the key. So while people have and should have the right not to incriminate themselves it is also reasonable to ensure that criminal investigations can still be (fairly) carried out... It was much easier when people could only hide their secrets in a safe. I believe even in the US one may be obligated to disclose keys. One big question is whether this should require a court order, which implies that the police must convince a judge that this is necessary and useful, or whether (as seems the case here?) the police themselves have that power, which is indeed more contentious.
deleted 4y ago
[deleted]
formerly_proven 4y ago
The US has uniquely good protections against abuse by government officials. Things like the fruit of the poisonous tree doctrine, explicitly designed to keep prosecutors from overstepping their boundaries, simply don't exist in most of the world. Admissibility is complex and important in the US and basically not a concern outside the US at all, virtually everything is admissible in court. For example, it has been established at the highest level of jurisprudence in the EU that you can torture suspects and you can prosecute them with evidence acquired through their forced confession. That's because at a fundamental level, the prosecutors/court determining the truth far outweighs the right to a fair trial in most of the world. The idea outside the US being that you'll just prosecute investigators and prosecutors who overstep legal boundaries.

otikik 4y ago

Two words: “J’ai oublié”

knodi123 4y ago
If the judge believes you: "Okay! Sucks for the cops." If the judge does not believe you: "That's contempt. You can sit in jail until you decide to remember." A better two words would be "hidden volume". https://www.truecrypt71a.com/documentation/plausible-deniability/hidden-volume/ https://www.truecrypt71a.com/documentation/plausible-deniabi...
- userbinator 4y ago
  ...or "duress password".
- jeroenhd 4y ago
  It's trivial to find if a hidden volume is in use or not. It's a good defence against an abusive family member who isn't very tech-savvy, but it's useless against law enforcement.
  - martinko 4y ago
    How exactly?
    - malfist 4y ago
      Source: Trust him. In all fairness, there is a lot of documentation in veracrypt's manual about how to properly hide a hidden partition, and how it's circumvented. Most of them rely on knowledge of the encrypted container over time. A single point in time is unlikely to reveal a hidden partition, but if you are being monitored that is possible. Please note that backups or wear leveling on an SSD, or just the TRIM command not deleting stored data can provide those points in time. Hidden partitions work best on magnetic drives. Read them here: https://veracrypt.eu/en/Security%20Requirements%20for%20Hidden%20Volumes.html https://veracrypt.eu/en/Security%20Requirements%20for%20Hidd...

adrian_b 4y ago

In my opinion, one of the most fundamental human rights, maybe even the most important human right, is the right to refuse to answer to a question. Any law that says that there are circumstances when humans must answer to a question otherwise they will be punished is wrong and abusive. Obviously, when people are suspected to have done something illegal, but they refuse to give answers that might dis-incriminate them, then that can be used in conjunction with evidence that makes probable that they are guilty to conclude that they are indeed guilty and sentence them accordingly. However, in such cases any punishment should be for the crime whose authors they are believed to be and not for refusing to answer any question. I do not care if a bunch of mean or stupid people claim to "represent the will of the people" and they make Draconian laws that punish those who do not answer questions. I will never recognize that they have any right to make such laws and I pity the people that are so naive that they accept the existence of such laws. I have been born and I have grown up in a country which was governed by a criminal organization which had received the political power from a foreign invading army, even if they also claimed that they have been elected democratically and they "represent the will of the people". To maintain their power, the government imprisoned and killed any opponents, which were identified through mass surveillance. Any honest citizen did not have any greater wish than to get rid of the government, but it was impossible to organize any kind of opposition, due to the mass surveillance and due to the confidential informers who infiltrated any institution or company. In such a country, answering the truth to any question of a law enforcement officer could lead to grave consequences for other innocent people, from destroying their professional careers, up to even death. A similar history was shared by all the countries in the Eastern Europe, but there are also many other such countries. It worries me that after a decade when it seemed that the political conditions have greatly improved in many countries, after 2000 the actions of the governments from North America, Western Europe and Australia have become each year more and more similar to the actions of the former communist governments that they previously loved to criticize for their disregard of human rights, and the legal rights of the citizens of these countries have become more and more restricted, under various pretexts, such as "war on terror" or "save the children".

bombolo 4y ago
Perhaps you're not familiar with this https://www.youtube.com/watch?v=d-7o9xYp7eE https://www.youtube.com/watch?v=d-7o9xYp7eE

greatgib 4y ago

To be noted, there is a subtile nuance with the meaning of this ruling. It does not really says that "it is a crime" but that "it might be a crime under certain Circumstances". In the current case it is like there is a password, it is known, it is needed to unlock a phone, not encrypted data itself. And the guy is plainly refusing to give it. This is the case that was judged. But hundreds of variations of this still might or might not be a crime in a future case.

gruez 4y ago
>In the current case it is like there is a password, it is known, it is needed to unlock a phone, not encrypted data itself. I'm not seeing the distinction here. Don't all modern phones have encryption enabled by default, and the encryption keys are partly derived from the passcode?
- courgette 4y ago
  They do mention that explicitly. But that further confuse me then. The circumstances seems to be “we Know you conducted illegal trade on that phone” ?
- greatgib 4y ago
  I'm not sure on the technical ruling details, but it looks like something like that: They did not care about the data, officially. As they have already recording, sms, ... They just wanted to access the home of his phone that his restricted by the passcode. And he explicitly refused. Nothing say that once they would accessed, they would have been allowed to access private data or being able to use any of that in the trial. It is like a 2 steps process. First they should be granted access, then there is the question of incriminating data that could encrypted or not. It looks dubious, but it is how it is presented to be able to get such a ruling. As an equivalent, imagine that cops ask you to unlock the steal bar reinforced door of your entrance because they have a warrant and you refuse. And you claim that their might be naked pictures of you inside of your home this is why you refuse.
  - 4y ago

mherdeg 4y ago

A neat question is whether it would be illegal for Apple to refuse to write software to unlock the iPhone of someone who illegally refuses to disclose their passcode.

lotsofpulp 4y ago
It would be legal for Apple to refuse, but France can make it a requirement to sell phones in France. And then Apple would have to decide to comply or cease French operations.
- nilespotter 4y ago
  Well they bent right over on USB-C, so ...
  - egberts1 4y ago
    That ... is a demonstration of making the product fit into the law. Would Not be a stretch for France to do this toward the security alcove portion of Apple iPhones as well.

Barrin92 4y ago

I'm a little bit skeptical about the claim that refusing access to a phone falls under the right of not self incriminating. There is such a thing as a lawful search of property, and when someone comes to you with a warrant to search your car in particular if it involves an ongoing crime you certainly cannot refuse, and pretending you forgot the keys isn't going to do you much good either. I don't think phones are particularly special in that regard. The bigger issue seems to be that phone searches are often attempted in unlawful manner.

crooked-v 4y ago
Your analogy actually supports not giving up a password: if you pretend to lose your keys, it's not illegal to avoid helping the cops find them.
- Barrin92 4y ago
  I'm not convinced that's true because I feel like I'm getting hit with obstruction next, also depending on the country in question of course. But the important point is this isn't about self-incrimination. If you accept that a search of property can be ordered then that implies that authority can compel you to actually see the search through. In the physical world the police would just break your lock. Can't do that with encryption, but that's not a legal argument. If someone was screaming in a trunk and cars had unbreakable locks, that wouldn't be a justification to not compel the driver to open it.
  - crooked-v 4y ago
    > If you accept that a search of property can be ordered then that implies that authority can compel you to actually see the search through. Except, it doesn't. If police present a warrant at your door they can't force you to help them open the bank vault in your basement. > If someone was screaming in a trunk and cars had unbreakable locks, that wouldn't be a justification to not compel the driver to open it. Now you've moved the goalposts from "search and seizure" to "crime actively in progress". These things are not the same, ethically or legally.

breton 4y ago

I am reading a bit more about this. In a similar case, where Fair Trials intervened, they made this submission: https://www.fairtrials.org/app/uploads/2022/03/FT-intervention-Minteh-v-France-21-Feb-2022.pdf https://www.fairtrials.org/app/uploads/2022/03/FT-interventi... . In the submission there are these sentences: > Law enforcement authorities may compel suspects to provide the passcode to their mobile device under threat of a legal sanction pursuant to Article 434-15-2 paragraph 1 of the French Criminal Code, [...]. The request must be sanctioned by a judicial authority. What is this sanction by judicial authority? A court order? Can it be appealed against? Can i get a lawyer participate in the hearing for the sanction?

simonh 4y ago
France has investigating judges, maybe one of them would have the authority?
rtsil 4y ago
Warning: IANAL. Sanction here does not mean punishment, it means approved (the law itself says "upon request") That article of the Criminal Code refers to two chapters of the Code of Criminal Procedure, which covers the two types of criminal investigations in France and their respective judicial authority: the prosecutor, and the judge of instruction (an investigative magistrate). An order/request by the judge can be appealed against, I don't think the orders/requests of the prosecutor can be appealed.
- breton 4y ago
  Thanks. I raised the question, because i want to understand, how much police in France needs to do to issue an order to unlock a phone. It does not sound too bad to me, if they have to go through a judge and a hearing to issue the order.
  - rtsil 4y ago
    The problem is that the prosecutor can issue a blanket order that forces any person, company or organization to hand over to the police any and all digital information and data that may be related to the investigation. And as with all blanket orders, this gives a lot of leeway to the police.

nimbius 4y ago

friendly reminder for those in the USA, or visiting it: face, blood, fingerprint, and other biometrics on your mobile device are not protected by the 5th amendment and can be secured from your person by force if necessary and compelled by a warrant. If you fail to submit to a DUI test for example, your blood can be forcibly drawn against your consent in the presence of a warrant. strong passphrases (not passwords) however are vital to your security and protected under the united states 5th amendment. you can be compelled to surrender your device, but not its password. failure to disclose a password cannot be used as reasonable suspicion to detain you for a crime.

trafnar 4y ago
Related for iPhone users: if you press and hold the lock and volume up buttons until the "slide to power off" screen appears, FaceID will be disabled until the next successful passcode entry. You can press "cancel" after the "power off" screen appears, or you can power it off, faceID will be disabled regardless. Further discussion: https://daringfireball.net/2022/06/require_a_passcode_to_unlock_your_iphone https://daringfireball.net/2022/06/require_a_passcode_to_unl...
- derrasterpunkt 4y ago
  One can also press the lock button five times which has the same outcome.
  - 14 4y ago
    iPhone 8 on iOS 13 here. That does not work but holding lock and volume does.
- Symbiote 4y ago
  Are there any Android phones with a similar feature?
  - rrrrrrrrrrrryan 4y ago
    It's called "lockdown mode" on Android, usually in the power menu. Not quite as good as a pure hardware button flow, but it does exist.

jrvarela56 4y ago

Would be awesome to have another password that on input shows a fresh profile and wipes the 'real' profile in the background.

deleted 4y ago
[deleted]
ewi_ 4y ago
Ledger, the leader in crypto hardware manufacturer, has a "Plausible Deniability" feature that works a bit like this https://www.ledger.com/ledger-101-part-4-advanced-security-principles https://www.ledger.com/ledger-101-part-4-advanced-security-p...
- KennyBlanken 4y ago
  > the leader in crypto hardware manufacturer [Citation required]
  - egberts1 4y ago
    They may not be the best but they are pretty damn good for its class, and yes are the leader in its class.
1letterunixname 4y ago
Not exactly the same functionality, but veracrypt/truecrypt supports key files and multiple hidden volumes for plausible deniability. Overwrite a key file used to unlock "your stuff" and there goes the data.

deleted 4y ago

[deleted]

user5994461 4y ago

It seems to me this English article does not reflect the actual decision of the court in French. See judgment here and attached PDF (in French) https://www.courdecassation.fr/toutes-les-actualites/2022/11/07/code-de-deverrouillage-dun-ecran-de-telephone-et-cryptologie https://www.courdecassation.fr/toutes-les-actualites/2022/11... The case was a person who was arrested for drug possession and trafficking, they were requested to give their passcode to unlock 2 phones allegedly used for trafficking, they refused then were further charged for not giving their password. 1) 15th May 2018 - First court ruled on drug trafficking but rejected the charges for not giving the passcode to unlock the phone, considering that a screen passcode is not a cryptographic mean to make the data on the phone unreadable or inaccessible. 2) 11th July 2019 - Escalated to the court of Appeal, same result. 3) 13th October 2020 - Escalated to the cour de cassation, who ruled that the law was incorrectly applied and sent back the case to the court. The cour de cassation doesn't rule cases, it only rules on whether a specific law was correctly applied by the court. (A decision of the court de cassation, like this one, explains how a law is meant to be interpreted and applied by the courts). 4) 20th April 2021 - The court of Appeal, repeated the initial result (home screen passcode is not a cryptographic mean to protect data) and dismissed the charges AGAIN. 5) Yesterday - Escalated to the cour de cassation AGAIN, who ruled that the law was incorrectly applied AGAIN, and sent back the case to the court AGAIN. 6) Future - This is pending another trial, from the court of appeal. My understanding of the cour de cassation explanations, the home screen may or may not constitute a cryptographic mean to make the data unreadable or inaccessible, that depends on the phone. The court needs to rule on whether it is for that specific phone in that specific case. For the HN audience who is technical and some of you actually make the phones. Most modern phones including all Apple and most Android have cryptographic means to protect all the data on the phone, it's effectively not possible to access contacts, messages, photos, storage, etc without having the home screen password. (Please consider that historically, it was often possible to take out the sim card or the storage SD card or use other tools to read the content of the phone, but not anymore) My understanding is that the next ruling will have to consider whether these technical protections render the data inaccessible to the police. If yes and the data is deemed required for a criminal investigation, the suspect is required by law to disclose their passcode, or risk up to 3 year of prison and 270 000 euros.

4y ago

courgette 4y ago

It’s not over, the higher court just send it back to the lower one. But still, I find it concerning. If you happen to read French the appeal court publish a good technical summary. https://www.courdecassation.fr/toutes-les-actualites/2022/11/07/code-de-deverrouillage-dun-ecran-de-telephone-et-cryptologie https://www.courdecassation.fr/toutes-les-actualites/2022/11... Par conséquent, en l’espèce, la décision de la cour d’appel est cassée et une autre cour d’appel est désignée pour rejuger l’affaire.

gobip 4y ago
As always, the country known for its human rights (or so they advertise themselves as), is gonna get reprimanded by the european court for not respecting the human rights. Good job France.
- Kuinox 4y ago
  Always first on the start, and always arriving late.
- wobbly_bush 4y ago
  > As always, the country known for its human rights (or so they advertise themselves as) As someone who wasn't aware of this association, I'm curious where do they advertise themselves for human rights?
  - ramesh31 4y ago
    https://en.wikipedia.org/wiki/Liberté,_égalité,_fraternité https://en.wikipedia.org/wiki/Liberté,_égalité,_fraternité
    - ASalazarMX 4y ago
      "Tell me what you boast of, and I'll tell you what you lack." - Old Hispanic proverb
      - 4y ago

deleted 4y ago

[deleted]

ispo 4y ago

Sorry I cannot remember it.

19870213 4y ago

Would it be possible to construct a file/system encryption scheme where you have a read-write passcode and a read-only passcode? Such that when given the read-only passcode it would allow (legal/valid) searches by law enforcement, but not (easily) allow fabrication of evidence by planting incriminating files? I suppose you could make it part of a signature scheme for files (file written by passcode X) so that your defense could point to the discrepancy in your favour.

m00x 4y ago
Any backdoor made for law enforcement will eventually land in the hands of bad actors, and sometimes those backdoors will be used illegally by law enforcement.
- oh_my_goodness 4y ago
  The proposal is kind of the opposite. It's a restricted mode intended for use by law enforcement.
  - hnuser123456 4y ago
    It's a practical feature in general, to allow anyone to poke through your phone without installing/posting/reconfiguring anything, occasionally nice to have. Then again, it would also slightly increase the social normalcy of being able to ask to snoop through other people's phones.
    - asvitkine 4y ago
      So they can use the banking app to transfer money away from your account because that's not stored locally on your phone? Or to look at your private photos?
      - halper 4y ago
        Surely even banks/countries that do not have a stronger auth method require at least a password for login?

makeitdouble 4y ago

For context, French law doesn’t have a “5th”: you were already required to expose decryption keys of encrypted data if requested (e.g: give a password for a locked zip file) The law: https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000032654251/ https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI00003... This specific ruling is about wether the lock screen of the phone was subjected to this law as well. Basically, is the lockscreen password a decryption key ? The Cassation court judgement comes from the disk encryption mechanism being now attached to the phone locking mechanism: full disc encryption is only unlocked when the phone unlocks, so the passcode screen can be seen as a mean to unlock the disk.

fieryskiff11 4y ago

puffoflogic 4y ago

Apropos of nothing, social media comments often leave me doubtful about how many people truly grok that laws are different in different jurisdictions.

1letterunixname 4y ago

So Chelsea Manning-treatment then. Try as they might, they can't extract something someone knows short of trying rubber-hose cryptanalysis.

qualudeheart 4y ago

What’s the answer to 1300 + 12? I think it has something to do with this french law.

deleted 4y ago

[deleted]