9 ms·

Judge: Americans can be forced to decrypt their laptops

175 points by llambda 15y ago

deleted 15y ago
[deleted]
ChrisNorstrom 15y ago
The problem here is what are they going to find that ISN'T Illegal? Everyone has cracked software, pirated movies, & torrents. Then there's content that isn't illegal but very personal: chat logs, email archives, contact lists, usernames & passwords, FTP info, master passwords to everything, OH and my entire life's worth of inventions and ideas. I'm not saying they'd steal them but remember, we're talking about the American Government here. The same one that can't account for billions of dollars in missing money. Lost 6.6 Billion in Iraq and doesn't know what happened to it. And doesn't know how or why a warehouse full of missiles in the middle east is empty. If that's how they treat their money and weapons, I wonder how they're going to treat my life's work. So... Just use TrueCrypt to create a hidden volume on a flash drive or SD card, keep everything else un-encrypted. They won't even know it's there. I've got a 32 GB SD card just for this purpose, it's got all my project files on it, thunderbird portable, my entire collection of inventions and business ideas, my life's work basically. If anyone were to plug that card in, it would just read "card has not been formatted yet". I've got a backup of it as well. If you have a hard drive full of torrented content or DVD rips that look like torrented content just make 2 TrueCrypt volumes, one that is visible (put some porn on it to simulate a "this is all I have hidden" excuse) and the other volume hidden (with all of your pirated content). They literally won't ever know it was there.
- gcr 15y ago
  The fact that you have truecrypt installed on your start menu is a dead giveaway.
  - vessenes 15y ago
    No, he has a plausible deniability plan.
  - gte910h 15y ago
    Truecrypt is also excellent full disk encryption in case your computer is stolen
  - korny 15y ago
    I use truecrypt to encrypt lots of legitimate stuff. All my financial data is on a truecrypt volume on DropBox. And I suspect that folks with something to hide wouldn't find it hard to hide trucrypt itself.
    - jiggy2011 15y ago
      where you going to hide it? In another truecrypt volume? It would be easier just to only use it via a VM booted from a Linux Live CD.
- Karunamon 15y ago
  >Everyone has cracked software, pirated movies, & torrents That's a bit of a leap, really. Also, Truecrypt's deniable encryption here doesn't seem like it would help, since they're talking at the computer level. Presumably, a power on or hard drive password. Assuming there's only one volume, you put that one in and the attacker has the keys to the kingdom. Besides that, most averages joes wouldn't go through this kind of trouble. If you're running in opposition to a ruling power who might, say, launch a missile at you from 30,000 feet while you're in foreign territory (not naming any names here), then you probably already know to cover your ass. On the other hand, an average joe thinking that they're cute by giving up the password to the concealed volume will only land a contempt charge when the file access times are checked.
  - Simucal 15y ago
    TrueCrypt supports Hidden OS partitions much like its normal hidden containers and it asks for these passwords at boot. You could enter one password and have it boot into a boring Windows XP environment while the true password would boot to your actual environment with all your secret files.
    - Karunamon 15y ago
      There's the file time problem, though. Okay, let's say you're Joe Randomguy and you keep two XP partitions. One that you actively use and might have all manner of contraband on it, and another "boring" one for showing any would-be snoopers. It's Jan 2012. What do you think is going to happen when they see that the one you gave up the code to hasn't been touched since July 2011? Does Truecrypt have an option to not record date/time stamps on volumes, or better yet, scramble them?
      - burgerbrain 15y ago
        Standard practice is to use the one you don't care about for things you don't care about (which for most people, will be most things. Web browsing, gaming, emailing the aunt, whatever). Timestamps are going to be at the FS layer or higher, not much Truecrypt can realistically do about that..
- shasta 15y ago
  ...unless Chris Norstrom is your real name and they know how to use a search engine to find this post.
  - ChrisNorstrom 15y ago
    Remember, who we're talking about here. They're not exactly CSI agents. If someone really wants to smuggle data or keep it secret they WILL find a way. They could just cram it all on a MicroSD and put it under their tongue, or between their butt crack, super glued behind their scrotum, lodged up into their vagina, buried in their rectum, etc.... The methods are endless. This won't catch terrorists or pedophiles, it'll just catch innocent people like your mom who have some illegally downloaded songs on their laptop.
    - weekendlogic 15y ago
      Or simply use the internet. This is digital data we are talking about, there are much more effective means of moving it about.
- patrickgzill 15y ago
  You could even get a MicroSD card, stick it in your phone, and carry it across that way.
  - tomflack 15y ago
    Stick it in your phone? Your phone is still liable for a search. Get a MicroSD card and stick it in an orifice.
- andylei 15y ago
  > The problem here is what are they going to find that ISN'T Illegal? This isn't really a problem. Cops can get a warrant to search your house, and I'm pretty sure they'll find some things that aren't illegal, but are very personal. If you restrict evidence finding procedure to those in which only evidence (and nothing else) can be found, then I'm pretty sure you'll end up with no evidence.
  - andylei 15y ago
    do people here honestly believe that its not okay for cops with warrants to search someone's encrypted hard drive because they might find something that's not illegal?
    - WalterBright 15y ago
      Many people have secrets that, if disclosed, could ruin their lives even though they are not illegal. For example, a politician with politically unacceptable activities. I'm sure you can come up with examples, such are regularly reported on the news.
      - tedunangst 15y ago
        How is that different from finding naughty stuff in the closet while searching for the murder weapon?
    - burgerbrain 15y ago
      It is never okay for my privacy to be compromised. I don't care if they have a piece of paper that says that I'm not supposed to care. This has nothing to do with things that may or may not be "illegal".
      - tedunangst 15y ago
        How do you propose police execute a search warrant in someone's house? Or should the police never be allowed in your house under any circumstance?
- bpd1069 15y ago
  http://16s.us/TCHunt/index.php http://16s.us/TCHunt/index.php Finds hidden TrueCrypt volumes... :(
  - Simucal 15y ago
    No, it doesn't. This finds files suspected to be TrueCrypt volumes and it does so by looking for certain heuristics. If your file passes a chi-square distribution test it is likely to be a TrueCrypt volume. If I create a file with a bunch of random data TCHunt would also likely peg it as a potential TC volume. However, it does not detect the existence of a hidden inner volume.
- Simucal 15y ago
  I'm curious what the courts would say when told that it is possible to have a hidden inner volume that is impossible to detect and when I hand over my key it may just be the outer containers, not the hidden inner container that I have unlocked.
  - felipemnoa 15y ago
    That is like saying that you are guilty but there is no way to prove it.
    - Simucal 15y ago
      I agree. However, having the capability to have an undetectable hidden innner volume feels like it makes a lot of this moot. That is, as long as the inner volumes remain truly undetectable.
  - ChrisNorstrom 15y ago
    The best way to hide something is with misdirection and dead ends. It's by letting someone win a little but not all the way. If you're a straight male just make a second inner hidden volume and put a ton of gay porn on it. After a few days of arguing with the court just reveal your password to it and they'll think "oh shit, this is what he was hiding. Well nothing to see here, moving on. That's all."
    - Jach 15y ago
      This is the best comment really... I brought up Truecrypt's Hidden OS feature a while ago (here: http://news.ycombinator.com/item?id=3415658 http://news.ycombinator.com/item?id=3415658 ) and apparently in the UK you have to somehow prove the non-existence of such a thing. If you can't get them to leave you alone through such above trickery it becomes a fairly simple calculated choice deciding whether obstruction of justice is a less harmful penalty than what they want to find and charge you for after decryption.
    - cmundhe 15y ago
      genius.
- sukuriant 15y ago
  > Everyone has cracked software, pirated movies, & torrents. I make it a point to not have pirated movies. I torrent linux distributions and free music (OC Remix); and I buy my software or use free alternatives. It may be true that most people have cracked software, pirated movies and [illegal] torrents, but it's not everyone.
  - jwhitlark 15y ago
    I don't even think most people have those things. Many, sure, but while I am on your end of the spectrum (free software, etc.), many people don't care, or can't be bothered to get those thing, morals aside.
- techiferous 15y ago
  > Everyone has cracked software, pirated movies, & torrents. I don't have any of these. I'm not being contrary, just saying you should update your view that everyone has these things.
  - batista 15y ago
    "Everyone", in common language, is not equivalent to the mathematical "all elements in the set". It just means "almost everybody, excluding very few people that might as well be statistical error". Actually, even 95% of the people qualifies as "everyone" for all practical purposes. You might want to take a look at this: http://tirania.org/blog/archive/2011/Feb-17.html http://tirania.org/blog/archive/2011/Feb-17.html
    - deleted 15y ago
      [deleted]
  - EwanG 15y ago
    Are you SURE you don't have any of these? That's one of the interesting things I've learned over the years. You may THINK you don't have any, or that you have never gone out of your way to get such. But that presumes that when you visited YouTube that the unlicensed excerpt you watched wasn't cached on your computer, and won't be found and used as evidence against you. That a friend or family member never borrowed your computer for a couple minutes to check email and left a copy of an attachment they shouldn't have had. And so on... Oh, and you think folks who have no problem casually planting a bag of something in your car would have a problem dropping some files on your computer if they think that would help? I'm not being contrary either, but to claim that you have nothing to hide could be seen as perjury for someone who wants to make sure they get you of something. And in this day and age I suspect the odds that you have something is higher than you may believe.
    - deleted 15y ago
      [deleted]
- viveksec 15y ago
  This sounds airtight. The analogy with the physical safe is completely destroyed by True Crypt's hidden partitions. Any lawyers want to comment on this ?
  - arantius 15y ago
    > This sounds airtight. The analogy with the physical safe is completely destroyed by True Crypt's hidden partitions. Because it's impossible for a safe to have an extra hidden compartment?
grecy 15y ago
>Dubois said that, in addition, his client may not be able to decrypt the laptop for any number of reasons. "If that's the case, then we'll report that fact to the court, and the law is fairly clear that people cannot be punished for failure to do things they are unable to do," he said. So can everyone just claim they can't decrypt their drive because of <sort-of-plausible-excuse-here> ?
- cdr 15y ago
  It would depend on how plausible what you say is - ie, whether a judge believes you.
- ______ 15y ago
  Yeah, does forgetting a password constitute one of these reasons? It's perfectly plausible if the laptop has been sitting in an evidence locker for a while. People forget passwords all the time.
- learc83 15y ago
  Happens all the time in child support cases. Dad won't pay because he says he doesn't have the money (or can't find a job), judge doesn't believe him and throws him in jail for contempt. There's a huge lawsuit in Georgia arguing that this essentially creates a debtors prison.
Karunamon 15y ago
This is an interesting case. From a civil liberties, card-carrying ACLU member standpoint, I'm all for the "anti" side of this - keep the gov't out. On the other hand, there's a decent case made that establishing this kind of precedent would basically mean that if criminals are smart enough to use PGP, then that data can never be used against them. Since you can be compelled to turn over a physical key via due process, why can you not also be compelled to turn over a digital one? Most of the privacy arguments vanish as well since they don't want the password (which could give them access to other things they're not supposed to have), but they just want the data. I'll be watching this one closely.
- shasta 15y ago
  Yes, it's very reasonable. The main problem with the decision is just that it magnifies the other inequities of legal system.
- marshray 15y ago
  why can you not also be compelled to turn over a digital one? Because you may have forgotten it. It's likely you would not have had access to the hardware in the many months these things drag out. I know I've forgotten some complex passwords in a day or two. Also, there may be an argument to be made that by demonstrating your knowledge of the password you are being forced to confess to ownership of whatever content is unlocked. Although the lock-and-key metaphor seems very attractive, it not necessarily the case that "decryption" equals "authentication". Encryption is easy, authentication is the harder problem! There have been encryption products sold and used that did not provide effective authentication, i.e., someone who didn't know the key could tamper with the contents of the disk so that it decrypted to something else.
- icebraining 15y ago
  On the other hand, there's a decent case made that establishing this kind of precedent would basically mean that if criminals are smart enough to use PGP, then that data can never be used against them. So now smart criminals will move to Truecrypt hidden volumes and claim there isn't any hidden volume. So now what do you do? Jail someone who might be telling the truth, or let him go? This doesn't solve anything. Encryption is way past it.
jwhitlark 15y ago
It's an interesting situation: What you say to your doctor, lawyer, or spouse is protected, but what you say to yourself, is not.
- deleted 15y ago
  [deleted]
- rsl7 15y ago
  So tell your lawyer your passphrase.
mcritz 15y ago
“I’m sorry, Your Honor. I have forgotten my password.” If it’s good enough for Bob McFarlane and Alberto Gonzales, it’s good enough for regular Americans, too!
Steko 15y ago
related: http://news.ycombinator.com/item?id=2693599 http://news.ycombinator.com/item?id=2693599 'TrueCrypt User Held in Contempt of Court (truecrypt.org) "
stretchwithme 15y ago
I wonder by what means they will make their hands type. Can they be taser-ed into submission, like the guy who couldn't stand up in the college library?
- marshray 15y ago
  Yes, contempt-of-court in the US can mean being held in an abusive jail.
thekevan 15y ago
I hate that I think I agree with the ruling. If the authorities had a warrant to someone's house and barricade themselves in so there could be no entry, we'd hardly give it a second thought that they were violating the warrant. Refusing to give up a password to an encrypted drive is effectively barricading your content. I guess my issue is what they describe as probable cause for issuing the warrant in the first place.
waiwai933 15y ago
If I encrypt a letter by hand using, say, Caesar's cipher (despite how weak it is), could a court compel me (i.e. is there common law precedent in the US or elsewhere) to decrypt said letter? Surely there must be some precedent before we had computers and whatnot, right? This, after all, seems to be the closest-fitting analogy I can think of—both the "key to lock" and "privacy of mind" arguments seem to be stretching it. Unless the reason they're using these analogies is that no one has ever brought a non-digital encryption case before a court, which would make sense as to why they're not consulting that precedent, but surely 230 years of US law and several times that of British law would bring up something...
- learc83 15y ago
  There is precedent that a court can't compel you give up the combination to a combination lock, because it would be considered testimony. Seems to me that this falls under that precedent.
  - philfreo 15y ago
    Source?
    - jpol 15y ago
      U.S. v. Hubbell, citing U.S. v. Doe. For these reasons, we cannot accept the Government's submission that respondent's immunity did not preclude its derivative use of the produced documents because its "possession of the documents [was] the fruit only of a simple physical act-the act of producing the documents." Id., at 29. It was unquestionably necessary for respondent to make extensive use of "the contents of his own mind" in identifying the hundreds of documents responsive to the requests in the subpoena. See Curcio v. United States, 354 U. S. 118, 128 (1957); Doe v. United States, 487 U. S., at 210. The assembly of those documents was like telling an inquisitor the COMBINATION TO A WALL SAFE, not like being forced to surrender the key to a strongbox. Id., at 210, n. 9. http://supreme.justia.com/cases/federal/us/530/27/case.html http://supreme.justia.com/cases/federal/us/530/27/case.html
    - 15y ago
losethos 15y ago
compression, not encryptian. http://www.losethos.com/LTHtml/OSMain/Compress.html http://www.losethos.com/LTHtml/OSMain/Compress.html I will interpret God for a fee -- pain in the ass. God says... sloth oh_oh fight rubbish do_you_like_it charged air_head hello what_a_mess my_bad bickering lifes_like_chocolates jealousy chump_change middle_class I_donno off_the_record in_a_perfect_world tattle_tale bank hate Zzzzzzzz quite hippy climate busybody
cschep 15y ago
Obligatory XKCD: http://xkcd.com/538/ http://xkcd.com/538/ Seriously though, why does the government think they can win at this stuff? Without hitting the guy with a wrench that is.
cynwoody 15y ago
What if she can't remember the pass phrase? Of course, she could be lying, but how could they prove that?
- mc32 15y ago
  In India they do it with technology. Far form proven but they might get better at this. A case. http://www.technovelgy.com/ct/Science-Fiction-News.asp?NewsNum=1876 http://www.technovelgy.com/ct/Science-Fiction-News.asp?NewsN... The tech. http://www.forensic-centre.com/assessments/brainwave-profiling http://www.forensic-centre.com/assessments/brainwave-profili...
- shmerl 15y ago
  They can apply various methods, such as polygraph to determine whether she really forgot the key, and it won't be so easy for her to avoid revealing the real fact.
  - desas 15y ago
    Polygraphs are considered reliable? In the UK they are inadmissible in court.
meatmanek 15y ago
A stupid idea: what if we passed a law making, say, knowing an encryption key illegal, with a $0.01 penalty per year? Then asking you for your encryption key would be asking you to provide self-incriminating testimony.
- chimeracoder 15y ago
  You don't need to do that - there's a decent argument to be made that forcing you to decrypt a drive is already forcing you to testify against yourself, in violation of the 5th Amendment.
  - techtalsky 15y ago
    Right, and that's what the article says a judge decided is NOT the case.
    - Nick_C 15y ago
      No he hasn't. Pls read the article. They are requiring her to provide the documents.
- bdonlan 15y ago
  If you're able to pass silly laws, wouldn't it be easier to just pass a law saying discovery can't compel people to divulge encryption keys kept only within their own head?
eck 15y ago
Isn't this one of the things TPMs are designed to defend you against? The TPM only releases the encryption key after the right password is entered, some number of wrong passwords cause a reset, and perhaps a single duress code instantly causes a reset? Once the TPM is erased, who's to tell if it wasn't just broken to begin with.
- gte910h 15y ago
  You mirror drives as part of evidence collection
  - yew 15y ago
    . . . which is subsequently rendered useless by the TPM erasing itself. (The standard procedure is to encrypt the drive using a key stored in the TPM. The TPM then decrypts the drive when provided with the proper authentication. If the designated security policy is violated the TPM destroys the key, rendering the drive's contents useless.)
    - gte910h 15y ago
      They're mirroring the drive. Why wouldn't they mirror the TPM too? Or are you contending they're tamperproof?
      - yew 15y ago
        They are intended to be tamperproof, yes. Mirroring the contents of a TPM is an exercise in hardware deconstruction where you also have to worry about setting of auto-erase traps. It's not impossible by any means, but it's not standard procedure and there's no guarantee it will actually work.
      - yew 15y ago
        They are intended to be tamperproof, yes. Mirroring the contents of a TPM is an exercise in hardware deconstruction where you also have to worry about setting off auto-erase traps. It's not impossible by any means, but it's not standard procedure and there's no guarantee it will actually work.
rhaphazard 15y ago
A bit torn on the issue and don't have a strong opinion either way. I slightly lean towards they shouldn't have to hand over the password, but I really thing courts should try to be flexible (is that even possible?) and go case by case. Will be looking towards hearing more opinion on the issue.
kogir 15y ago
This should be cause for serious concern. There's often no way to prove that someone knows a key or pass-phrase. If a personal computer I've used for years has TrueCrypt at boot, perhaps a reasonable argument[1] could be made that I know the password. That's not true of a flash drive or an encrypted file on a shared computer. If someone plants a safe in my house, I may be held in contempt for a while while it's drilled open. Properly encrypted data might withstand attacks for a lifetime or more. [1] Best I can tell, it's possible for me to TrueCrypt encrypt your computer with only physical access. You wouldn't notice until next boot.
- aaronblohowiak 15y ago
  >This should be cause for serious concern. Just like using an IP address as identification of a person.
duncan_bayne 15y ago
Personally I think this is reasonable, provided that requests for decryption keys are handled with the same level of respect for law & privacy afforded to physical keys. There is a thornier issue though: stenanography + encryption. What if the encrypted data aren't visible in the first place? Or, what if the data aren't provably encrypted data? I can imagine a case where someone languishes in jail for contempt of court, after being ordered to produce something that doesn't actually exist.
scottdw2 15y ago
You can be compelled to produce a physical key to a safe. However what if the contents of the safe are paper with text written in an invented language, known only to you? Can you be compelled to translate them for the court? What if they just contained numbers? Could you be forced to explain what the numbers mean? I would conclude that such an action would violate the 5th ammendment. Forcing her to decrypt the hard drive is the same thing. Given a warrant, the police have the right to search her hard drive. If they can't understand what it says, she should not have to explain it to them. Right now, they have no evidence. She is being compelled to produce evidence against her self. Providing a physical key produces no evidence. It produces a key. Providing a decrypted version of the data on the laptop is producing information. The contents of the laptop are such that they exhibit a high level of entropy. By definition, they are not information. If they did contain information, they would by definition not be encrypted. Thus, the request is for the defendant in a criminal trial to replace something that is not information with something that is information. That is clearly a violation of the 5th ammendment.
- deleted 15y ago
  [deleted]
  - deleted 15y ago
    [deleted]
- pi18n 15y ago
  I agree and so do past rulings. This judge needs brush up on US law.
  - rorrr 15y ago
    There were all kinds of rulings, and it has never reached the Supreme Court. So until then, a judge can lock you up indefinitely, until you produce the password.
- tedunangst 15y ago
  The contents of the laptop are such that they exhibit a high level of entropy. By definition, they are not information. uh, the bits of a compressed file also exhibit a high level of entropy. Are compressed files not information either?
nirvana 15y ago
I wonder about this: What if the key to the encryption is written on a dozen seemingly random notes on yellow sticky notes in your office full of yellow sticky notes? Or, it is composed of the last letter on each page of a series of innocuous looking documents, such that the government might seize the documents but naturally in the process of doing so, scramble the documents order rendering the password irretrievable. Or its some combination of words from a book, or some other innocuous piece of material that they'd simply ignore and that would be thrown out after they left. The one FBI raid I'm directly familiar with involved them seizing the computers and even the phones, but not the desks or the phone books, etc. In this case the passphrase existed in the location where the laptop was seized but in the intervening months, or in the act of seizing it, the phrase was destroyed. Thus it is the responsibility of the cops who seized it that the passphrase is no longer retrievable, and thus it is the government's fault the data is impossible to decrypt. I'm sure there's an even better way to accomplish something similar that I'm not thinking of, where the phrase is kept handy, but only obvious to you so that you know how to derive it, but the simple act of serving a search warrant will eliminate the phrase by rearranging the key elements. Then in court you can testify honestly to exactly how you looked up the phrase, but the government would have no way to recreate it.
- IgorPartola 15y ago
  Sure. You could do even better: keep your computer on at all times and keep everything you do in RAM. No encryption is necessary here, just a $100 UPS and your laptop's own battery. The problem with all these comments about "what if I give half of my phrase to a friend?" or "what if I write it in the dust at the entrance to my house and the FBI wipes it away when they bust in?" is that it doesn't really address the core issue. There is no technological solution to this situation: 1. The gov't can just give up on the idea of looking at encrypted drives. Not likely and possibly bad for society as a whole. I am not able to judge that. 2. The judge can just refuse to understand that there is no way to decrypt the drive and hold you in contempt of the court indefinitely at which point you'll be cursing yourself for not burying the passphrase chiseled into a stone in your back yard. 3. The gov't makes it illegal to encrypt drives without giving them the keys. At best this is done through some kind of third-party escrow service so that an actual warrant needs to be given before the key is given out. At worst, you just drop off your encryption keys with the nearest post office. 4. There is no #4. The judicial system won't just go "well, this guy has an encrypted drive and we can't get in. Let's just let him go since he clearly outsmarted us." They either will find something else on you, or compel you to decrypt the drive. Like I said, there is no technical solution, only social/behavioral. Encryption became too sophisticated and there isn't much that we can do nowadays.
jdietrich 15y ago
For anyone wondering what this might look like in practice, look up the Regulation of Investigatory Powers Act. There have been a number of prosecutions in the UK for failing to provide encryption keys, many of them resulting in imprisonment. Notably, the first prosecution was of a paranoid schizophrenic man, who was moved to a secure psychiatric hospital during his prison sentence. We have not yet had a test case regarding deniable encryption, but I imagine it will be only a matter of time.
jrockway 15y ago
"I forgot the key." Done. (Presumably serving an 18 month contempt sentence in a county jail is better than the 25-to-life in a maximum security federal prison you'd get if they saw the contents of your hard drive.)
- ComputerGuru 15y ago
  If I'm not mistaken, there's no limit on contempt of court. A... stubborn judge could keep you detained until you're no longer in contempt.
  - jpol 15y ago
    Imprisonment for civil contempt can be of unlimited duration, but the purpose of it is to force you to give up the information. Once you have been in jail long enough for the judge to realize that imprisoning you won't change your mind, you will be released. That could be a very long time.
  - learc83 15y ago
    Longest jail term for contempt was 14 years for a man who said he lost $2.75 million, and therefore couldn't give anything to his wife. http://abcnews.go.com/2020/story?id=8101209&page=1#.Tx4s32NWrM4 http://abcnews.go.com/2020/story?id=8101209&page=1#.Tx4s...
  - jrockway 15y ago
    I've read that it's tied to a particular grand jury session, which is something like 18 months. Either way, the longest contempt sentence ever was 14 years, which is nothing compared to what you'll get if the government convicts you of laundering money, selling drugs, possessing child porn, or all the other crimes that you might have documented on your computer.
    - 3143 15y ago
      Why would you want that person to be able to avoid going to jail just because he was smart enough to use encryption?
ThePinion 15y ago
This is a serious question that I hope gets answered: Is it possible to tell Linux (or Windows I guess) to immediately crash if you boot it up and are either 1) not connected to the internet or 2) not connected from a certain IP address. Then you could give up the key, but tell them "see, it's broken and I haven't been able to use it anyway."
ryanwaggoner 15y ago
What if you made your passphrase itself a confession to a crime? "I shot the sheriff." Then you could claim that supplying your password would constitute self-incrimination, and so you'd like to invoke your 5th Amendment rights :)
- ComputerGuru 15y ago
  It's not testimony. Even confessions can't be used against you if not given in the form of a testimony.
  - ryanwaggoner 15y ago
    Source? Not trying to be snarky, just would like more details. What counts as testimony?
- geoffschmidt 15y ago
  Ceci n'est pas une pipe. Reasonable people are sophisticated enough to understand that there is a difference between using a sentence as a password, and believing that sentence to be true. On a related note, I once looked into changing my middle name to an executable implementation of RSA, so that my passport would be a non-exportable munition. (No go.)
  - lawnchair_larry 15y ago
    What was their reason for declining the name change?
    - bdonlan 15y ago
      I would guess that it would be too long if written out in English, and that they'd probably deny a name change to a name that contains characters not normally used in names (asterisks, semicolons, underscores...)
- noblethrasher 15y ago
  http://en.wikipedia.org/wiki/Use%E2%80%93mention_distinction http://en.wikipedia.org/wiki/Use%E2%80%93mention_distinction
Cushman 15y ago
Okay, American hackers, here's your civil disobedience: Go to a foreign country. Buy a flash drive. Set up two partitions; make one a small TrueCrypt bootstrap partition, configured to decrypt the second with a password. Random-wipe the second. (For insurance, you may wish to do this provably. Maybe use a publicly-accessible source of random data?) Travel back across the border. When you are asked to decrypt your drive, inform the authority that you are unable to do so, since no password exists, and the data is utterly meaningless. They will probably want you to provide some evidence of this. Refuse; insist that you cannot be required to prove that you have not done something wrong. If all goes well, they'll arrest you for something. Then, call a lawyer.
geoffschmidt 15y ago
Let's look a little bit further down the road, say 100 or 200 years. If the computer is implanted in my head, can you compel me to give you the data in it? What if the computer is made partly of cells? Just how tightly integrated do I have to be with the storage device before it's part of the private, protected sphere of my personal consciousness? I don't mean to be frivolous. As we become ever more dependent on cloud storage and mobile devices as extensions of our memories and our capabilities, we're eventually going to have revisit the legal boundaries of our personhood. My communications with my attorney are subject to attorney-client privilege. It's almost like the attorney is considered to be a subprocess of me when he is thinking about my problems. We correctly see it as being in the public interest to allow me to communicate with my attorney without hindrance. Why shouldn't my communications with myself be given the same privilege?
- ww520 15y ago
  Well, governments can compel to collect DNA sampling from you now. Why not go further and compel to read your implanted chip? They can collect your recorded GPS location as evidence.
- hobin 15y ago
  I am inclined to think that this is one of those cases where people feel uncomfortable for some time. ...and then they get used to it.
RexRollman 15y ago
"He said the All Writs Act, which dates back to 1789 and has been used to require telephone companies to aid in surveillance, could be invoked in forcing decryption of hard drives as well." I respectfully disagree, even if his opinion is correct under the law. A defendant should never, ever, be forced to assist in his own prosecution, and being forced to decrypt the drive would be doing exactly that.
feralchimp 15y ago
I'm a government-should-leave-reasonable-people-the-hell-alone libertarian and a crypto-is-the-shit kind of guy. I also think warrants for searches of encrypted media are totally legit, and think the hair splitting over "typing in the password without anyone seeing it" vs. "being compelled to dictate the password" is completely pointless. 1. Not every vocal Utterance qualifies as Testimony, and the only person who gets to self-identify with an encryption key is Whitfield Diffie, and that rule only applies after 3 bong hits -OR- when he's doing Salvia with Ron Rivest as his sitter. Your weasel card-skimming ass ain't no Whitfield Diffie. 2. If you leak enough inculpatory evidence outside your encrypted hard drive, such that the police are now holding a warrant for searching inside your encrypted hard drive, the jig is up, son! Shouldn't have leaked all that other guilt-stench, and should have plausibly-deniably deleted that evidence.
- ataggart 15y ago
  Individuals should not be compelled to actively participate in their own prosecution. This is the spirit of the 5th Amendment.
  - feralchimp 15y ago
    I appreciate that the adversarial method of trial has given rise to that and other threads of argument on behalf of defendants; I'm just not buying it in this case. It's an absurdly low bar for "active participation." He's not being asked to compute the AES decryption on 3x5 cards, or help the prosecution find the spot where the laptop is buried in the woods. When you're caught, you're forced to empty your pockets. If your 'pockets' include 1TB of incriminating data, that's your bad. Is one also actively participating in his own prosecution when he fails to resist arrest? How about when he agrees not to leave the country as a condition for posting bail? After all, he's had that vacation to [insert non-extradition country here] for months! Why should he change his plans to benefit the prosecution?
hippich 15y ago
Once again - either providing password, or entering it without revealing password itself is a self-incrimination simply because this way you prove you are owner of this information. Why this is important? It might be not yours information but you might know password. And this will make you incriminating yourself. And most important, no matter what, right to not incriminate yourself should be remain untouched. Otherwise, nothing protects people from its government.
trotsky 15y ago
Perhaps I don't understand some dynamic here, but what prevents someone from just stating that they no longer know the pass phrase? I thought that was more or less a free pass, as no one can prove what you do or don't remember. Hence why the phrase "I'm sorry, I don't recall that senator" is used so often when everyone knows they're lying.
Derbasti 15y ago
Yet another freedom lost in the land of the free: You are not allowed to have secrets any more.
pimeys 15y ago
I used to think of moving to USA. I'm a pretty good programmer and it would've been nice to work in an American startup. When reading these news, about SOPA/PIPA, about the crazy amount of spying and control in the airports, about forcing to decrypt my laptop, I don't want to go there even for a holiday anymore. I'm happy here in Berlin and even though the salaries are half what I would get from Silicon Valley, the cost of living is also much lower. And I'm not alone.
scelerat 15y ago
Does the defendant's fate hinge on the contents of this laptop? It seems not: the article mentions other evidence against her. If a case hinges entirely on the contents of an encrypted laptop, perhaps it's not the strongest of cases... which is kind of the point of the fourth and fifth amendments: keeping the government honest, so to speak.

175 points by llambda 15y ago

deleted 15y ago

[deleted]

The problem here is what are they going to find that ISN'T Illegal? Everyone has cracked software, pirated movies, & torrents. Then there's content that isn't illegal but very personal: chat logs, email archives, contact lists, usernames & passwords, FTP info, master passwords to everything, OH and my entire life's worth of inventions and ideas. I'm not saying they'd steal them but remember, we're talking about the American Government here. The same one that can't account for billions of dollars in missing money. Lost 6.6 Billion in Iraq and doesn't know what happened to it. And doesn't know how or why a warehouse full of missiles in the middle east is empty. If that's how they treat their money and weapons, I wonder how they're going to treat my life's work. So... Just use TrueCrypt to create a hidden volume on a flash drive or SD card, keep everything else un-encrypted. They won't even know it's there. I've got a 32 GB SD card just for this purpose, it's got all my project files on it, thunderbird portable, my entire collection of inventions and business ideas, my life's work basically. If anyone were to plug that card in, it would just read "card has not been formatted yet". I've got a backup of it as well. If you have a hard drive full of torrented content or DVD rips that look like torrented content just make 2 TrueCrypt volumes, one that is visible (put some porn on it to simulate a "this is all I have hidden" excuse) and the other volume hidden (with all of your pirated content). They literally won't ever know it was there.

gcr 15y ago
The fact that you have truecrypt installed on your start menu is a dead giveaway.
- vessenes 15y ago
  No, he has a plausible deniability plan.
- gte910h 15y ago
  Truecrypt is also excellent full disk encryption in case your computer is stolen
- korny 15y ago
  I use truecrypt to encrypt lots of legitimate stuff. All my financial data is on a truecrypt volume on DropBox. And I suspect that folks with something to hide wouldn't find it hard to hide trucrypt itself.
  - jiggy2011 15y ago
    where you going to hide it? In another truecrypt volume? It would be easier just to only use it via a VM booted from a Linux Live CD.
Karunamon 15y ago
>Everyone has cracked software, pirated movies, & torrents That's a bit of a leap, really. Also, Truecrypt's deniable encryption here doesn't seem like it would help, since they're talking at the computer level. Presumably, a power on or hard drive password. Assuming there's only one volume, you put that one in and the attacker has the keys to the kingdom. Besides that, most averages joes wouldn't go through this kind of trouble. If you're running in opposition to a ruling power who might, say, launch a missile at you from 30,000 feet while you're in foreign territory (not naming any names here), then you probably already know to cover your ass. On the other hand, an average joe thinking that they're cute by giving up the password to the concealed volume will only land a contempt charge when the file access times are checked.
- Simucal 15y ago
  TrueCrypt supports Hidden OS partitions much like its normal hidden containers and it asks for these passwords at boot. You could enter one password and have it boot into a boring Windows XP environment while the true password would boot to your actual environment with all your secret files.
  - Karunamon 15y ago
    There's the file time problem, though. Okay, let's say you're Joe Randomguy and you keep two XP partitions. One that you actively use and might have all manner of contraband on it, and another "boring" one for showing any would-be snoopers. It's Jan 2012. What do you think is going to happen when they see that the one you gave up the code to hasn't been touched since July 2011? Does Truecrypt have an option to not record date/time stamps on volumes, or better yet, scramble them?
    - burgerbrain 15y ago
      Standard practice is to use the one you don't care about for things you don't care about (which for most people, will be most things. Web browsing, gaming, emailing the aunt, whatever). Timestamps are going to be at the FS layer or higher, not much Truecrypt can realistically do about that..
shasta 15y ago
...unless Chris Norstrom is your real name and they know how to use a search engine to find this post.
- ChrisNorstrom 15y ago
  Remember, who we're talking about here. They're not exactly CSI agents. If someone really wants to smuggle data or keep it secret they WILL find a way. They could just cram it all on a MicroSD and put it under their tongue, or between their butt crack, super glued behind their scrotum, lodged up into their vagina, buried in their rectum, etc.... The methods are endless. This won't catch terrorists or pedophiles, it'll just catch innocent people like your mom who have some illegally downloaded songs on their laptop.
  - weekendlogic 15y ago
    Or simply use the internet. This is digital data we are talking about, there are much more effective means of moving it about.
patrickgzill 15y ago
You could even get a MicroSD card, stick it in your phone, and carry it across that way.
- tomflack 15y ago
  Stick it in your phone? Your phone is still liable for a search. Get a MicroSD card and stick it in an orifice.
andylei 15y ago
> The problem here is what are they going to find that ISN'T Illegal? This isn't really a problem. Cops can get a warrant to search your house, and I'm pretty sure they'll find some things that aren't illegal, but are very personal. If you restrict evidence finding procedure to those in which only evidence (and nothing else) can be found, then I'm pretty sure you'll end up with no evidence.
- andylei 15y ago
  do people here honestly believe that its not okay for cops with warrants to search someone's encrypted hard drive because they might find something that's not illegal?
  - WalterBright 15y ago
    Many people have secrets that, if disclosed, could ruin their lives even though they are not illegal. For example, a politician with politically unacceptable activities. I'm sure you can come up with examples, such are regularly reported on the news.
    - tedunangst 15y ago
      How is that different from finding naughty stuff in the closet while searching for the murder weapon?
  - burgerbrain 15y ago
    It is never okay for my privacy to be compromised. I don't care if they have a piece of paper that says that I'm not supposed to care. This has nothing to do with things that may or may not be "illegal".
    - tedunangst 15y ago
      How do you propose police execute a search warrant in someone's house? Or should the police never be allowed in your house under any circumstance?
bpd1069 15y ago
http://16s.us/TCHunt/index.php http://16s.us/TCHunt/index.php Finds hidden TrueCrypt volumes... :(
- Simucal 15y ago
  No, it doesn't. This finds files suspected to be TrueCrypt volumes and it does so by looking for certain heuristics. If your file passes a chi-square distribution test it is likely to be a TrueCrypt volume. If I create a file with a bunch of random data TCHunt would also likely peg it as a potential TC volume. However, it does not detect the existence of a hidden inner volume.
Simucal 15y ago
I'm curious what the courts would say when told that it is possible to have a hidden inner volume that is impossible to detect and when I hand over my key it may just be the outer containers, not the hidden inner container that I have unlocked.
- felipemnoa 15y ago
  That is like saying that you are guilty but there is no way to prove it.
  - Simucal 15y ago
    I agree. However, having the capability to have an undetectable hidden innner volume feels like it makes a lot of this moot. That is, as long as the inner volumes remain truly undetectable.
- ChrisNorstrom 15y ago
  The best way to hide something is with misdirection and dead ends. It's by letting someone win a little but not all the way. If you're a straight male just make a second inner hidden volume and put a ton of gay porn on it. After a few days of arguing with the court just reveal your password to it and they'll think "oh shit, this is what he was hiding. Well nothing to see here, moving on. That's all."
  - Jach 15y ago
    This is the best comment really... I brought up Truecrypt's Hidden OS feature a while ago (here: http://news.ycombinator.com/item?id=3415658 http://news.ycombinator.com/item?id=3415658 ) and apparently in the UK you have to somehow prove the non-existence of such a thing. If you can't get them to leave you alone through such above trickery it becomes a fairly simple calculated choice deciding whether obstruction of justice is a less harmful penalty than what they want to find and charge you for after decryption.
  - cmundhe 15y ago
    genius.
sukuriant 15y ago
> Everyone has cracked software, pirated movies, & torrents. I make it a point to not have pirated movies. I torrent linux distributions and free music (OC Remix); and I buy my software or use free alternatives. It may be true that most people have cracked software, pirated movies and [illegal] torrents, but it's not everyone.
- jwhitlark 15y ago
  I don't even think most people have those things. Many, sure, but while I am on your end of the spectrum (free software, etc.), many people don't care, or can't be bothered to get those thing, morals aside.
techiferous 15y ago
> Everyone has cracked software, pirated movies, & torrents. I don't have any of these. I'm not being contrary, just saying you should update your view that everyone has these things.
- batista 15y ago
  "Everyone", in common language, is not equivalent to the mathematical "all elements in the set". It just means "almost everybody, excluding very few people that might as well be statistical error". Actually, even 95% of the people qualifies as "everyone" for all practical purposes. You might want to take a look at this: http://tirania.org/blog/archive/2011/Feb-17.html http://tirania.org/blog/archive/2011/Feb-17.html
  - deleted 15y ago
    [deleted]
- EwanG 15y ago
  Are you SURE you don't have any of these? That's one of the interesting things I've learned over the years. You may THINK you don't have any, or that you have never gone out of your way to get such. But that presumes that when you visited YouTube that the unlicensed excerpt you watched wasn't cached on your computer, and won't be found and used as evidence against you. That a friend or family member never borrowed your computer for a couple minutes to check email and left a copy of an attachment they shouldn't have had. And so on... Oh, and you think folks who have no problem casually planting a bag of something in your car would have a problem dropping some files on your computer if they think that would help? I'm not being contrary either, but to claim that you have nothing to hide could be seen as perjury for someone who wants to make sure they get you of something. And in this day and age I suspect the odds that you have something is higher than you may believe.
  - deleted 15y ago
    [deleted]
viveksec 15y ago
This sounds airtight. The analogy with the physical safe is completely destroyed by True Crypt's hidden partitions. Any lawyers want to comment on this ?
- arantius 15y ago
  > This sounds airtight. The analogy with the physical safe is completely destroyed by True Crypt's hidden partitions. Because it's impossible for a safe to have an extra hidden compartment?

grecy 15y ago

>Dubois said that, in addition, his client may not be able to decrypt the laptop for any number of reasons. "If that's the case, then we'll report that fact to the court, and the law is fairly clear that people cannot be punished for failure to do things they are unable to do," he said. So can everyone just claim they can't decrypt their drive because of <sort-of-plausible-excuse-here> ?

cdr 15y ago
It would depend on how plausible what you say is - ie, whether a judge believes you.
______ 15y ago
Yeah, does forgetting a password constitute one of these reasons? It's perfectly plausible if the laptop has been sitting in an evidence locker for a while. People forget passwords all the time.
learc83 15y ago
Happens all the time in child support cases. Dad won't pay because he says he doesn't have the money (or can't find a job), judge doesn't believe him and throws him in jail for contempt. There's a huge lawsuit in Georgia arguing that this essentially creates a debtors prison.

Karunamon 15y ago

This is an interesting case. From a civil liberties, card-carrying ACLU member standpoint, I'm all for the "anti" side of this - keep the gov't out. On the other hand, there's a decent case made that establishing this kind of precedent would basically mean that if criminals are smart enough to use PGP, then that data can never be used against them. Since you can be compelled to turn over a physical key via due process, why can you not also be compelled to turn over a digital one? Most of the privacy arguments vanish as well since they don't want the password (which could give them access to other things they're not supposed to have), but they just want the data. I'll be watching this one closely.

shasta 15y ago
Yes, it's very reasonable. The main problem with the decision is just that it magnifies the other inequities of legal system.
marshray 15y ago
why can you not also be compelled to turn over a digital one? Because you may have forgotten it. It's likely you would not have had access to the hardware in the many months these things drag out. I know I've forgotten some complex passwords in a day or two. Also, there may be an argument to be made that by demonstrating your knowledge of the password you are being forced to confess to ownership of whatever content is unlocked. Although the lock-and-key metaphor seems very attractive, it not necessarily the case that "decryption" equals "authentication". Encryption is easy, authentication is the harder problem! There have been encryption products sold and used that did not provide effective authentication, i.e., someone who didn't know the key could tamper with the contents of the disk so that it decrypted to something else.
icebraining 15y ago
On the other hand, there's a decent case made that establishing this kind of precedent would basically mean that if criminals are smart enough to use PGP, then that data can never be used against them. So now smart criminals will move to Truecrypt hidden volumes and claim there isn't any hidden volume. So now what do you do? Jail someone who might be telling the truth, or let him go? This doesn't solve anything. Encryption is way past it.

jwhitlark 15y ago

It's an interesting situation: What you say to your doctor, lawyer, or spouse is protected, but what you say to yourself, is not.

deleted 15y ago
[deleted]
rsl7 15y ago
So tell your lawyer your passphrase.

mcritz 15y ago

“I’m sorry, Your Honor. I have forgotten my password.” If it’s good enough for Bob McFarlane and Alberto Gonzales, it’s good enough for regular Americans, too!

Steko 15y ago

related: http://news.ycombinator.com/item?id=2693599 http://news.ycombinator.com/item?id=2693599 'TrueCrypt User Held in Contempt of Court (truecrypt.org) "

stretchwithme 15y ago

I wonder by what means they will make their hands type. Can they be taser-ed into submission, like the guy who couldn't stand up in the college library?

marshray 15y ago
Yes, contempt-of-court in the US can mean being held in an abusive jail.

thekevan 15y ago

I hate that I think I agree with the ruling. If the authorities had a warrant to someone's house and barricade themselves in so there could be no entry, we'd hardly give it a second thought that they were violating the warrant. Refusing to give up a password to an encrypted drive is effectively barricading your content. I guess my issue is what they describe as probable cause for issuing the warrant in the first place.

waiwai933 15y ago

If I encrypt a letter by hand using, say, Caesar's cipher (despite how weak it is), could a court compel me (i.e. is there common law precedent in the US or elsewhere) to decrypt said letter? Surely there must be some precedent before we had computers and whatnot, right? This, after all, seems to be the closest-fitting analogy I can think of—both the "key to lock" and "privacy of mind" arguments seem to be stretching it. Unless the reason they're using these analogies is that no one has ever brought a non-digital encryption case before a court, which would make sense as to why they're not consulting that precedent, but surely 230 years of US law and several times that of British law would bring up something...

learc83 15y ago
There is precedent that a court can't compel you give up the combination to a combination lock, because it would be considered testimony. Seems to me that this falls under that precedent.
- philfreo 15y ago
  Source?
  - jpol 15y ago
    U.S. v. Hubbell, citing U.S. v. Doe. For these reasons, we cannot accept the Government's submission that respondent's immunity did not preclude its derivative use of the produced documents because its "possession of the documents [was] the fruit only of a simple physical act-the act of producing the documents." Id., at 29. It was unquestionably necessary for respondent to make extensive use of "the contents of his own mind" in identifying the hundreds of documents responsive to the requests in the subpoena. See Curcio v. United States, 354 U. S. 118, 128 (1957); Doe v. United States, 487 U. S., at 210. The assembly of those documents was like telling an inquisitor the COMBINATION TO A WALL SAFE, not like being forced to surrender the key to a strongbox. Id., at 210, n. 9. http://supreme.justia.com/cases/federal/us/530/27/case.html http://supreme.justia.com/cases/federal/us/530/27/case.html
  - 15y ago

losethos 15y ago

compression, not encryptian. http://www.losethos.com/LTHtml/OSMain/Compress.html http://www.losethos.com/LTHtml/OSMain/Compress.html I will interpret God for a fee -- pain in the ass. God says... sloth oh_oh fight rubbish do_you_like_it charged air_head hello what_a_mess my_bad bickering lifes_like_chocolates jealousy chump_change middle_class I_donno off_the_record in_a_perfect_world tattle_tale bank hate Zzzzzzzz quite hippy climate busybody

cschep 15y ago

Obligatory XKCD: http://xkcd.com/538/ http://xkcd.com/538/ Seriously though, why does the government think they can win at this stuff? Without hitting the guy with a wrench that is.

cynwoody 15y ago

What if she can't remember the pass phrase? Of course, she could be lying, but how could they prove that?

mc32 15y ago
In India they do it with technology. Far form proven but they might get better at this. A case. http://www.technovelgy.com/ct/Science-Fiction-News.asp?NewsNum=1876 http://www.technovelgy.com/ct/Science-Fiction-News.asp?NewsN... The tech. http://www.forensic-centre.com/assessments/brainwave-profiling http://www.forensic-centre.com/assessments/brainwave-profili...
shmerl 15y ago
They can apply various methods, such as polygraph to determine whether she really forgot the key, and it won't be so easy for her to avoid revealing the real fact.
- desas 15y ago
  Polygraphs are considered reliable? In the UK they are inadmissible in court.

meatmanek 15y ago

A stupid idea: what if we passed a law making, say, knowing an encryption key illegal, with a $0.01 penalty per year? Then asking you for your encryption key would be asking you to provide self-incriminating testimony.

chimeracoder 15y ago
You don't need to do that - there's a decent argument to be made that forcing you to decrypt a drive is already forcing you to testify against yourself, in violation of the 5th Amendment.
- techtalsky 15y ago
  Right, and that's what the article says a judge decided is NOT the case.
  - Nick_C 15y ago
    No he hasn't. Pls read the article. They are requiring her to provide the documents.
bdonlan 15y ago
If you're able to pass silly laws, wouldn't it be easier to just pass a law saying discovery can't compel people to divulge encryption keys kept only within their own head?

eck 15y ago

Isn't this one of the things TPMs are designed to defend you against? The TPM only releases the encryption key after the right password is entered, some number of wrong passwords cause a reset, and perhaps a single duress code instantly causes a reset? Once the TPM is erased, who's to tell if it wasn't just broken to begin with.

gte910h 15y ago
You mirror drives as part of evidence collection
- yew 15y ago
  . . . which is subsequently rendered useless by the TPM erasing itself. (The standard procedure is to encrypt the drive using a key stored in the TPM. The TPM then decrypts the drive when provided with the proper authentication. If the designated security policy is violated the TPM destroys the key, rendering the drive's contents useless.)
  - gte910h 15y ago
    They're mirroring the drive. Why wouldn't they mirror the TPM too? Or are you contending they're tamperproof?
    - yew 15y ago
      They are intended to be tamperproof, yes. Mirroring the contents of a TPM is an exercise in hardware deconstruction where you also have to worry about setting of auto-erase traps. It's not impossible by any means, but it's not standard procedure and there's no guarantee it will actually work.
    - yew 15y ago
      They are intended to be tamperproof, yes. Mirroring the contents of a TPM is an exercise in hardware deconstruction where you also have to worry about setting off auto-erase traps. It's not impossible by any means, but it's not standard procedure and there's no guarantee it will actually work.

rhaphazard 15y ago

A bit torn on the issue and don't have a strong opinion either way. I slightly lean towards they shouldn't have to hand over the password, but I really thing courts should try to be flexible (is that even possible?) and go case by case. Will be looking towards hearing more opinion on the issue.

kogir 15y ago

This should be cause for serious concern. There's often no way to prove that someone knows a key or pass-phrase. If a personal computer I've used for years has TrueCrypt at boot, perhaps a reasonable argument[1] could be made that I know the password. That's not true of a flash drive or an encrypted file on a shared computer. If someone plants a safe in my house, I may be held in contempt for a while while it's drilled open. Properly encrypted data might withstand attacks for a lifetime or more. [1] Best I can tell, it's possible for me to TrueCrypt encrypt your computer with only physical access. You wouldn't notice until next boot.

aaronblohowiak 15y ago
>This should be cause for serious concern. Just like using an IP address as identification of a person.

duncan_bayne 15y ago

Personally I think this is reasonable, provided that requests for decryption keys are handled with the same level of respect for law & privacy afforded to physical keys. There is a thornier issue though: stenanography + encryption. What if the encrypted data aren't visible in the first place? Or, what if the data aren't provably encrypted data? I can imagine a case where someone languishes in jail for contempt of court, after being ordered to produce something that doesn't actually exist.

scottdw2 15y ago

You can be compelled to produce a physical key to a safe. However what if the contents of the safe are paper with text written in an invented language, known only to you? Can you be compelled to translate them for the court? What if they just contained numbers? Could you be forced to explain what the numbers mean? I would conclude that such an action would violate the 5th ammendment. Forcing her to decrypt the hard drive is the same thing. Given a warrant, the police have the right to search her hard drive. If they can't understand what it says, she should not have to explain it to them. Right now, they have no evidence. She is being compelled to produce evidence against her self. Providing a physical key produces no evidence. It produces a key. Providing a decrypted version of the data on the laptop is producing information. The contents of the laptop are such that they exhibit a high level of entropy. By definition, they are not information. If they did contain information, they would by definition not be encrypted. Thus, the request is for the defendant in a criminal trial to replace something that is not information with something that is information. That is clearly a violation of the 5th ammendment.

deleted 15y ago
[deleted]
- deleted 15y ago
  [deleted]
pi18n 15y ago
I agree and so do past rulings. This judge needs brush up on US law.
- rorrr 15y ago
  There were all kinds of rulings, and it has never reached the Supreme Court. So until then, a judge can lock you up indefinitely, until you produce the password.
tedunangst 15y ago
The contents of the laptop are such that they exhibit a high level of entropy. By definition, they are not information. uh, the bits of a compressed file also exhibit a high level of entropy. Are compressed files not information either?

nirvana 15y ago

I wonder about this: What if the key to the encryption is written on a dozen seemingly random notes on yellow sticky notes in your office full of yellow sticky notes? Or, it is composed of the last letter on each page of a series of innocuous looking documents, such that the government might seize the documents but naturally in the process of doing so, scramble the documents order rendering the password irretrievable. Or its some combination of words from a book, or some other innocuous piece of material that they'd simply ignore and that would be thrown out after they left. The one FBI raid I'm directly familiar with involved them seizing the computers and even the phones, but not the desks or the phone books, etc. In this case the passphrase existed in the location where the laptop was seized but in the intervening months, or in the act of seizing it, the phrase was destroyed. Thus it is the responsibility of the cops who seized it that the passphrase is no longer retrievable, and thus it is the government's fault the data is impossible to decrypt. I'm sure there's an even better way to accomplish something similar that I'm not thinking of, where the phrase is kept handy, but only obvious to you so that you know how to derive it, but the simple act of serving a search warrant will eliminate the phrase by rearranging the key elements. Then in court you can testify honestly to exactly how you looked up the phrase, but the government would have no way to recreate it.

IgorPartola 15y ago
Sure. You could do even better: keep your computer on at all times and keep everything you do in RAM. No encryption is necessary here, just a $100 UPS and your laptop's own battery. The problem with all these comments about "what if I give half of my phrase to a friend?" or "what if I write it in the dust at the entrance to my house and the FBI wipes it away when they bust in?" is that it doesn't really address the core issue. There is no technological solution to this situation: 1. The gov't can just give up on the idea of looking at encrypted drives. Not likely and possibly bad for society as a whole. I am not able to judge that. 2. The judge can just refuse to understand that there is no way to decrypt the drive and hold you in contempt of the court indefinitely at which point you'll be cursing yourself for not burying the passphrase chiseled into a stone in your back yard. 3. The gov't makes it illegal to encrypt drives without giving them the keys. At best this is done through some kind of third-party escrow service so that an actual warrant needs to be given before the key is given out. At worst, you just drop off your encryption keys with the nearest post office. 4. There is no #4. The judicial system won't just go "well, this guy has an encrypted drive and we can't get in. Let's just let him go since he clearly outsmarted us." They either will find something else on you, or compel you to decrypt the drive. Like I said, there is no technical solution, only social/behavioral. Encryption became too sophisticated and there isn't much that we can do nowadays.

jdietrich 15y ago

For anyone wondering what this might look like in practice, look up the Regulation of Investigatory Powers Act. There have been a number of prosecutions in the UK for failing to provide encryption keys, many of them resulting in imprisonment. Notably, the first prosecution was of a paranoid schizophrenic man, who was moved to a secure psychiatric hospital during his prison sentence. We have not yet had a test case regarding deniable encryption, but I imagine it will be only a matter of time.

jrockway 15y ago

"I forgot the key." Done. (Presumably serving an 18 month contempt sentence in a county jail is better than the 25-to-life in a maximum security federal prison you'd get if they saw the contents of your hard drive.)

ComputerGuru 15y ago
If I'm not mistaken, there's no limit on contempt of court. A... stubborn judge could keep you detained until you're no longer in contempt.
- jpol 15y ago
  Imprisonment for civil contempt can be of unlimited duration, but the purpose of it is to force you to give up the information. Once you have been in jail long enough for the judge to realize that imprisoning you won't change your mind, you will be released. That could be a very long time.
- learc83 15y ago
  Longest jail term for contempt was 14 years for a man who said he lost $2.75 million, and therefore couldn't give anything to his wife. http://abcnews.go.com/2020/story?id=8101209&page=1#.Tx4s32NWrM4 http://abcnews.go.com/2020/story?id=8101209&page=1#.Tx4s...
- jrockway 15y ago
  I've read that it's tied to a particular grand jury session, which is something like 18 months. Either way, the longest contempt sentence ever was 14 years, which is nothing compared to what you'll get if the government convicts you of laundering money, selling drugs, possessing child porn, or all the other crimes that you might have documented on your computer.
  - 3143 15y ago
    Why would you want that person to be able to avoid going to jail just because he was smart enough to use encryption?

ThePinion 15y ago

This is a serious question that I hope gets answered: Is it possible to tell Linux (or Windows I guess) to immediately crash if you boot it up and are either 1) not connected to the internet or 2) not connected from a certain IP address. Then you could give up the key, but tell them "see, it's broken and I haven't been able to use it anyway."

ryanwaggoner 15y ago

What if you made your passphrase itself a confession to a crime? "I shot the sheriff." Then you could claim that supplying your password would constitute self-incrimination, and so you'd like to invoke your 5th Amendment rights :)

ComputerGuru 15y ago
It's not testimony. Even confessions can't be used against you if not given in the form of a testimony.
- ryanwaggoner 15y ago
  Source? Not trying to be snarky, just would like more details. What counts as testimony?
geoffschmidt 15y ago
Ceci n'est pas une pipe. Reasonable people are sophisticated enough to understand that there is a difference between using a sentence as a password, and believing that sentence to be true. On a related note, I once looked into changing my middle name to an executable implementation of RSA, so that my passport would be a non-exportable munition. (No go.)
- lawnchair_larry 15y ago
  What was their reason for declining the name change?
  - bdonlan 15y ago
    I would guess that it would be too long if written out in English, and that they'd probably deny a name change to a name that contains characters not normally used in names (asterisks, semicolons, underscores...)
noblethrasher 15y ago
http://en.wikipedia.org/wiki/Use%E2%80%93mention_distinction http://en.wikipedia.org/wiki/Use%E2%80%93mention_distinction

Cushman 15y ago

Okay, American hackers, here's your civil disobedience: Go to a foreign country. Buy a flash drive. Set up two partitions; make one a small TrueCrypt bootstrap partition, configured to decrypt the second with a password. Random-wipe the second. (For insurance, you may wish to do this provably. Maybe use a publicly-accessible source of random data?) Travel back across the border. When you are asked to decrypt your drive, inform the authority that you are unable to do so, since no password exists, and the data is utterly meaningless. They will probably want you to provide some evidence of this. Refuse; insist that you cannot be required to prove that you have not done something wrong. If all goes well, they'll arrest you for something. Then, call a lawyer.

geoffschmidt 15y ago

Let's look a little bit further down the road, say 100 or 200 years. If the computer is implanted in my head, can you compel me to give you the data in it? What if the computer is made partly of cells? Just how tightly integrated do I have to be with the storage device before it's part of the private, protected sphere of my personal consciousness? I don't mean to be frivolous. As we become ever more dependent on cloud storage and mobile devices as extensions of our memories and our capabilities, we're eventually going to have revisit the legal boundaries of our personhood. My communications with my attorney are subject to attorney-client privilege. It's almost like the attorney is considered to be a subprocess of me when he is thinking about my problems. We correctly see it as being in the public interest to allow me to communicate with my attorney without hindrance. Why shouldn't my communications with myself be given the same privilege?

ww520 15y ago
Well, governments can compel to collect DNA sampling from you now. Why not go further and compel to read your implanted chip? They can collect your recorded GPS location as evidence.
hobin 15y ago
I am inclined to think that this is one of those cases where people feel uncomfortable for some time. ...and then they get used to it.

RexRollman 15y ago

"He said the All Writs Act, which dates back to 1789 and has been used to require telephone companies to aid in surveillance, could be invoked in forcing decryption of hard drives as well." I respectfully disagree, even if his opinion is correct under the law. A defendant should never, ever, be forced to assist in his own prosecution, and being forced to decrypt the drive would be doing exactly that.

feralchimp 15y ago

I'm a government-should-leave-reasonable-people-the-hell-alone libertarian and a crypto-is-the-shit kind of guy. I also think warrants for searches of encrypted media are totally legit, and think the hair splitting over "typing in the password without anyone seeing it" vs. "being compelled to dictate the password" is completely pointless. 1. Not every vocal Utterance qualifies as Testimony, and the only person who gets to self-identify with an encryption key is Whitfield Diffie, and that rule only applies after 3 bong hits -OR- when he's doing Salvia with Ron Rivest as his sitter. Your weasel card-skimming ass ain't no Whitfield Diffie. 2. If you leak enough inculpatory evidence outside your encrypted hard drive, such that the police are now holding a warrant for searching inside your encrypted hard drive, the jig is up, son! Shouldn't have leaked all that other guilt-stench, and should have plausibly-deniably deleted that evidence.

ataggart 15y ago
Individuals should not be compelled to actively participate in their own prosecution. This is the spirit of the 5th Amendment.
- feralchimp 15y ago
  I appreciate that the adversarial method of trial has given rise to that and other threads of argument on behalf of defendants; I'm just not buying it in this case. It's an absurdly low bar for "active participation." He's not being asked to compute the AES decryption on 3x5 cards, or help the prosecution find the spot where the laptop is buried in the woods. When you're caught, you're forced to empty your pockets. If your 'pockets' include 1TB of incriminating data, that's your bad. Is one also actively participating in his own prosecution when he fails to resist arrest? How about when he agrees not to leave the country as a condition for posting bail? After all, he's had that vacation to [insert non-extradition country here] for months! Why should he change his plans to benefit the prosecution?

hippich 15y ago

Once again - either providing password, or entering it without revealing password itself is a self-incrimination simply because this way you prove you are owner of this information. Why this is important? It might be not yours information but you might know password. And this will make you incriminating yourself. And most important, no matter what, right to not incriminate yourself should be remain untouched. Otherwise, nothing protects people from its government.

trotsky 15y ago

Perhaps I don't understand some dynamic here, but what prevents someone from just stating that they no longer know the pass phrase? I thought that was more or less a free pass, as no one can prove what you do or don't remember. Hence why the phrase "I'm sorry, I don't recall that senator" is used so often when everyone knows they're lying.

Derbasti 15y ago

Yet another freedom lost in the land of the free: You are not allowed to have secrets any more.

pimeys 15y ago

I used to think of moving to USA. I'm a pretty good programmer and it would've been nice to work in an American startup. When reading these news, about SOPA/PIPA, about the crazy amount of spying and control in the airports, about forcing to decrypt my laptop, I don't want to go there even for a holiday anymore. I'm happy here in Berlin and even though the salaries are half what I would get from Silicon Valley, the cost of living is also much lower. And I'm not alone.

scelerat 15y ago

Does the defendant's fate hinge on the contents of this laptop? It seems not: the article mentions other evidence against her. If a case hinges entirely on the contents of an encrypted laptop, perhaps it's not the strongest of cases... which is kind of the point of the fourth and fifth amendments: keeping the government honest, so to speak.