7 ms·

Just out of curiosity, what's the case-law like if she had encoded these documents and stored them on paper? I certainly don't want to see mandatory decryption

Just out of curiosity, what's the case-law like if she had encoded these documents and stored them on paper? I certainly don't want to see mandatory decryption, but at the same time it doesn't make sense to let an accused completely skip out on discovery by simply truecrypt-ing the evidence either.

mikeash 15y ago
To me, the most convincing argument is, what if you legitimately forget your password? If that alone gets you thrown in jail, then you're going to be jailing a lot of innocent people. On the other hand, if that does not get you thrown in jail, then one can simply claim to have forgotten the password without repercussion. Personally, I'd rather let people hide evidence by encrypting it than jail people for being forgetful, since those seem to be the only two choices.
- grecy 15y ago
  I agree 100% I'm thinking about the case where a person never even knew the key to what they have. The example is a business laptop being carried through customs, that was encrypted by someone else, who will decrypt it upon your arrival (or something similar)
  - tedunangst 15y ago
    1. If there's no evidence that you know the password, that's possibly a reasonable defense. When the police have a recording of you saying "don't worry, the files are on my encrypted partition", it's less reasonable. 2. I would seriously reconsider the decision to carry unknown contents through customs.
    - jrockway 15y ago
      2. I would seriously reconsider the decision to carry unknown contents through customs. My ISP does this billions of times per day.
- alextgordon 15y ago
  And, what if I do this? head -c 1048576 /dev/random >not_encrypted_I_promise I can't prove that file isn't actually encrypted data. Are we going to throw people in jail for possessing random data without a justification?
  - tedunangst 15y ago
    No, we're only going to throw people in jail for possessing random data and failing to produce encrypted documents we have evidence they possess.
    - gcb 15y ago
      that's the most dodged response ever. i think for his question to even be made, it was assumed he was being accused of possessing encrypted something. Let's attach the old guy from france that got into the 3 strike law without even having a computer at the time. Now let's say instead of getting the IP of that old guy from france, the police got the IP of the comment above yours, from let's say mr Buttle. Now they confuse him with Mr Tuttle and assume he has encrypted criminal data. but all they could find on his computer is the file "not_encrypted_i_promise". he is then throw in jail because he failed to provide the password. His infective defense was that he was "playing" with philosophical questions regarding encryption.
      - tedunangst 15y ago
        Then explain that to the judge. The defendant in this case is not claiming to be the victim of mistaken identity.
        gcb 15y ago
        that was even less to the point. you are good ignore the mistaken identity, was just a means to reach the false/wrong accusation resulting in the experiment he just did convicting him.
        15y ago
- rayiner 15y ago
  You're creating a dichotomy that doesn't exist. What actually happens is that there is an intent element to crimes associated with destroying evidence. So you might get in trouble for purposefully destroying evidence, or in some cases negligently destroying evidence (e.g. a company that didn't have a proper data-retention policy). You usually can't get in trouble for accidentally destroying evidence. Then, you testify as to your intent, and the jury gets to decide whether you're telling the truth, making inferences from your circumstances. People might believe you forgot the password to some drive you never use, but probably won't believe you forgot the password to the drive holding the bank codes for all the money you embezzled.
  - mikeash 15y ago
    And what if the police just think the drive holds the bank codes for all the money I embezzled, but is actually an archive of amusing cat pictures I forgot the password to a year ago? Seems to me that the only way to reasonably apply "innocent until proven guilty" there is to only convict if they know what the encrypted contents are, and if they can already prove that beyond a reasonable doubt, why do they even need you to decrypt them for you? Conversely, if they don't know the contents, then they may well be innocent, and the password innocently forgotten.
    - dedward 15y ago
      which means prosecutors will have supporting evidence that you have the info they need andyou wonthaveevidence that you are acat freak.
lukev 15y ago
Also analogous would be whether defendants can be required to provide they key to a safe, correct? According to the article, Judge Blackburn's reasoning was that if defendants can be required to produce other documents, the existence of which is known, they can be required to "produce" encrypted documents via decrypting.
koenigdavidmj 15y ago
Interesting argument. Or what about different languages: if I write it in German, they can just get a translator. If I write it in a language of my own creation (hat tip to Tolkien here), then can they force me to translate?
- cosmando 15y ago
  Or if you write in gibberish, who does the burden of proof fall on to demonstrate the information is truly 'random' and not a cypher?

mikeash 15y ago

To me, the most convincing argument is, what if you legitimately forget your password? If that alone gets you thrown in jail, then you're going to be jailing a lot of innocent people. On the other hand, if that does not get you thrown in jail, then one can simply claim to have forgotten the password without repercussion. Personally, I'd rather let people hide evidence by encrypting it than jail people for being forgetful, since those seem to be the only two choices.

grecy 15y ago
I agree 100% I'm thinking about the case where a person never even knew the key to what they have. The example is a business laptop being carried through customs, that was encrypted by someone else, who will decrypt it upon your arrival (or something similar)
- tedunangst 15y ago
  1. If there's no evidence that you know the password, that's possibly a reasonable defense. When the police have a recording of you saying "don't worry, the files are on my encrypted partition", it's less reasonable. 2. I would seriously reconsider the decision to carry unknown contents through customs.
  - jrockway 15y ago
    2. I would seriously reconsider the decision to carry unknown contents through customs. My ISP does this billions of times per day.
alextgordon 15y ago
And, what if I do this? head -c 1048576 /dev/random >not_encrypted_I_promise I can't prove that file isn't actually encrypted data. Are we going to throw people in jail for possessing random data without a justification?
- tedunangst 15y ago
  No, we're only going to throw people in jail for possessing random data and failing to produce encrypted documents we have evidence they possess.
  - gcb 15y ago
    that's the most dodged response ever. i think for his question to even be made, it was assumed he was being accused of possessing encrypted something. Let's attach the old guy from france that got into the 3 strike law without even having a computer at the time. Now let's say instead of getting the IP of that old guy from france, the police got the IP of the comment above yours, from let's say mr Buttle. Now they confuse him with Mr Tuttle and assume he has encrypted criminal data. but all they could find on his computer is the file "not_encrypted_i_promise". he is then throw in jail because he failed to provide the password. His infective defense was that he was "playing" with philosophical questions regarding encryption.
    - tedunangst 15y ago
      Then explain that to the judge. The defendant in this case is not claiming to be the victim of mistaken identity.
      - gcb 15y ago
        that was even less to the point. you are good ignore the mistaken identity, was just a means to reach the false/wrong accusation resulting in the experiment he just did convicting him.
        15y ago
rayiner 15y ago
You're creating a dichotomy that doesn't exist. What actually happens is that there is an intent element to crimes associated with destroying evidence. So you might get in trouble for purposefully destroying evidence, or in some cases negligently destroying evidence (e.g. a company that didn't have a proper data-retention policy). You usually can't get in trouble for accidentally destroying evidence. Then, you testify as to your intent, and the jury gets to decide whether you're telling the truth, making inferences from your circumstances. People might believe you forgot the password to some drive you never use, but probably won't believe you forgot the password to the drive holding the bank codes for all the money you embezzled.
- mikeash 15y ago
  And what if the police just think the drive holds the bank codes for all the money I embezzled, but is actually an archive of amusing cat pictures I forgot the password to a year ago? Seems to me that the only way to reasonably apply "innocent until proven guilty" there is to only convict if they know what the encrypted contents are, and if they can already prove that beyond a reasonable doubt, why do they even need you to decrypt them for you? Conversely, if they don't know the contents, then they may well be innocent, and the password innocently forgotten.
  - dedward 15y ago
    which means prosecutors will have supporting evidence that you have the info they need andyou wonthaveevidence that you are acat freak.

lukev 15y ago

Also analogous would be whether defendants can be required to provide they key to a safe, correct? According to the article, Judge Blackburn's reasoning was that if defendants can be required to produce other documents, the existence of which is known, they can be required to "produce" encrypted documents via decrypting.

koenigdavidmj 15y ago

Interesting argument. Or what about different languages: if I write it in German, they can just get a translator. If I write it in a language of my own creation (hat tip to Tolkien here), then can they force me to translate?

cosmando 15y ago
Or if you write in gibberish, who does the burden of proof fall on to demonstrate the information is truly 'random' and not a cypher?