7 ms·

Colorado woman must unencrypt hard drive

25 points by jamesbritt 15y ago

drivebyacct2 15y ago
If it were possible to prove that I didn't remember the password to my encrypted drive, would I be violating some law that I could get into trouble for?
- Cieplak 15y ago
  That would be rather difficult to prove. Conversely, it'd be difficult to prove that you didn't forget the password. I think it comes down to a Fifth Amendment issue. If a judge decides it's not protected under the Fifth Amendment, then I suppose you could be held in contempt of court. http://www.brettwmartin.com/contempt-of-court-in-colorado/contempt-and-the-fifth-amendment http://www.brettwmartin.com/contempt-of-court-in-colorado/co...
  - bgentry 15y ago
    How could you prove that I didn't forget it? It's impossible.
    - Cieplak 15y ago
      It's impossible to prove it beyond a reasonable doubt, but there could be a preponderance of evidence that you didn't forget it. For instance, someone could testify that they saw you log in the day the computer was seized. http://en.wikipedia.org/wiki/Legal_burden_of_proof http://en.wikipedia.org/wiki/Legal_burden_of_proof However, you could argue that you didn't log in using your PGP password that day, but rather your OS level password. Your habit is to never shut down your computer, but rather to let it stand by, so very rarely do you ever use your PGP password. Earlier that week you changed your PGP password, but you can't remember it. The password went something like blah blah blah. This way you are cooperative, without turning yourself in.
- pluies_public 15y ago
  It would be akin to say "this safe? I lost the keys.", wouldn't it? I don't know what's the standard way of dealing with that either though.
  - maxerickson 15y ago
    Depending on what was inside of it, they would just have someone open it.
  - drivebyacct2 15y ago
    I imagine with enough willpower or strength any safe can be broken into. Not so much with encryption.
rottencupcakes 15y ago
This is simply a terrible title for this article.
billpg 15y ago
I misread that as "colocated woman". (Edit: This comment made sense before the title was edited.)
- deleted 15y ago
  [deleted]
- jamesbritt 15y ago
  Yes, my apologies. After I read your comment I no longer read the "Colo." as an abbreviation for a state; now it instantly meant "colocated." :( My thanks to whomever fixed it.
RexRollman 15y ago
I would refuse to decrypt the drive, even though it would be contempt, but everyone has to decide for themselves what battles are worth fighting.
- mattmiller 15y ago
  I would like to see them prove that I knew my password. That would be an interesting precedent. On an unrelated note, these people are probably guilty and it is a bummer that I have to choose to side with them because letting them go free is better than giving the government one more tool to erode privacy.
- jrockway 15y ago
  I would too. County jail is a lot better than federal prison. (Anything that you'd want to encrypt is going to get you life in prison these days, so it's not like you have anything to lose.)
  - ceol 15y ago
    >(Anything that you'd want to encrypt is going to get you life in prison these days, so it's not like you have anything to lose.) There's more you can use encryption for than just illegal activities. Personal and financial information comes to mind, as do company secrets.
- grecy 15y ago
  I wonder what the penalty for contempt is? let's say it's a high-profile murder case, and they need the info on the drive to make it stick. Without the drive, there is no case. If the defendant gives over the key, they get 25-life, what's the penalty for contempt?
  - Miner49er 15y ago
    In Colorado, it looks like the maximum sentence for contempt is 6 months. In Wyoming (my state), the max is 90 days or a $500 fine. I would choose contempt.
zalew 15y ago
"Federal prosecutors argue that not allowing the government access to encrypted computers would make it impossible to prosecute crimes such as terrorism, child exploitation and drug trafficking" good old 'think of the children'
- refurb 15y ago
  What I find annoying is the use of the word "impossible". Really? If everyone used encryption, the number of successful prosecutions of these crimes would drop to zero?
  - zalew 15y ago
    We should ask if before everyone had a laptop, and before those laptops were encrypted, haven't those crimes existed and be prosecuted in the first place?
- superppl 15y ago
  That line just bugs me on so many levels. Why can't they prosecute those cases without having the data on someone's laptop? What can someone have on a laptop that can be so important that without it it becomes impossible to convince a jury? Honestly, I think if the prosecution is unable to move forward without that data, then they had no hope in the first place.
  - whyenot 15y ago
    Wouldn't an obvious case be possession of child pornography?
  - deleted 15y ago
    [deleted]
  - ceol 15y ago
    I disagree. In cases of fraud, logs, emails, and spreadsheets could all be used to guarantee a case— especially if it's the online variety. From my understanding, you're basically asking for the prosecution to prosecute a murder case but not allow them to use the murder weapon— with the person's prints on it— as evidence.
grecy 15y ago
Wow, that raises so many interesting questions / loopholes / stupid scenarios. 1. What if I encrypt the drive twice? Sure, I'll decrypt the first layer, then they can have the "contents" of that. 2. What are the legal implications if I've "encrypted" something written down? i.e. replaced every letter with the next letter in the alphabet. Do I have to decrypt that? 3. What are the legal implications if I've written things down in another language, known only to me - can I be forced to translate it? I would think a nice defense here is to say they can have the disk, it's just in another language, which is their problem. 4. Further to point 3. what if I have the info on a drive with a File System that only I can read/write? Do I have to give them the tools to read the file system? 5. Similar to point 4, I write my own custom binary file format that only I know how to read/write - again, do I have to describe the file format? This is about to get crazy.
- Arelius 15y ago
  As a response to #1, I'm pretty sure that wouldn't hold up. Unless they specifically state that she will "Run the XXX Algorithm on the drive" It's probably legally sound that she has to fully decrypt all the data. #2 probably holds similarly. The remaining ones are just getting more ridiculous.
jrockway 15y ago
This is far from over. There is still the matter of "I forgot". (No, the judge might not like that, but on the other hand, if she did actually forget...)
Sukotto 15y ago
How is this different than being forced to unlock something like a filing cabinet or empty your pockets, or open the storage locker as part of a police investigation? this is investigating a specific crime. It's not like being forced to decrypt when the police are fishing for a reason to bust you. (or NYC's stop-and-frisk emptying of your pockets which I firmly oppose)
- Arelius 15y ago
  Should we all be storing our hard drives in a lockable vault, such that we can get the legal protection that physically sealing it would do?
  - Sukotto 15y ago
    No. My point is that search warrants should cover decrypting your digital data in exactly the same way that they allow the police to search your home, your office, your storage locker, your safe, etc.
    - maxerickson 15y ago
      Why not treat cryptography as a novelty? A nice outcome is that it avoids all the issues surrounding guessing whether the key to the random bits even exists, and what form it takes, and whether there is more than one key, and so on.
revelation 15y ago
For all anyone can prove, its random data. What are they going to do next time I safely erase a file? Throw me in jail for contempt because I can't magically turn the random data into incriminating evidence?
- Arelius 15y ago
  The decrypted data could be random, but afaik, encrypted data does have patterns that are evident of encrypted data.
  - keeperofdakeys 15y ago
    Usually this is only in the form of a header on the block device. Dm-crypt on linux has a mode called 'plain'. This uses the sector number and passphrase/keyfile to generate a unique encryption key for each sector. This means there is no meta-data, and corruption of any physical sectors map directly to the unencrypted block device. In this case, it does look just like random data.
halefx 15y ago
Future solution: Create a killswitch password that completely erases specific directories when used.
- Arelius 15y ago
  This would hardly solve the problem. By the time they would have you decrypt, they would have made a disk image of the drive in question. When you enter the killswitch, they could simply restore, and request that you try again, not to mention that that is then suddenly better evidence against you. The best solution seems that it may be nested encrypted partitions. ala, the trucrypt solution: http://www.truecrypt.org/docs/?s=hidden-volume http://www.truecrypt.org/docs/?s=hidden-volume
  - halefx 15y ago
    Or Deniable Encryption: http://en.wikipedia.org/wiki/Deniable_encryption http://en.wikipedia.org/wiki/Deniable_encryption
duncan_bayne 15y ago
Steganography FTW, here. "Here you go, I've decrypted my hard drive. Now, somewhere in my gigs of cat photos and music lie the documents you're looking for. Have fun."
drucken 15y ago
Unless the US specifically has laws about not revealing passwords, all this couple have to do is claim they forgot it. Even if that failed, the most the judge can add to their charge is contempt of court... This is clearly a fishing expedition (unlike, allegedly, the cited border child pornography case) by government agencies AND the justice system trying to set a precedent for searches without existing hard evidence of a crime.
thoughtsimple 15y ago
I have many encrypted files that I do not know the password to. The passwords are in an encrypted keychain that I do know the password to. If I delete the keychain, there is no way that I will be able to decrypt those files. What would happen if the courts ordered me to decrypt a file where I no longer have access to the password?
gm 15y ago
What encryption software is this woman using?

25 points by jamesbritt 15y ago

If it were possible to prove that I didn't remember the password to my encrypted drive, would I be violating some law that I could get into trouble for?

Cieplak 15y ago
That would be rather difficult to prove. Conversely, it'd be difficult to prove that you didn't forget the password. I think it comes down to a Fifth Amendment issue. If a judge decides it's not protected under the Fifth Amendment, then I suppose you could be held in contempt of court. http://www.brettwmartin.com/contempt-of-court-in-colorado/contempt-and-the-fifth-amendment http://www.brettwmartin.com/contempt-of-court-in-colorado/co...
- bgentry 15y ago
  How could you prove that I didn't forget it? It's impossible.
  - Cieplak 15y ago
    It's impossible to prove it beyond a reasonable doubt, but there could be a preponderance of evidence that you didn't forget it. For instance, someone could testify that they saw you log in the day the computer was seized. http://en.wikipedia.org/wiki/Legal_burden_of_proof http://en.wikipedia.org/wiki/Legal_burden_of_proof However, you could argue that you didn't log in using your PGP password that day, but rather your OS level password. Your habit is to never shut down your computer, but rather to let it stand by, so very rarely do you ever use your PGP password. Earlier that week you changed your PGP password, but you can't remember it. The password went something like blah blah blah. This way you are cooperative, without turning yourself in.
pluies_public 15y ago
It would be akin to say "this safe? I lost the keys.", wouldn't it? I don't know what's the standard way of dealing with that either though.
- maxerickson 15y ago
  Depending on what was inside of it, they would just have someone open it.
- drivebyacct2 15y ago
  I imagine with enough willpower or strength any safe can be broken into. Not so much with encryption.

rottencupcakes 15y ago

This is simply a terrible title for this article.

billpg 15y ago

I misread that as "colocated woman". (Edit: This comment made sense before the title was edited.)

deleted 15y ago
[deleted]
jamesbritt 15y ago
Yes, my apologies. After I read your comment I no longer read the "Colo." as an abbreviation for a state; now it instantly meant "colocated." :( My thanks to whomever fixed it.

RexRollman 15y ago

I would refuse to decrypt the drive, even though it would be contempt, but everyone has to decide for themselves what battles are worth fighting.

mattmiller 15y ago
I would like to see them prove that I knew my password. That would be an interesting precedent. On an unrelated note, these people are probably guilty and it is a bummer that I have to choose to side with them because letting them go free is better than giving the government one more tool to erode privacy.
jrockway 15y ago
I would too. County jail is a lot better than federal prison. (Anything that you'd want to encrypt is going to get you life in prison these days, so it's not like you have anything to lose.)
- ceol 15y ago
  >(Anything that you'd want to encrypt is going to get you life in prison these days, so it's not like you have anything to lose.) There's more you can use encryption for than just illegal activities. Personal and financial information comes to mind, as do company secrets.
grecy 15y ago
I wonder what the penalty for contempt is? let's say it's a high-profile murder case, and they need the info on the drive to make it stick. Without the drive, there is no case. If the defendant gives over the key, they get 25-life, what's the penalty for contempt?
- Miner49er 15y ago
  In Colorado, it looks like the maximum sentence for contempt is 6 months. In Wyoming (my state), the max is 90 days or a $500 fine. I would choose contempt.

zalew 15y ago

"Federal prosecutors argue that not allowing the government access to encrypted computers would make it impossible to prosecute crimes such as terrorism, child exploitation and drug trafficking" good old 'think of the children'

refurb 15y ago
What I find annoying is the use of the word "impossible". Really? If everyone used encryption, the number of successful prosecutions of these crimes would drop to zero?
- zalew 15y ago
  We should ask if before everyone had a laptop, and before those laptops were encrypted, haven't those crimes existed and be prosecuted in the first place?
superppl 15y ago
That line just bugs me on so many levels. Why can't they prosecute those cases without having the data on someone's laptop? What can someone have on a laptop that can be so important that without it it becomes impossible to convince a jury? Honestly, I think if the prosecution is unable to move forward without that data, then they had no hope in the first place.
- whyenot 15y ago
  Wouldn't an obvious case be possession of child pornography?
- deleted 15y ago
  [deleted]
- ceol 15y ago
  I disagree. In cases of fraud, logs, emails, and spreadsheets could all be used to guarantee a case— especially if it's the online variety. From my understanding, you're basically asking for the prosecution to prosecute a murder case but not allow them to use the murder weapon— with the person's prints on it— as evidence.

grecy 15y ago

Wow, that raises so many interesting questions / loopholes / stupid scenarios. 1. What if I encrypt the drive twice? Sure, I'll decrypt the first layer, then they can have the "contents" of that. 2. What are the legal implications if I've "encrypted" something written down? i.e. replaced every letter with the next letter in the alphabet. Do I have to decrypt that? 3. What are the legal implications if I've written things down in another language, known only to me - can I be forced to translate it? I would think a nice defense here is to say they can have the disk, it's just in another language, which is their problem. 4. Further to point 3. what if I have the info on a drive with a File System that only I can read/write? Do I have to give them the tools to read the file system? 5. Similar to point 4, I write my own custom binary file format that only I know how to read/write - again, do I have to describe the file format? This is about to get crazy.

Arelius 15y ago
As a response to #1, I'm pretty sure that wouldn't hold up. Unless they specifically state that she will "Run the XXX Algorithm on the drive" It's probably legally sound that she has to fully decrypt all the data. #2 probably holds similarly. The remaining ones are just getting more ridiculous.

jrockway 15y ago

This is far from over. There is still the matter of "I forgot". (No, the judge might not like that, but on the other hand, if she did actually forget...)

Sukotto 15y ago

How is this different than being forced to unlock something like a filing cabinet or empty your pockets, or open the storage locker as part of a police investigation? this is investigating a specific crime. It's not like being forced to decrypt when the police are fishing for a reason to bust you. (or NYC's stop-and-frisk emptying of your pockets which I firmly oppose)

Arelius 15y ago
Should we all be storing our hard drives in a lockable vault, such that we can get the legal protection that physically sealing it would do?
- Sukotto 15y ago
  No. My point is that search warrants should cover decrypting your digital data in exactly the same way that they allow the police to search your home, your office, your storage locker, your safe, etc.
  - maxerickson 15y ago
    Why not treat cryptography as a novelty? A nice outcome is that it avoids all the issues surrounding guessing whether the key to the random bits even exists, and what form it takes, and whether there is more than one key, and so on.

revelation 15y ago

For all anyone can prove, its random data. What are they going to do next time I safely erase a file? Throw me in jail for contempt because I can't magically turn the random data into incriminating evidence?

Arelius 15y ago
The decrypted data could be random, but afaik, encrypted data does have patterns that are evident of encrypted data.
- keeperofdakeys 15y ago
  Usually this is only in the form of a header on the block device. Dm-crypt on linux has a mode called 'plain'. This uses the sector number and passphrase/keyfile to generate a unique encryption key for each sector. This means there is no meta-data, and corruption of any physical sectors map directly to the unencrypted block device. In this case, it does look just like random data.

halefx 15y ago

Future solution: Create a killswitch password that completely erases specific directories when used.

Arelius 15y ago
This would hardly solve the problem. By the time they would have you decrypt, they would have made a disk image of the drive in question. When you enter the killswitch, they could simply restore, and request that you try again, not to mention that that is then suddenly better evidence against you. The best solution seems that it may be nested encrypted partitions. ala, the trucrypt solution: http://www.truecrypt.org/docs/?s=hidden-volume http://www.truecrypt.org/docs/?s=hidden-volume
- halefx 15y ago
  Or Deniable Encryption: http://en.wikipedia.org/wiki/Deniable_encryption http://en.wikipedia.org/wiki/Deniable_encryption

duncan_bayne 15y ago

Steganography FTW, here. "Here you go, I've decrypted my hard drive. Now, somewhere in my gigs of cat photos and music lie the documents you're looking for. Have fun."

drucken 15y ago

Unless the US specifically has laws about not revealing passwords, all this couple have to do is claim they forgot it. Even if that failed, the most the judge can add to their charge is contempt of court... This is clearly a fishing expedition (unlike, allegedly, the cited border child pornography case) by government agencies AND the justice system trying to set a precedent for searches without existing hard evidence of a crime.

thoughtsimple 15y ago

I have many encrypted files that I do not know the password to. The passwords are in an encrypted keychain that I do know the password to. If I delete the keychain, there is no way that I will be able to decrypt those files. What would happen if the courts ordered me to decrypt a file where I no longer have access to the password?

gm 15y ago

What encryption software is this woman using?