5 ms·

> the Milwaukee-area man now must either ... or must provide an unencrypted copy of the data How will they know if he provided an unencrypted copy of the data

> the Milwaukee-area man now must either ... or must provide an unencrypted copy of the data How will they know if he provided an unencrypted copy of the data or some other data? Also, what if he forgot the password? I have at least one pendrive with an encrypted partition that I wouldn't be able to decrypt. It's empty but that is supposedly unprovable. I should probably reformat it. On the political side, the government is cleverly eroding the right to privacy. Virtually no one will stand up for a paedophile (whether the charge is true doesn't matter) so they get to set a precedence here and use it against whomever they want later.

wpietri 13y ago
I don't see an erosion here. Has the right to privacy ever allowed people to prevent access to something where there is probable cause to think there's evidence of a crime?
- downandout 13y ago
  He isn't "preventing access". He is merely remaining silent on the matter, and has not admitted ownership of the drives or knowledge of the contents or decryption key. It is important to note that the judge never held that forced decryption of drives he owns violates the fifth amendment; he simply held that, at the time of the government's request, there was no evidence that he actually owned and controlled the drives and their contents. The recent discovery of the data on the other drives convinced the judge that the drives do in fact belong to him, and as a result he is now OK with ordering the forced decryption. If you are doing bad things, you probably shouldn't use a decryption key that you could remember. Store that stuff elsewhere.
- mikeash 13y ago
  I think it's a wholly new situation. Previously, you couldn't be compelled to e.g. hand over the combination to a safe, but the police are free to just break into it, once they have a warrant. There's no "breaking into" cryptography, which sets it apart. In any case, I don't see how the Fifth Amendment wouldn't apply here. Maybe we'd prefer that people not be able to take refuge in it for this stuff, but that means amending the Constitution, not ignoring inconvenient parts of it.
  - rosser 13y ago
    Based on previous rulings, the 5th Amendment doesn't apply because the State already has specific knowledge that this guy has child porn on an encrypted drive, through other means. That being the case, the act of decrypting the drive is no longer testimonial, as, by itself, it does not implicate him. If they merely believed really, really strongly that he has CP on an encrypted drive, then compelling its decryption would be testimonial, because the State would have knowledge (namely, that he possesses child porn) after the act of decryption that they did not have before it. That makes the act of decryption, itself, testimonial, and subject to 5th Amendment protection. EDIT: as has been noted else-thread, however, Wisconsin is in a different Federal Circuit than the aforementioned previous rulings, and so isn't bound by them.
    - cjhopman 13y ago
      My understanding is not that they have good evidence that there is CP on the encrypted drive, but rather that they have good evidence that the drive belongs to the guy and that he can decrypt it/has access to/knowledge of its contents. The idea about not having to give up a combination/password is that by doing so you would essentially be admitting ownership/access/knowledge about the contents that were protected by that combination/password.
    - mikeash 13y ago
      I don't really understand. If the contents of the drive don't implicate him in anything, why do they need him to decrypt it? If they implicate him in something, why doesn't the Fifth Amendment apply? Seems like these are the only two choices.
rmc 13y ago
Also, what if he forgot the password? IANAL but surely it would help to be able to prove that you've forgotten the password. If you use the same password (or small amount of password) for everything, and you can do it by muscle memory, then you probably haven't forgotten. If you can show a blog post you wrote 2 years ago explaining how you change your passwords every month, then you might be safer.
- jlgreco 13y ago
  How could you possibly prove that you have forgotten a password? Even being able to point to a rigorous password policy wouldn't really do it (and trivially few people would be able to do that much). Proving that you forgot your password, like other forms of "proving your innocence", is an absurd expectation. The prosecution should have to prove that you did not forget it, and if they cannot do that then tough shit.
- dbg31415 13y ago
  If you're technical enough to encrypt your drives, you are technical enough not to use the same passwords on everything. I couldn't tell you any of my passwords off the top of my head. They're all stored in password managers. Additionally, as someone else pointed out, it could be the case that the password he has expired and is no longer valid.
rayiner 13y ago
> On the political side, the government is cleverly eroding the right to privacy. Which right is implicated here? After all, you have no 4th amendment protection against the government forcing you to unlock your cellar if they have probable cause and a warrant. That has been the status quo for oh about 250 years now. The 11th Circuit has ruled that forcing a suspect to decrypt a hard drive implicates the 5th amendment right to not furnish self-incriminating testimony. However, that decision rests on a delicate characterization: that giving up the decryption key to a hard drive is testimonial in nature. After all, there is no 5th amendment protection against being forced to give up non-testimonial self-incriminating evidence (e.g. hair sample, or a key to your cellar). The 11th Circuit's decision rested on the fact that giving up a decryption key involved use of the mind, which made it testimonial in nature and made it more like forcing the suspect to tell you where the body is buried versus forcing him to give up a physical key. The Milwaukee court is of course not bound by the 11th Circuit decision, and in any case sitting on my armchair I can't say its decision is in any way inconsistent with precedent. Fact is, as a general rule you don't have the right to impede the collection of evidence pursuant to a valid warrant.
- maratd 13y ago
  > After all, you have no 4th amendment protection against the government forcing you to unlock your cellar Am I obligated to unlock it? I can't bar them entry since they have a valid search warrant, but am I under the obligation to facilitate it? In the case of the cellar, they can simply force their way in, but with an encrypted hard drive? They have no way of decrypting it without my help.
  - rayiner 13y ago
    Yes, the court can hold you in contempt for not giving them the key. See: http://scholar.google.com/scholar_case?case=13470186693193682219&q=487+U.S.+201&hl=en&as_sdt=2,33 http://scholar.google.com/scholar_case?case=1347018669319368... ("He may in some cases be forced to surrender a key to a strongbox containing incriminating documents, but I do not believe he can be compelled to reveal the combination to his wall safe — by word or deed.", Stevens dissenting).
cortesoft 13y ago
Also, has no one in this case heard of a hidden volume? (http://www.truecrypt.org/docs/?s=hidden-volume http://www.truecrypt.org/docs/?s=hidden-volume) Would they then claim he hadn't decrypted it properly if they didn't find what they were looking for?

wpietri 13y ago

I don't see an erosion here. Has the right to privacy ever allowed people to prevent access to something where there is probable cause to think there's evidence of a crime?

downandout 13y ago
He isn't "preventing access". He is merely remaining silent on the matter, and has not admitted ownership of the drives or knowledge of the contents or decryption key. It is important to note that the judge never held that forced decryption of drives he owns violates the fifth amendment; he simply held that, at the time of the government's request, there was no evidence that he actually owned and controlled the drives and their contents. The recent discovery of the data on the other drives convinced the judge that the drives do in fact belong to him, and as a result he is now OK with ordering the forced decryption. If you are doing bad things, you probably shouldn't use a decryption key that you could remember. Store that stuff elsewhere.
mikeash 13y ago
I think it's a wholly new situation. Previously, you couldn't be compelled to e.g. hand over the combination to a safe, but the police are free to just break into it, once they have a warrant. There's no "breaking into" cryptography, which sets it apart. In any case, I don't see how the Fifth Amendment wouldn't apply here. Maybe we'd prefer that people not be able to take refuge in it for this stuff, but that means amending the Constitution, not ignoring inconvenient parts of it.
- rosser 13y ago
  Based on previous rulings, the 5th Amendment doesn't apply because the State already has specific knowledge that this guy has child porn on an encrypted drive, through other means. That being the case, the act of decrypting the drive is no longer testimonial, as, by itself, it does not implicate him. If they merely believed really, really strongly that he has CP on an encrypted drive, then compelling its decryption would be testimonial, because the State would have knowledge (namely, that he possesses child porn) after the act of decryption that they did not have before it. That makes the act of decryption, itself, testimonial, and subject to 5th Amendment protection. EDIT: as has been noted else-thread, however, Wisconsin is in a different Federal Circuit than the aforementioned previous rulings, and so isn't bound by them.
  - cjhopman 13y ago
    My understanding is not that they have good evidence that there is CP on the encrypted drive, but rather that they have good evidence that the drive belongs to the guy and that he can decrypt it/has access to/knowledge of its contents. The idea about not having to give up a combination/password is that by doing so you would essentially be admitting ownership/access/knowledge about the contents that were protected by that combination/password.
  - mikeash 13y ago
    I don't really understand. If the contents of the drive don't implicate him in anything, why do they need him to decrypt it? If they implicate him in something, why doesn't the Fifth Amendment apply? Seems like these are the only two choices.

rmc 13y ago

Also, what if he forgot the password? IANAL but surely it would help to be able to prove that you've forgotten the password. If you use the same password (or small amount of password) for everything, and you can do it by muscle memory, then you probably haven't forgotten. If you can show a blog post you wrote 2 years ago explaining how you change your passwords every month, then you might be safer.

jlgreco 13y ago
How could you possibly prove that you have forgotten a password? Even being able to point to a rigorous password policy wouldn't really do it (and trivially few people would be able to do that much). Proving that you forgot your password, like other forms of "proving your innocence", is an absurd expectation. The prosecution should have to prove that you did not forget it, and if they cannot do that then tough shit.
dbg31415 13y ago
If you're technical enough to encrypt your drives, you are technical enough not to use the same passwords on everything. I couldn't tell you any of my passwords off the top of my head. They're all stored in password managers. Additionally, as someone else pointed out, it could be the case that the password he has expired and is no longer valid.

rayiner 13y ago

> On the political side, the government is cleverly eroding the right to privacy. Which right is implicated here? After all, you have no 4th amendment protection against the government forcing you to unlock your cellar if they have probable cause and a warrant. That has been the status quo for oh about 250 years now. The 11th Circuit has ruled that forcing a suspect to decrypt a hard drive implicates the 5th amendment right to not furnish self-incriminating testimony. However, that decision rests on a delicate characterization: that giving up the decryption key to a hard drive is testimonial in nature. After all, there is no 5th amendment protection against being forced to give up non-testimonial self-incriminating evidence (e.g. hair sample, or a key to your cellar). The 11th Circuit's decision rested on the fact that giving up a decryption key involved use of the mind, which made it testimonial in nature and made it more like forcing the suspect to tell you where the body is buried versus forcing him to give up a physical key. The Milwaukee court is of course not bound by the 11th Circuit decision, and in any case sitting on my armchair I can't say its decision is in any way inconsistent with precedent. Fact is, as a general rule you don't have the right to impede the collection of evidence pursuant to a valid warrant.

maratd 13y ago
> After all, you have no 4th amendment protection against the government forcing you to unlock your cellar Am I obligated to unlock it? I can't bar them entry since they have a valid search warrant, but am I under the obligation to facilitate it? In the case of the cellar, they can simply force their way in, but with an encrypted hard drive? They have no way of decrypting it without my help.
- rayiner 13y ago
  Yes, the court can hold you in contempt for not giving them the key. See: http://scholar.google.com/scholar_case?case=13470186693193682219&q=487+U.S.+201&hl=en&as_sdt=2,33 http://scholar.google.com/scholar_case?case=1347018669319368... ("He may in some cases be forced to surrender a key to a strongbox containing incriminating documents, but I do not believe he can be compelled to reveal the combination to his wall safe — by word or deed.", Stevens dissenting).

cortesoft 13y ago

Also, has no one in this case heard of a hidden volume? (http://www.truecrypt.org/docs/?s=hidden-volume http://www.truecrypt.org/docs/?s=hidden-volume) Would they then claim he hadn't decrypted it properly if they didn't find what they were looking for?