2 ms·

I don't like it. We had this long discussion on Slashdot when the first decision in favor of Defendant was delivered, where it should be considered wrong under

by yebyen 13y ago

I don't like it. We had this long discussion on Slashdot when the first decision in favor of Defendant was delivered, where it should be considered wrong under any circumstances to compel a person to testify against himself. The drive they decrypted has child porn and his personal files on it. How does that prove he was the one who encrypted it / put the CP on it? How does that prove anything about the remaining drives that they've not been able to decrypt? http://slashdot.org/comments.pl?sid=3681715&cid=43537739 http://slashdot.org/comments.pl?sid=3681715&cid=43537739 It seems like the only effect of this order would be to guarantee he's going to have either a guilty verdict or a contempt charge, even if it's a total frame-up and he never had the keys to begin with. If the FBI could really get into some of "his" encrypted files without any cooperation, who's to say that Frame-up Guy didn't also get into his (real) encrypted files, re-crypt the drive, and put incriminating evidence on it, next to some personal information to seal the deal? Who wrote the requirement such that he is required to access the drives only 'while the authorities turn their backs' -- what can be the actual value of that? He's being compelled to testify against himself. By either providing the keys or decrypting the drives, he would be proving that he was in (at least shared, not necessarily exclusive) control of their content. The FBI successfully decrypting the drives and finding CP does not prove anything additionally regarding the ownership. I understand it would be very hard to prove that much with the very high bar I'm setting, but I think it's justified.

Torgo 13y ago
I wrote a long post exploring it but then realized your frame-up statement was more interesting. If I wanted to extralegally grind somebody into the dirt, maybe what I would do is deposit an encrypted drive with a shitty password, some personal files of the defendant, and some illegal files. Then I would submit this as court's evidence and use it to compel him to decrypt a drive that was actually under his control that never in a million years could we crack without his help. If he doesn't cooperate, we can hold him for eternity under contempt of court. If this decision stands, it could be used by unscrupulous law enforcement to socially engineer the legal system into routing around self-incrimination prohibition. Obviously this requires fabricating and planting evidence against a defendant, but history has shown this happens. So, I'd say it's a serious risk if this ruling stands.
- yebyen 13y ago
  Yes, but on the other hand, what is an appropriate standard to prove stewardship or ownership of information on a drive? If you live alone, are a security professional, and maintain encrypted storage, it would seem to be completely impossible to prove that any information in your possession actually belonged to you as long as you were able to keep your keys private and secure throughout the investigation. If you ever slip up (it seems he did) and let some information leak (like leaving download/share logs with suspicious filenames on an un-encrypted drive), they can start to build a case against you. But if you don't confess, if they never obtain the keys from you, if they don't catch you in the act of accessing those files, it would seem to be an impossible standard of proof to meet. Then again we're talking about the law that bans possession of a piece of information, with no respect for mens rea or any sort of allowances for cases of accidental acquisition. People who find Child Porn on their own computers are best advised to delete it, since reporting it to the police will be a straight-up confession to illegal possession. It's right out of Fahrenheit 451. Have any artwork, we'll burn your house down. It could really be that it's just a bad law. I'm more torn, the more I have to think about it. I can tell you though, when I was in college and I discovered that my server had been hacked, was running out of disk as it was being filled with German Scheiße porn, I didn't look to see how long it had been there. I deleted it. Wiped all of the drives immediately. Could have easily been 0wned for months. With having 9 drives and 7 of them encrypted separately, I would imagine it's actually going to be pretty easy to lose track of which items are really yours in there. Especially when you don't actually believe that anyone else has even been in for a visit.

by yebyen 13y ago

Torgo 13y ago

I wrote a long post exploring it but then realized your frame-up statement was more interesting. If I wanted to extralegally grind somebody into the dirt, maybe what I would do is deposit an encrypted drive with a shitty password, some personal files of the defendant, and some illegal files. Then I would submit this as court's evidence and use it to compel him to decrypt a drive that was actually under his control that never in a million years could we crack without his help. If he doesn't cooperate, we can hold him for eternity under contempt of court. If this decision stands, it could be used by unscrupulous law enforcement to socially engineer the legal system into routing around self-incrimination prohibition. Obviously this requires fabricating and planting evidence against a defendant, but history has shown this happens. So, I'd say it's a serious risk if this ruling stands.

yebyen 13y ago
Yes, but on the other hand, what is an appropriate standard to prove stewardship or ownership of information on a drive? If you live alone, are a security professional, and maintain encrypted storage, it would seem to be completely impossible to prove that any information in your possession actually belonged to you as long as you were able to keep your keys private and secure throughout the investigation. If you ever slip up (it seems he did) and let some information leak (like leaving download/share logs with suspicious filenames on an un-encrypted drive), they can start to build a case against you. But if you don't confess, if they never obtain the keys from you, if they don't catch you in the act of accessing those files, it would seem to be an impossible standard of proof to meet. Then again we're talking about the law that bans possession of a piece of information, with no respect for mens rea or any sort of allowances for cases of accidental acquisition. People who find Child Porn on their own computers are best advised to delete it, since reporting it to the police will be a straight-up confession to illegal possession. It's right out of Fahrenheit 451. Have any artwork, we'll burn your house down. It could really be that it's just a bad law. I'm more torn, the more I have to think about it. I can tell you though, when I was in college and I discovered that my server had been hacked, was running out of disk as it was being filled with German Scheiße porn, I didn't look to see how long it had been there. I deleted it. Wiped all of the drives immediately. Could have easily been 0wned for months. With having 9 drives and 7 of them encrypted separately, I would imagine it's actually going to be pretty easy to lose track of which items are really yours in there. Especially when you don't actually believe that anyone else has even been in for a visit.