4 ms·

>the government can coerce you to give up your encryption keys just the same, no? No they can't. In general, such an act would be a breach of the Fifth Amendm

>the government can coerce you to give up your encryption keys just the same, no? No they can't. In general, such an act would be a breach of the Fifth Amendment protection against self-incrimination. You cannot claim similar protections for information that would get another person in trouble though. This is why Levison was risking a contempt charge by refusing to turn over evidence about someone else.

zzzeek 12y ago
OK, do you mean, I can be compelled to give up all my equipment via search warrant, but they have no legal means of making me tell them what my passphrase is? that would be an important distinction. Though at the same time, the government can just as well have covertly installed a keylogger on my system. Which may be illegal but it seems to be happening regardless.
- e12e 12y ago
  > [the US government] have no legal means of making me tell them what my passphrase is? Exactly. There was a lot of back and forth about legislation in the UK that basically considered it contempt of court (or worse: impeding an investigation) to not provide encryption keys/pass phrases. Problem was, the government didn't have to prove that you actually had (access to) the keys in question -- effectively being caught with a usb key filled with random data could get you a year in prison... If you think about it it's entirely unreasonable to demand encryption keys (to say nothing of how you would prove/disprove that the right keys have been provided, specially with stuff like hidden encryption partitions available...). At any rate the (technical) problem with lavabit was that lavabit could technically sabotage their product in such a was as to gain/give access to user data -- a secure system would not. The viability of both private (data) and private meta-data messaging have been debated a few times, but basically it's currently hard to beat regular email+gpg+mixmaster routing. And as long as we don't have secure "web" crypto, the situation won't change.
mikecb 12y ago
I just want to point out that, with respect to Fifth Am. protection for passwords and keys, there are at least two District Court decisions suggesting that giving up keys is non-testimonial, and one Circuit decision suggesting it is, so there may be a split on this issue sometime in the future that will end up at the Supreme Court.
- mpyne 12y ago
  Giving up keys about information otherwise already known to be on the computer is what's declared non-testimonial though. It would be like refusing to open a safe even though the cops have a video recording of every point in time from you putting a bloody knife in the safe to the present time; making you open the safe isn't what proves your association with the knife as the police already have that on video. How the courts interpret that kind of theory for computing will certainly be intriguing though.
  - mikecb 12y ago
    |Giving up keys about information otherwise already known to be on the computer is what's declared non-testimonial though. That was true of In Re Boucher and to a similar extent US v Kirschner, but in US v. Fricosu, the agents had not seen the contents of the computer, as the defendant claimed she couldn't remember the password. Obviously PC still has to exist that the thing to be found will be found on the computer, but in Fiscosu it was.
- IgorPartola 12y ago
  I believe you are correct and the grandparent is not. The fifth protects you from being coerced into saying "I did the crime", but not from cooperating with court orders. By you uttering your passphrase, you are not incriminating itself (a wise guy in the crowd will as "What if my password is 'IDidIt!'?" In that case, as I understand it, the jury would be told to disregard the actual phrasing of the passphrase and look only at what the passphrase (really the decryption key) unlock. In other words, yes this is exactly like refusing to open a safe. The only difference is that with a safe, if you no longer have the key, the law enforcement agencies can attempt other methods of opening the safe. If you lose your encryption key, nobody can prove that you actually lost it and are not just trying to hide it. In this case, it seems the judge will simply say that you are in contempt of court and will lock you up until your memory improves (as in indefinitely).
baddox 12y ago
> No they can't. In general, such an act would be a breach of the Fifth Amendment protection against self-incrimination. The first sentence doesn't follow from the second.
- dublinben 12y ago
  It most certainly does. Reread it.
  - hrjet 12y ago
    I think they were hinting at coercion.
  - baddox 12y ago
    The first sentence only follows from the second if you also assume that the government cannot do anything that you or someone perceives to be a violation of the Constitution.

zzzeek 12y ago

OK, do you mean, I can be compelled to give up all my equipment via search warrant, but they have no legal means of making me tell them what my passphrase is? that would be an important distinction. Though at the same time, the government can just as well have covertly installed a keylogger on my system. Which may be illegal but it seems to be happening regardless.

e12e 12y ago
> [the US government] have no legal means of making me tell them what my passphrase is? Exactly. There was a lot of back and forth about legislation in the UK that basically considered it contempt of court (or worse: impeding an investigation) to not provide encryption keys/pass phrases. Problem was, the government didn't have to prove that you actually had (access to) the keys in question -- effectively being caught with a usb key filled with random data could get you a year in prison... If you think about it it's entirely unreasonable to demand encryption keys (to say nothing of how you would prove/disprove that the right keys have been provided, specially with stuff like hidden encryption partitions available...). At any rate the (technical) problem with lavabit was that lavabit could technically sabotage their product in such a was as to gain/give access to user data -- a secure system would not. The viability of both private (data) and private meta-data messaging have been debated a few times, but basically it's currently hard to beat regular email+gpg+mixmaster routing. And as long as we don't have secure "web" crypto, the situation won't change.

mikecb 12y ago

I just want to point out that, with respect to Fifth Am. protection for passwords and keys, there are at least two District Court decisions suggesting that giving up keys is non-testimonial, and one Circuit decision suggesting it is, so there may be a split on this issue sometime in the future that will end up at the Supreme Court.

mpyne 12y ago
Giving up keys about information otherwise already known to be on the computer is what's declared non-testimonial though. It would be like refusing to open a safe even though the cops have a video recording of every point in time from you putting a bloody knife in the safe to the present time; making you open the safe isn't what proves your association with the knife as the police already have that on video. How the courts interpret that kind of theory for computing will certainly be intriguing though.
- mikecb 12y ago
  |Giving up keys about information otherwise already known to be on the computer is what's declared non-testimonial though. That was true of In Re Boucher and to a similar extent US v Kirschner, but in US v. Fricosu, the agents had not seen the contents of the computer, as the defendant claimed she couldn't remember the password. Obviously PC still has to exist that the thing to be found will be found on the computer, but in Fiscosu it was.
IgorPartola 12y ago
I believe you are correct and the grandparent is not. The fifth protects you from being coerced into saying "I did the crime", but not from cooperating with court orders. By you uttering your passphrase, you are not incriminating itself (a wise guy in the crowd will as "What if my password is 'IDidIt!'?" In that case, as I understand it, the jury would be told to disregard the actual phrasing of the passphrase and look only at what the passphrase (really the decryption key) unlock. In other words, yes this is exactly like refusing to open a safe. The only difference is that with a safe, if you no longer have the key, the law enforcement agencies can attempt other methods of opening the safe. If you lose your encryption key, nobody can prove that you actually lost it and are not just trying to hide it. In this case, it seems the judge will simply say that you are in contempt of court and will lock you up until your memory improves (as in indefinitely).

baddox 12y ago

> No they can't. In general, such an act would be a breach of the Fifth Amendment protection against self-incrimination. The first sentence doesn't follow from the second.

dublinben 12y ago
It most certainly does. Reread it.
- hrjet 12y ago
  I think they were hinting at coercion.
- baddox 12y ago
  The first sentence only follows from the second if you also assume that the government cannot do anything that you or someone perceives to be a violation of the Constitution.