Slashdot Log In
Encryption Passphrase Protected by the 5th Amendment
Posted by
CmdrTaco
on Sat Dec 15, 2007 01:46 PM
from the my-password-is-password dept.
from the my-password-is-password dept.
Takichi writes "A federal judge in Vermont has ruled that prosecutors can't force the defendant to divulge his PGP passphrase. The ruling was given on the basis that the passphrase is protected under the 5th amendment to the United States Constitution (protection against self-incrimination)." The question comes down to, is your password the contents of your brain, or the keys to a safe.
Related Stories
[+]
Examining the Search and Seizure of Electronics at Airports 699 comments
Angus McKraken brings us a Washington Post story about how travelers are seeking more well-defined policies and rules about the search and seizure of electronic devices by U.S. Customs officials. The EFF has already taken legal action over similar concerns. We recently discussed the related issue of requiring people to disclose their passwords in order to search their private data. From the Post:
"Maria Udy, a marketing executive with a global travel management firm in Bethesda, said her company laptop was seized by a federal agent as she was flying from Dulles International Airport to London in December 2006. Udy, a British citizen, said the agent told her he had 'a security concern' with her. 'I was basically given the option of handing over my laptop or not getting on that flight,' she said. 'I was assured that my laptop would be given back to me in 10 or 15 days,' said Udy, who continues to fly into and out of the United States. She said the federal agent copied her log-on and password, and asked her to show him a recent document and how she gains access to Microsoft Word. She was asked to pull up her e-mail but could not because of lack of Internet access. With ACTE's help, she pressed for relief. More than a year later, Udy has received neither her laptop nor an explanation."
[+]
News: Judge Rules Man Cannot Be Forced To Decrypt HD 775 comments
I Don't Believe in Imaginary Property writes "In Vermont, US Magistrate Judge Jerome Niedermeier has ruled that forcing someone to divulge the password to decrypt their hard drive violates the 5th Amendment. Border guards testify that they saw child pornography on the defendant's laptop when the PC was on, but they made the mistake of turning it off and were unable to access it again because the drive was protected by PGP. Although prosecutors offered many ways to get around the 5th Amendment protections, the Judge would have none of that and quashed the grand jury subpoena requesting the defendant's PGP passphrase. A conviction is still likely because prosecutors have the testimony of the two border guards who saw the drive while it was open." The article stresses the potential importance of this ruling (which was issued last November but went unnoticed until now): "Especially if this ruling is appealed, US v. Boucher could become a landmark case. The question of whether a criminal defendant can be legally compelled to cough up his encryption passphrase remains an unsettled one, with law review articles for the last decade arguing the merits of either approach."
Update: 08/19 23:49 GMT by KD : Several readers have pointed out that this story in fact did not go unnoticed.
Update: 08/19 23:49 GMT by KD : Several readers have pointed out that this story in fact did not go unnoticed.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
But but but! (Score:4, Insightful)
Re:But but but! (Score:5, Funny)
Liberals!
Parent
Re: (Score:3, Funny)
Oh shit, did I say that out loud?
If not anything else... (Score:5, Insightful)
Re:If not anything else... (Score:4, Insightful)
Parent
Re:If not anything else... (Score:5, Funny)
Parent
Re:If not anything else... (Score:4, Interesting)
Hmm, that brings the question, did we waterboard Gonzales? If not, why not?
Parent
Re:If not anything else... (Score:4, Insightful)
Parent
Re:If not anything else... (Score:5, Funny)
Parent
Re:If not anything else... (Score:4, Funny)
Parent
Interesting development (Score:5, Interesting)
Hmmm....
Re: (Score:3, Insightful)
Hmmm....
Well the government of Vermont can't at least.
Re:Interesting development (Score:5, Insightful)
Hmmm....
Well the government of Vermont can't at least.
It was a Federal judge.
It was also probably not worth bothering the NSA with. I wouldn't take this to mean much of anything about how quickly the Feds can crack PGP.
Parent
Re:Interesting development (Score:5, Informative)
No, it doesn't tell you the second. If the government has the knowledge required to break the ciphers used by PGP, they would be very unlikely to reveal that for something as unimportant as this court case.
Personally, I strongly doubt that the NSA can break PGP, but this decision doesn't say anything one way or the other about the question.
Parent
Re:Interesting development (Score:5, Insightful)
Parent
Re:Interesting development (Score:5, Insightful)
If there is anything that you should have learned from reading all of those articles about quantum computing, is that it's friggin HARD. Any quantum device complicated enough to even be remotely useful in breaking encryption is many decades away. This is because it will take centuries of man hours and armies of graduate students in multiple fields to crack this nut. There still need to be tens of thousands of PhD's written on related topics before you can even dream of starting construction.
In order to have a secret working quantum computer, the US government would have had to have been actively working on the technology since long before traditional silicon computing took hold... hell, long before the idea of quantum computing for decryption even tickled our imaginations. They would have had to independently train a clandestine army of engineers and physicists that far outclassed our brightest minds in academia. These people would have had to replicate ALL of our modern advances decades earlier (which, btw. is not apparent from any other military technology). The resources required for a project like this are simply staggaring, and I estimate that the financial costs would have EASILY been in the trillions of dollars.
We certainly do spend enormous amounts of capital on military R&D in the USA, and there are many important technologies where the military is years ahead of commercial efforts. However from numerous projects that have bee declassified over the years, this advantage usually only involves the effective weaponization / improvement of currently existing/proven technologies. The military is only ahead in the little details of practical implementations, and not the fundamental scientific principles. In short, claiming the existence of some secret quantum computer is akin to claiming the US military had Joint Strike Fighters before the Wright brothers even made their first flight.
Parent
Re:Interesting development (Score:5, Insightful)
In case you still have no concept of how big this number is, there are estimated to be around 10^80 atoms in the universe, which is around 2^266. That means that each of your four billion computers is having try 2^1740 keys for every atom in the universe.
To put it another way: Let's assume each of your four billion computers is a few orders of magnitude faster than anything I know of and can try four billion keys a second, giving you a total of around 2^64 keys tried per second. This means you can do around 2^76 per day. At this rate (and don't forget that we are assuming that you have almost as many computers that are orders of magnitude faster than anything real as there are people in the world) it will take you 2^1972 days to do an exhaustive search (although on average it will only take you 2^1971 days to find the key). For those following at home, that's around 2^1962 years. For reference, the universe is approximately 13.7 billion years old, which is a shade under 2^34 years.
In summary, if every atom in the universe was a computer that ran orders of magnitude faster than anything we can build today, and it ran for the life of the universe to date, you would not be able to crack a single 2048-bit message. If, however, you have a quantum computer, then you might be able to.
Parent
Re:Better use of a botnet? (Score:5, Interesting)
What a lot of people fail to realise is that encryption can be made unbreakable even by brute force by simply choosing a large enough encryption key. What people also fail to realise is that 256 bit encryption doesn't take twice as long to crack as 128 bit encryption. It in fact takes 2^128 times as long to crack.
Let's for a second assume that 128 bit encryption is crackable by your own personal home computer in a period of 1 hour.
136 bit encryption would take 2^8 times as long (250 times as long)... so we use 250 computers, and crack it in 1 hour still.
144 bit encryption takes again 250 times as long, so instead we use 250 superpowerful server computers and crack it in 1 hour.
156 bit encryption takes another 250 times longer, so we use a top-secret government super computer the size of the Pentagon and still crack it in 1 hour.
164 bit encryption takes.. you guess it, 250 times longer to crack. All the governments in the world pool their top-secret super computers and crack your content in.. 1 hour.
172 bit encryption takes 250 times longer to crack. We use all the computers on the entire planet and manage to crack it in 1 hour.
180 bit encryption takes 250 times longer to crack. We use all those computers, but let them run 250 hours (10 days) instead.
188 bit encryption takes 250 times longer to crack. We let those computers run 6 years to crack your password.
192 bit encryption takes 250 times longer to crack... never mind, we're not THAT interested in your personal photo album.
Parent
Sad state. (Score:3, Interesting)
It's a sad sad day in America that the truth of the 5th ammendment and the constitution itself is even called into question in this way. Thanks to the judge who supported the constitution, unfortunately there are laws shredding it up as we read this news.
http://www.govtrack.us/congress/bill.xpd?bill=h110-1955 [govtrack.us]
Welcome to the police state.
Re: (Score:3, Insightful)
A good ruling but... (Score:4, Interesting)
Plausible deniability (Score:5, Interesting)
Re:Plausible deniability (Score:4, Informative)
Q: Is it possible to use TrueCrypt without leaving any 'traces' on Windows?
A: Yes. This can be achieved by running TrueCrypt in traveller mode under BartPE. BartPE stands for "Bart's Preinstalled Environment", which is essentially the Windows operating system prepared in a way that it can be entirely stored on and booted from a CD/DVD (registry, temporary files, etc., are stored in RAM - hard disk is not used at all and does not even have to be present). The freeware Bart's PE Builder can transform a Windows XP installation CD into BartPE. As of TrueCrypt 3.1, you do not need any TrueCrypt plug-in for BartPE. Simply boot BartPE, download the latest version of TrueCrypt to the RAM disk (which BartPE creates), extract the downloaded archive to the RAM disk, and run the file 'TrueCrypt.exe' from the folder 'Setup Files' on the RAM disk (the 'Setup Files' folder should be created when you unpack the archive containing TrueCrypt).
Parent
write up at Volokh, by guys who are lawyers (Score:5, Insightful)
This case is a very interesting overlap between 4th Amendment "right to privacy" cases and 5th Amendment "right not to self-incriminate" cases. I personally think that if the government can't break the encryption to "prove" what is hidden from them, they have no right to force the owner to do their work for them. People have a right to keep stuff private, and if they've hidden it effectively, then tough shit for the cops.
I acknowledge that child porn is inherently harmful to the children involved, and that laws targeting possession of child porn are therefore valid so far as they aim to protect children by destroying the market for the exploitative and harmful material. And there is no first-amendment protection for child porn. But the cops still can't break into your house without a warrant just because they they think you have pictures of naked kids inside, and they can't wiretap your internet connection without a court order (heh, they can't LEGALLY, even though it's probably going on right now OMGHI2NSA). Those are 4th amendment rights. But the 5th amendment kicks in to say that even with a court order and a valid warrant, the cops in your house can't force you to tell them which floorboard is the loose one with the bloody knife hidden under it. If you refuse to tell them, they have to find it on their own-- and if they can't find it, they can't use it as evidence against you. That's exactly how the 5th amendment is supposed to work.
A police force with the power to compel self-incriminating testimony becomes the enemy of any citizen who wishes to lawfully express dissent with any policy of government. The 5th Amendment is the most powerful safeguard citizens have against confessions extracted via torture finding purchase in US courts.
From the decision itself (lifted from that post at Volokh Conspiracy), bolded emphasis is mine:
Horrible case law (Score:3, Interesting)
Encryption keeps getting easier and easier to use - someday my job wont be possible without good case law forcing defendants to give up encryption keys. The only other option is to step up the use of no-knock search warrants and live acquisition. Problem is... when a daughter accuses her step-dad of molesting her and taking pictures - there is usually a family fight long before law enforcement gets involved. This leaves the subject days to encrypt and clean any evidence he has.
I know that most people think that the police go around taking peoples' machines without any cause but I can tell you from my experiences (and the experiences of everybody else I've run into in this field) we don't go around looking for new cases. We are completely understaffed, under-budgeted, and flooded with horrible crimes. Plus, its not easy to get a search warrant. You need to satisfy probable cause in order for the judge to sign off on your warrant.
Re:Horrible case law (Score:5, Interesting)
But as a society, we place a higher priority in personal liberty than on catching the maximum number of criminals. There are states that invert these two concepts: we call them "police states". I, for one, would rather live in a society where a few guilty people walk free because we can't crack their encryption than live in one where I can hide nothing from the government. It's a question of priorities.
Parent
Re:Horrible case law (Score:5, Interesting)
Unfortunately this situation is becoming more and more common in the practice of law today. For example, imprisoning someone for "contempt" is unjust. Where is the accused's right to a trial? There is none. What about appeals? There are none, you are in jail until you grovel enough to satisfy judge. No evidence...no trial...just the judge's opinion. God forbid you ever have to stand in front of a judge who decides to grind his ax on your ass.
Back about 40-50 years ago, law enforcement and prosecutors could be held liable for misconduct. Then came the so called "shield" laws, which gave immunity to prosecutors and law enforcement in the event of misconduct. We are finally seeing the result of these 'fine' laws; Convictions being overturned because of fabricated evidence, withheld evidence, and tampering of witnesses by officers of the court. Peoples lives are being ruined because some court officers feel it is more important to get a conviction at all costs, instead of by the weight of the evidence. These 'shield' laws protect the wrong doer from any kind of repercussion. Nifong, of the Duke rape case infamy, is an exception to this, mostly because he was so vocal about the case, calling national attention to the case. However, while his career is in shambles, he has yet to pay any restitution to the boys he so vehemently accused, or face perjury charges for the false claims he made in court.
All in all, there are a lot of reasons to keep government out of the personal affairs of it people.
Parent
The spirit of the 5th amendment (Score:5, Insightful)
I always thought the 5th amendment served two main purposes:
1. Prevent the government from compelling individuals to confess (through torture, or other means).
2. Give weight to confessions by ensuring that they were not obtained through torture.
Perhaps it will be illustrative to take the computer out of it, since we tend to get distracted by the technology. To me it seems pretty clear that if someone is arrested carrying a letter that was encoded with a cipher with information that may or may not be relevant to the case, that the person could not be compelled under law to explain how to decrypt the letter, whether to law enforcement or in court. Of course that couldn't stop the officials from attempting to break the cipher. But just because modern encryption is more difficult to crack than a hand cipher, I don't believe that changes the nature of the situation.
There's a bit more to it (Score:4, Interesting)
People who actually forget their passwords (Score:4, Insightful)
What if someone actually did forged their long, complicated pass phrase? In that case, prosecutors would be trying to force someone to divulge a passphase that they don't even know.
On several occasions, I have briefly played around with encryption programs and made an extra copy of unimportant stuff and then encrypted it. Since it was usually just for practice, I did not always bother writing the passphrase down on the sheet of paper which lists all my passwords and passphrases. I may have not always got around to deleting those encrypted practice files and they may still exist somewhere on one of my old hard disks or on a USB key or somewhere or in the box of CDs that I have burned. I would have no idea what the password or passphrase was for those old practice encryption files.
I could easily imagine some prosecutor putting me in jail for not being able to come up with a passphrase to some old encrypted practice file. Then eventually, after getting out of jail, perhaps I would eventually find the passphrase on some old scrap of paper and they would discover that it was just an encrypted folder full of dozens of free 80 year old Gutenberg.net ebooks.
A person, such as myself, who has have never actually bothered to use encryption on a routine daily basis, would someone who is most likely to forget their passphrase. Perhaps I should dispose of all my old hard disks or wipe all the data with Darik's Boot and Nuke [sourceforge.net] Of course, if there were indications that someone has recently used their encrypted partition, folders or files recently, that would be different. A recent time stamp on the file or folder would be one such clue.
Re:I was wondering... (Score:5, Informative)
If the subpoena is requesting production of the files in drive Z, the foregone conclusion doctrine does not apply. While the government has seen some of the files on drive Z, it has not viewed all or even most of them. While the government may know of the existence and location of the files it has previously viewed, it does not know of the existence of other files on drive Z that may contain incriminating material. By compelling entry of the password the government would be compelling production of all the files on drive Z, both known and unknown.
By giving the government his password, the judge held, that the defendant was incriminating himself by opening up all of his files that weren't pertinent to the investigation. That was my take on it. *I am not a lawyer, but I scored high on critical reading on the SAT's, for what it's worth.
Parent
Re:I was wondering... (Score:5, Insightful)
Quite the opposite. By giving the password the defendant may incriminate himself by opening files containing incriminating (and pertinent) information, but unknown to the government prior to that.
Parent
Re:I was wondering... (Score:5, Insightful)
Thank God...FINALLY, a score for US privacy rights...and upholding our Constitutional rights!!!
You just don't see that much any more.....
Parent
Re: (Score:3, Informative)
Uhh ... no (Score:5, Informative)
Article. V.
The Congress, whenever two thirds of both Houses shall deem it necessary, shall propose Amendments to this Constitution, or, on the Application of the Legislatures of two thirds of the several States, shall call a Convention for proposing Amendments, which, in either Case, shall be valid to all Intents and Purposes, as Part of this Constitution, when ratified by the Legislatures of three fourths of the several States, or by Conventions in three fourths thereof, as the one or the other Mode of Ratification may be proposed by the Congress; Provided that no Amendment which may be made prior to the Year One thousand eight hundred and eight shall in any Manner affect the first and fourth Clauses in the Ninth Section of the first Article; and that no State, without its Consent, shall be deprived of its equal Suffrage in the Senate.
How the hell did the parent post get a +5 informative of all things?!
Parent
Re:Wanna bet? (Score:5, Funny)
Parent
Re:I was wondering... (Score:5, Funny)
Now if that isn't proof i don't know what is!
Parent
Re: (Score:3, Insightful)
You're saying "he can't be made to release incriminating files that are nothing to do with the case", while the poster you're replying to is saying "he can't be made to release incriminating files even if they are related to the case".
Re: (Score:3, Informative)
That's exactly right. As far as I understand, the main concern is that by opening the disk he would potentially give the government access to the incriminating files not seen by the customs agents.
Re:I was wondering... (Score:5, Interesting)
Basically, if you have the right to not incriminate yourself, then they can't force you to "confess". And if it happens, then any convictions should be turned over by a higher courts assuming that things go according to plan. This also carries the problem of blocking a criminal investigation but the necessity of not being forced to confess out ways the setback to criminal investigations. Many people support this idea if not simply because they don't want the cops showing up at their front door demanding you to tell them something you did that was illegal and later claiming it was part of an investigation.
As for me, I think it is a necessary evil that protects people in many ways above any benefit from a criminal investigation. If there is sufficient cause for the criminal investigation, then there will be other evidence outside that aspect that will eventually show up if it isn't already there.
One way they get around the 5th amendment is to grant immunity from prosecution for anything found or disclosed which seems to have the same effect of the 5th amendment. Something like that would be useful in convicting others involved by letting one person escape justice.
Parent
Re:I was wondering... (Score:4, Interesting)
Here they are saying that he has files that they know nothing about. Because those files are unknown, he is protected from having to provide them.
Thinking about it, I'm surprised that we haven't heard of cases getting thrown out because of computer evidence collected outside of the scope of any search warrant poisoning too much of the subsequent evidence. I could imagine a warrant to look on your computer for a warez program they think you have turning up an ssh known_hosts file entry for a warez server. Since they weren't looking for that evidence (maybe because they thought the computer had not been networked, or was not involved in warez transmission, just storage) then they can't use it, and if they then go hunting the logs of that remote server to find the connection that can't be used either because it was evidence they only knew to look for because of evidence they weren't allowed to have anyway. And because you can't un-know information once you have tainted evidence you have to show that any subsequently gathered evidence did not come from knowledge of that evidence or at least would have eventually been discovered by other means.
However I must offer the following disclaimer: I am not a lawyer (nor do I do anal like so many of you non-lawyers), but I have watched a lot of Law & Order. Disclaimer: Not being a lawyer, much
Parent
Re:I was wondering... (Score:5, Insightful)
You advocate punishing people for not confessing a crime?
Get a grip.
Parent
Re:I was wondering... (Score:4, Insightful)
So if they can be compelled to testify against themselves, what methods
are appropriate for that? Nothing life-threatening, surely, but perhaps a bit
of waterboarding is in order?
Parent
Re:I was wondering... (Score:4, Insightful)
If the warrant is to gain access to, for example "the twelve pornographic photographs known to be in the safe" that does not allow the investigators to also review the contents of all the accounting books also in the safe.
Since the original officers who looked at the images probably have no idea which files they were, I suspect that they will rifle through EVERYTHING in that drive if they had the opportunity, just to make sure they found the ones he saw.
By doing so they will likely find other things that may pose a problem to the owner of the drive the government now possesses, and US law has always said that one can't be made to incriminate themselves.
Very picky points, but in this case I actually think the judge may be right within very narrow confines.
(If the original investigator can remember the actual file names/paths, I suspect the defense could be asked to product THOSE files, but lacking that...)
--
Tomas
Parent
Re:I was wondering... (Score:5, Insightful)
This is so painfully obvious that I'm somewhat concerned that it took so long for a judge to rule in this manner. On the other hand I am relieved it has finally happened.
Parent
Re:I was wondering... (Score:4, Insightful)
Parent
Re:I was wondering... (Score:5, Informative)
But I'm nice and I found it an interesting read, so I will summarize it. There are a great many of cases involving what and when the government can force someone to turn over documents. Generally, things which don't represent what's in your mind can be forced over. An example would be a key to a lock as compared to a combination lock. The former exists, and is known to exist, and the latter's turnover requires the suspect to devolve information contained within his mind, which would be tantamount to testifying.
In this case, there is some splitting of legal hairs, and my description will be less than sound. While IANAL, I am marrying one
As I already rambled here, the government argues that they knew of the files, and that they had already seen the files. As such, the defendant needed to turn over the password. Something similar has been done previously, where the government knew that a suspect had a document in his possession,and the court forced its turnover. In this case, however, the judge unacknowledged that the prosecution has seen only a small number of the files on the encrypted drive, and that they were almost certainly incriminating. As such, the judge decided that he couldn't order the defendant to turn over the password as the governmetn would have access to new files it knew nothing about.
So, the lesson here is to just not talk to the police without your lawyer present, and don't fricking enter passwords to your files without a court order.
Parent
Re: (Score:3, Insightful)
Just like any other serious crime the police should be investigating it correctly and building a case without needing to look around the suspects' house first.
Re: (Score:3, Insightful)
In certain circumstances... (Score:3, Informative)