US Judge Rules Defendant Can Be Forced To Decrypt Hard Drive 1047
A Commentor writes "Perhaps to balance the good news with the Supreme Court ruling on GPS, a judge in Colorado has ordered a defendant to decrypt her hard drive. The government doesn't have the capability to break the PGP encryption, and 'the Fifth Amendment is not implicated by requiring production of the unencrypted contents' of the defendant's computer."
Why we need plausible deniability encryption... (Score:5, Informative)
"I forgot."
Some disagreements in recent history (Score:5, Informative)
I find it funny that a quick search on the subject yielded an article from the same site, with the opposite finding.
Article in 2007: Judge: Man can't be forced to divulge encryption passphrase
http://news.cnet.com/8301-13578_3-9834495-38.html [cnet.com]
Article in 2012: Judge: Americans can be forced to decrypt their laptops
http://news.cnet.com/8301-31921_3-57364330-281/judge-americans-can-be-forced-to-decrypt-their-laptops/ [cnet.com]
I'm fine with them breaking your encryption if they have probable cause; however, forcing you to give the password does seem to have a pretty straight-forward logical path to incriminating yourself (Especially if you are guilty and a subsequent search will yield something on the device).
Re:Same as opening a safe. (Score:5, Informative)
Re:no 5th? (Score:5, Informative)
Re:no 5th? (Score:5, Informative)
Ah, but incriminating evidence of what? She might be completely innocent of what she's charged with but guilty of something else. In fact, she probably is, and so are you [wsj.com].
Re:Talk or else! (Score:5, Informative)
You've been reading this [xkcd.com] again, haven't you!
Re:Fake passphrase (Score:5, Informative)
"Prosecutors in this case have stressed that they don't actually require the passphrase itself, and today's order appears to permit Fricosu to type it in and unlock the files without anyone looking over her shoulder. They say they want only the decrypted data and are not demanding "the password to the drive, either orally or in written form."
So this quote makes me wonder, what encryption software is out there that can be configured with a "doomsday" passphrase that will automatically begin some sort of secure delete process when entered? Of course with a fancy "decryption in progress" dialog window or something?
I guess if they figure out what you did, you could be charged with destruction of evidence but if that is a lesser sentence than the wire fraud it wouldn't be a bad move.
I think one of the first things they do is make an image of your hard drive, preserving the data, no matter what you do to it. Much better to keep the key itself on destructible media and destroy it when the cops knock at your door. Or steganographically hide it in plain sight in the digital picture frame with your kid's pictures. Without the passphrase, they can't prove that a suitably random key exists in a JPG.
Re:Why we need plausible deniability encryption... (Score:5, Informative)
Nono, that defense is reserved for important people, don't be silly!
Re:no 5th? (Score:5, Informative)
What's the problem with this? If the prosecution knows the defendant owns a pistol and is accusing the defendant of robbing a liquor store with a pistol, the prosecution is certainly within its rights to subpoena the defendant to produce the pistol so it can be tested against the three slugs pulled out of the counter clerk.
The defendant can claim the pistol doesn't exist (in which case the prosecution has to be able to prove it does), the defendant can claim it was lost or stolen, or ... etc. There are a ton of ways to prevent turning over the pistol. However, none of these ways invalidate the central fact, which is that the subpoena is valid and enforceable: if the prosecution can demonstrate you have the pistol, the judge will happily put you in jail until you turn it over to the prosecution.
Re:USA (Score:2, Informative)
Horrible place filled with human scum.
No, that's Mos Eisley and it's on Tatooine.
Re:no 5th? (Score:5, Informative)
No risk of contempt (Score:4, Informative)
If she claims she cannot provide the password for whatever reason (or simply because she forgot) there is nothing they can do. Read the article, it even states that someone cannot be punished for something they cannot do.
They would need evidence she HAS the password at all.
Re:Some disagreements in recent history (Score:5, Informative)
The antitrust case [wikipedia.org] against Microsoft, for instance, was based largely on email correspondence that could well have been encrypted before the court ordered them disclosed -- and if such protection actually existed, would have certainly been encrypted if only to trigger that legal protection.
In fact, there are emails there that say, "Ooo, this might be getting murky, let's CC a lawyer, then it's protected by attorney-client privilege!" They didn't understand that you can't just invoke attorney-client privilege by including a lawyer in the conversation, you have to be actively seeking legal advice for your actions to gain privilege.
In the same way, priest-confessor privilege is only protected as long as you're seeking penitence. If you confess a crime to a priest with no intent to seek spiritual absolution (say, in the lunch line), then the priest is perfectly allowed to divulge and even be forced to divulge your confession.
Re:no 5th? (Score:5, Informative)
Re:so take the next step (Score:5, Informative)
destruction of a key is not destruction of evidence. The evidence is still intact - just encrypted.
Re:Am glad that I ain't American !! (Score:5, Informative)
England already has laws that force suspects to decrypt their hard drives... but maybe you were ironically referring to that?
Re:no 5th? (Score:4, Informative)
In court you are required to tell the truth aren't you?
Only while under oath. You are not required to tell the truth during a police investigation, but any lie that you tell them can impeach your credibility later in court. And since sometimes you telling the truth can be impeached by the testimony of another person, your credibility can be damaged in court later regardless of the truth of your statements... so don't talk to the police except to demand a lawyer.
So if you lie about robbing the store but later confess and plead guilty, can they get you for lying in a court of law too??
Only if you testify in court that you did not rob the store. But perjury can actually be somewhat difficult to prove, so normally as part of a confession and guilty plea, you would get a pass for any false statements you made already.
Re:2-key Encryption? (Score:5, Informative)
You are aware that the first thing they do is to create a copy of the files. Actually, an image of the file system.
The very first thing you do in forensics is to create an image. Standard procedure. A bit for bit identical duplicate. Destroy it all you want, the only thing you accomplish is to piss me off because I have to repeat that procedure.
Re:no 5th? (Score:5, Informative)
The argument goes like this:
You can't be forced to testify against yourself. You can be forced to provide evidence that may incriminate you - that's the whole point of a warrant.
So it's something you know, vs something you have.
So if you had a smartcard to unlock encrypted data, you could be forced to hand it over, same as a safe key.
So what if it's something you know that is the key, like the passphrase or combination to the safe?
Well, as long as the passphrase or combination in itself is not incriminating (i.e. they don't open something you don't own) then it's treated as evidence, not testimony.
If you claim you've forgotten it, and the judge thinks you're lying, then you can be found in contempt of court until you remember, for withholding evidence.
I'm not saying its fair, but it is consistent with prior law and practise.
Re:Pesky constitution (Score:5, Informative)
so remind us all how PATRIOT got passed??
I didn't say that unconstitutional statutory law cannot be passed. I said that it cannot overrule the constitution, and thus is null and void. ... I'm going to note here as well, that doesn't mean that the executive won't enforce an unconstitutional statutory law either, but you're perfectly within your first amendment rights to petition for a redress of your grievance with the courts.
For instance, Rosa Parks committed a crime by not sitting at the back of the bus. She was arrested and sent to jail. Civil disobedience is one of the fastest ways to get a legal argument for unconstitutionality before the court, but it does not come free, and it does not exempt you from suffering as a result of breaking the law. However, if the courts do eventually agree with you, you can seek compensation for being punished for violating a law that was null and void. But you will still have to suffer harm at first.
Re:2-key Encryption? (Score:5, Informative)
This has been talked about on the TrueCrypt forums ad nauseum: A suggestion that the utility has a password that would erase volumes.
First, it is part of forensic practice to whip out a hardware write blocker. No hardware write blocker, and the evidence can be thrown out of court.
So, if someone hands a decent forensic analyzer a key, and it zaps the contents of the image, they just roll back the logs, add a destruction of evidence charge.
Re:Why we need plausible deniability encryption... (Score:4, Informative)
That rarely happens, at least in the United States.
And even if it does, in many cases you will be in a better facility than a maximum-security prison, depending on the state and the crime you are accused of. You will likely eventually be released, and you will have not been convicted of the crime, therefore retaining your civil rights (if you were accused of a felony).
That, or eventually they crack the crypto.
Apparently you haven't been in a family court lately. In Missouri as a case in point, you have *no right to appeal any contempt ruling*. Meaning, not only will you sit in jail indefinitely in a nasty county lockup facility, you will have no means to free yourself from a wrongful contempt charge. In addition to which, our wonderful Missouri law adds the extra kicker of "No other judge may remove, nor revoke the contempt order of another".
Re:no 5th? (Score:5, Informative)
"The 5th amendment does not protect you from being required to provide subpoenaed materials. It just means you dont have to testify or speak..."
Very definitely incorrect. I looked into this when I first read about the second court case mentioned in TFA. The one about the guy at the border who had child pornography on his computer. TFA gives a woefully incomplete account of that case; there is almost no chance that it is anything like this one at all.
The court ruled that he had to provide the password to an encrypted area on his hard drive, because Customs had already seen some child pornography on his computer, in the encrypted portion of the drive. The decryption software was running at the time, so these files were open and 2 Customs agents were able to see them. But somehow the man then managed to turn off the computer so the files could no longer be accessed.
The key thing here is that the court did not want the password in order to perform a SEARCH. It was already known that there was illegal material there. That is a FAR different situation.
In its ruling, the court made this point very clearly: the government normally cannot force someone to provide an encryption password, in order to SEARCH for items or material that are only SUSPECTED to be there. That would constitute a clear violation of the 5th Amendment.
However, in that particular (and really very unusual) case, the government already knew that there was illegal material, and even where it was. And the court wanted that material for the trial. There could be no violation of the 5th Amendment in that particular situation the court ruled, because it amounted to seizing illegal materials that were already known to be there. Therefore it was not a "search" in any reasonable sense of the term, and the defendant was not supplying anything incriminating that was not already known. He was not "testifying against himself" in other words.
Other courts have made this VERY clear: except under very unusual circumstances, rendering your password up to authorities is most definitely "testifying against yourself", and falls under the 5th Amendment. They cannot demand that information in order to search for evidence that might incriminate you.
When I mentioned all this earlier, when this post still hadn't appeared yet, somebody (sjames) replied that this was "sophistry", to use his word, and that if the court really "knew" it was there, they would not have required that it be supplied to the court.
However, that in itself is sophistry. Apparently he was forgetting several things: (1) As long as the court is not violating the 5th amendment (and in THAT rare case it was not), it can order the material to be presented for pretty much any damned reason it pleases. I did not say it was "needed" by the court to obtain a conviction; I simply stated that it was ordered to be given up. (2) Considering that the court already had consistent and concurring testimony from 2 Customs agents, if they had committed perjury it would have been ridiculously easy to very that without much compromising the defendant's privacy, and any further intrusion could be immediately ended. So there was little danger to the defendant's rights. And most importantly, (3) I wasn't asking sjames to take my word for it; he can look up the damned court decision himself on Google, just like I did, and read about it for himself.
Re:Let's hope he gets extradited, he'll be better (Score:3, Informative)
Nobody ever points out that democrat-appointed judges blocked the repeal of slavery for decades
And fucktards like you forget that the Dixiecrat judges left the Democrat Party in the 1960s and were welcomed into the modern racist GOP with open arms.
Saying that "Republicans" today are what they were over 50 years ago is a plain lie.
Re:no 5th? (Score:4, Informative)
True but easily worked around - the prosecution can only make a point of what you failed to say "under questioning". That doesn't mean when an officer asks you questions on the street - it means when you're in a custody suite being recorded.
If you ask for legal counsel they are not allowed to ask you any questions until you've spoken to a lawyer. If the first thing you do is ask for a lawyer they can't ask you questions and what you DON'T tell them cannot be used against you.
When you do see a lawyer you only have to get them to agree to some vague statement like "should I try not to say more than I have too". Then you can answer any questions with "On legal advice I decline to answer".
What is the prosecutor then going to do:
Prosecutor: "So Mr Sixpack, why did you fail to mention this to the police when you were questioned?"
Mr Sixpack: "My lawyer told me not to say anything".
Prosecutor: " . . . "
Re:Talk or else! (Score:4, Informative)
Actually, the defendant is specifically not being asked to talk (verbally give up her password). That would be a 5th amendment violation. She is also not being asked to write it out, which would again be a 5th amendment violation. She is, however, being asked to type it into the computer, without being watched. That is not a 5th amendment violation as she is not being required to actually divulge the password.
At least that is the argument. Basically, it is treating an encrypted hard drive like a safe. You can be forced to divulge the combination of a safe, but you can be required to open it yourself. The password is being treated like the combination. She can't be forced to divulge it, but can be compelled to enter into the system.
Re:Let's hope he gets extradited, he'll be better (Score:2, Informative)
Bullshit - the police are the initial arm of "evidence gathering" for prosecutors, a set of conscienceless, amoral assholes who see all citizens as nothing more than a potential conviction notch in their belts.
That is a gross over-generalization. As someone who has known many police officers personally, I can honestly say that not one of them would ever consider doing something like the things you just described. They were each made of the highest moral fiber and held themselves to the highest ethical standards, oftentimes going well beyond their duties in helping the people they encountered while on the job.
Do the sorts of officers you describe exist? Absolutely! Should people take the precautions you encourage? Certainly! But to suggest that all officers are like that is hyperbole at its worst, and it unjustly maligns the good officers who make up a large percentage of the police forces out there.
Coincidentally, I'm currently living in Texas and have a police officer friend here as well.
Re:Let's hope he gets extradited, he'll be better (Score:4, Informative)
The issue with maintaining two volumes is that each will report lower capacities than the total drive capacity reported through the BIOS or via the label on the drive
This is not how secret volumes work. For one thing, both volumes look like randomized data since everything is encrypted. You can only examine them if you have the decryption key. With the decryption key, both volumes will report their size as the entire allocated space. The primary volume writes data start->end, while the secondary (secret) volume writes end<-start.
For example if you encrypted a 20GB physical drive, both volumes report that they are 20GB. Indeed if you write 20GB of data to either volume, you will OVERWRITE the alternate volume. It's up to you to know how much data you have on each volume and be careful not to write enough data so that the sum of both volumes exceeds the total volume size. You can mount both volumes at the same time, and the encryption software will reject writes to either volume which would overwrite data on the alternate volume.
Re:Talk or else! (Score:4, Informative)
You think "I judge Robert Blackburn is stabbed repeatedly" is correct grammar?
I judge your skill with the English language is somewhat deficient
I judge your skill with English to be somewhat deficient.