Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×
Government Privacy The Courts United States Your Rights Online

Phone Passwords Protected By 5th Amendment, Says Federal Court 178

Ars Technica reports that a Federal court in Pennsylvania ruled Wednesday that the Fifth Amendment protects from compelled disclosure the passwords that two insider-trading suspects used on their mobile phones. In this case, the SEC is investigating two former Capital One data analysts who allegedly used insider information associated with their jobs to trade stocks—in this case, a $150,000 investment allegedly turned into $2.8 million. Regulators suspect the mobile devices are holding evidence of insider trading and demanded that the two turn over their passcodes. However, the court ruled, "Since the passcodes to Defendants' work-issued smartphones are not corporate records, the act of producing their personal passcodes is testimonial in nature and Defendants properly invoke their fifth Amendment privilege."
This discussion has been archived. No new comments can be posted.

Phone Passwords Protected By 5th Amendment, Says Federal Court

Comments Filter:
  • A sudden breakout (Score:5, Insightful)

    by fishscene ( 3662081 ) on Thursday September 24, 2015 @04:33PM (#50592421)
    ...of common sense no doubt! I love hearing stories of correct implementations.
    • by CaptainLard ( 1902452 ) on Thursday September 24, 2015 @04:56PM (#50592583)

      Well of course. All we needed was for data privacy to impact a bank employee.

      In other news, of all the financial improprieties why did the SEC end up being so good (apparently) at catching insider trading? Is it the crime that least rocks the boat?

    • ...of common sense no doubt! I love hearing stories of correct implementations.

      Its just sad there was ever even a question to start with.

  • Finally (Score:5, Insightful)

    by Teun ( 17872 ) on Thursday September 24, 2015 @04:35PM (#50592427)
    Tough for the prosecutors but this is a flash of some sense.
    • Comment removed based on user account deletion
    • Tough for the prosecutors but this is a flash of some sense.

      Be careful what you wish for. Because if it becomes precedent that technologically-protected documents can't be subpoenaed than the first people to take advantage of this will be large corporations trying to cover their own asses. You know, something like "Oh, we can't give you the emails between the VW ECU engineers and their managers, they are PGP-encrypted (with a key that each employee spins on their first day) and we can't make them turn over the passwords for their key". Or, like in this case, insider

      • I think the balance should be that you have no obligation to turn over any documents, but law enforcement can, with a court issued warrant can seize whatever is appropriate. It seems silly to me to expect corporations to cooperate anyway (e.g. turning over documents when ordered to).

        The way I see it, we have 2 options. We can give the government the power to compel people to produce information (i.e. punish people for not producing information), and hope that this power is not abused, or we can not give t

      • I think it's interesting how slashdotters reacted.

        When presented as an example of the Feds not being able to force a defendant to turn over info, it's universally lauded as correct Constitutional practice. If it had been presented as an example of rich bankers evading prosecution for their crimes by using their ill-gotten $2.65 million in stock profits to pay really good lawyers, it would be very controversial. And both readings of the situation are perfectly accurate. It would be unconstitutional to force

  • by Anonymous Coward on Thursday September 24, 2015 @04:38PM (#50592461)

    by the fifth Amendment.
    http://time.com/3558936/fingerprint-password-fifth-amendment/

    • Which is why, if you're ever pulled over or believe you're about to be taken into custody, you power off your phone. At least an iPhone requires the pass code be used the first time before it allows your fingerprint to be used.
      • Great, cop sees you fiddling with an object and assumes it is a gun and shoots you. At least your 5th amendment rights were not violated.

        • by cdrudge ( 68377 )

          Come on. You know that's not going to happen. The cop is going to shoot you regardless if he sees you fiddling with something or not. He only will say he saw you fiddling after the fact to justify it.

      • Which is why, if you're ever pulled over or believe you're about to be taken into custody, you power off your phone. At least an iPhone requires the pass code be used the first time before it allows your fingerprint to be used.

        I have thought the EXACT same thing, especially in light of that Virginia Court Ruling [findlaw.com] about a year ago.

    • by Anonymous Coward

      On iOS, after 24 hours or less than 10 failed fingerprint attempts, you are required to enter your password to gain access to the phone (fingerprint doesn't work at that point). I would assume that it would take longer than 24 hours for the police to convince a judge to force you to use your fingerprint, and a emergency stays by appeals courts do happen as well. I also believe that the knowledge of which finger unlocks your phone would be protected by the fifth amendment, so that you would not have to infor

      • by macs4all ( 973270 ) on Thursday September 24, 2015 @05:10PM (#50592683)

        On iOS, after 24 hours or less than 10 failed fingerprint attempts, you are required to enter your password to gain access to the phone (fingerprint doesn't work at that point). I would assume that it would take longer than 24 hours for the police to convince a judge to force you to use your fingerprint, and a emergency stays by appeals courts do happen as well. I also believe that the knowledge of which finger unlocks your phone would be protected by the fifth amendment, so that you would not have to inform law enforcement which fingerprint opens the phone and as a result the phone requires a password after many failed attempts.

        UNFORTUNATELY, There was an a decision a about a year ago that ruled that you COULD be forced to unlock your phone with your fingerprint [findlaw.com], even if you could not be forced to do so with your passcode.

        FORTUNATELY, it was only a STATE Court; so, unless you happen to be caught in Virginia, you could still fight it, and with this decision as (non-controlling, but persuasive) precedent, maybe even score a win for all of us!

        • Dang, posting to undo moderation error. Didn't mean to click the parent as "flamebait".

        • I think what he was meaning is though they can make you run your fingers over the fingerprint reader, you're under no obligation to tell them which one will unlock it. Just like if you have a key, you have to surrender it but, you're under no obligation to tell them what it unlocks. Nothing is preventing them from having you run all 10 fingers though. Now, what would be nice is if you could set it to have one fingerprint unlock it and another initiate a wipe. If you volunteer to unlock it but, use the

          • If the wipe is done properly, I would hope that the evidence that the information was intentionally wiped would also be wiped. Rather than displaying a message "Now wiping data as requested", it would just appear as if there was data corruption.

            Or even better than a wipe, the deice could be populated by some non incriminating data, hiding the fact that anything other than decryption was performed.

            https://en.wikipedia.org/wiki/Deniable_encryption

        • Exactly correct. That's why you should power off your iPhone if you're being taken into custody or being pulled over. iPhones require the use of a password after they've been powered off or if you've been away for too long (which shouldn't be counted on, since the first thing a competent police department will do is image your phone so that it can be preserved in a pre-locked state), so while they can compel you to provide your fingerprint or use it in an effort to unlock the iPhone, it won't do any good if

    • This is one of the reasons I don't use touch id on my iPhone.
    • by SumDog ( 466607 )

      Keep in mind for the passcode case, these were people involved with inside trading. They were part of the upper-class, the rich. There is a different level of law for people of different social classes. I wonder how rich/poor the person with the fingerprint case was.

      • by Aaden42 ( 198257 )

        The nice thing is that once precedent is set in a federal court, all cases in that district and *usually* similar cases in other districts are ruled the same.

        So the upper class fought for their rights, but they trickle down to the little guy.

        Could of course be decided differently in another district & need to go to SCOTUS for a final ruling, but for now it stands. Also possibility of direct appeal to SCOTUS.

  • Work Issued (Score:5, Funny)

    by The Raven ( 30575 ) on Thursday September 24, 2015 @04:41PM (#50592491) Homepage

    While I agree with the ruling, I must say that any idiot who uses a work issued phone to conduct illegal business is a special kind of idiot. There is no bus short enough.

    • It is that aspect that gives me a little pause. Everything on a work issued phone belongs to the company, it should be the companies decision as to whether to unlock the phone. Perhaps we will see secondary access by an admin become a condition of use?

      Will this get extended to divulging passwords in general like in the Terry Childs case? Couldn't someone in his position plead the 5th on similar grounds?

      • by Aaden42 ( 198257 )

        Absent a secondary access mechanism, the company very likely doesn't have the ability to unlock the phone. The worst penalty available would be to terminate the employee, which one would assume happened about the time charges were filed, if not before.

        Looking through the iOS docs as of 8.x, it looks like passcode reset isn't an option for MDM any more. It was at least in iOS 6. Makes sense considering how much vital key material in the Secure Enclave is derived from the passcode at power on. Resetting t

    • A "special kind of idiot" who in one act made more money than I'll make in two decades, and who looks like they'll get away with it.

      There's a word for this kind of idiot. It's either "lucky" or "not an idiot" but I'm not sure which...

    • And what business issues phones and doesn't have a Device Management system to track usage, unlock phones and remote wipe in case of loss? Another reason to not invest with Capital One. If they can't manage their own devices what the F^@( are they doing with our financial data?
  • by Anonymous Coward

    For handing over your encryption keys to authorities.

    • by Anonymous Coward

      Indeed. I'm little surprised the ruling went this way since it was a work issued phone. Surely work issued phones are managed, metered and secured by the company issuing them, just like a workstation would be. All phone passwords would then be corporate records just like any other credential for a device that has secure access to confidential company information. Private phones, on the other hand, are and should be private.

      • by TWX ( 665546 )
        If your corporate credentials are stored as one-way hashes, then there still isn't a practical way to retrieve the actual text to use on other devices that have different hash algorithms.

        I guess it depends on how your authorization server works.
  • Here is a contrary view: "Fifth Amendment protects passcode on smartphones, court holds - The Washington Post" https://www.washingtonpost.com... [washingtonpost.com]
  • Good to understand though, that not having to be compelled to produce something that could be used against you, doesn't mean that you are protected from that thing being produced... by others. So if somehow their phones were brute force unlocked or decrypted, that evidence could definitely be used against them.
    • True, which is why you need to use a password that's long enough that it can't be brute forced. I use an 18 character password that includes non-ASCII characters. Good luck brute forcing that before I'm dead.

  • A? Did Fonzi right this?
  • by Anonymous Coward

    Get a warrant and force their employer to unlock the phone.

    Then leave it up to them to lean on their employees or face massive fines.

    Point being here that the phone and it's contents belong to the employer, NOT the employee.

    • Typically, police cannot get a warrant to get a 3rd party to do what the police are not allowed to do. Example: A private citizen can hire a PI to spy on someone to gain evidence the police cannot obtain via warrant and turn that evidence over to the police and it is often legal (and even if a crime was committed the police can normally still use the evidence) but, the police cannot hire the PI to do the same thing or coerce the private citizen to do it on their behalf. In this case, if the cops leaned

  • Something about having to lift his own glass...

  • ... equivalent to admitting that one is guilty of at least one thing that is just as bad as whatever it is they are being charged with, or that what one is being charged with is actually entirely accurate?

    Granted, they don't know exactly what that something one is evidently guilty of might be, but still...

    Maybe I'm being just a goofy non-American here, but I honestly don't understand the point. In the general case, would someone explain to me how this constitutional amendment protects genuinely innoc

    • by Anonymous Coward

      http://lawcomic.net/guide/?p=2282

      This is a good place to start [lawcomic.net]

    • by Locke2005 ( 849178 ) on Thursday September 24, 2015 @05:58PM (#50593013)
      The Fifth Amendment means that when they torture you into confessing, it's not admissible in court? As an American, I find the concept of throwing out evidence somewhat questionable is well, as in, if someone is guilty, they are guilty, no matter how the evidence was obtained. There should be more direct consequences for unlawfully obtaining evidence, because supressing evidence obtained by violating rights only protects the guilty, as you said. What we really need is a way of punishing law enforcement for violating the rights of INNOCENT people, as it is, they don't even say "I'm sorry". The best we can hope for is to actually get reimbursed for the property they destroy.
      • by TWX ( 665546 ) on Thursday September 24, 2015 @06:19PM (#50593135)
        Part of the point is that confessing under pressure or torture doesn't mean that the confession is real. If one is being tortured, one may say anything that one believes will end the torture, if the torturer has stated that saying that thing will cause the torture to stop.

        Also, don't forget, everyone is innocent until they're convicted in a court of law. Right now, in the eyes of the law, Bill Cosby is completely innocent of any and all accusations that have been made against him. Individuals may choose whether or not to believe that he has or has not done the things that he has been accused of, but he has not been indicted or convicted of anything, and given that it doesn't sound like any evidence exists to substantiate these claims of acts a long time ago, it's very likely that he will not see criminal charges based on the accusations. That doesn't mean that people will trust him like they did before, but in the eyes of the law he is an innocent man.
        • everyone is innocent until they're convicted in a court of law

          Except anyone who looks like a terrorist who, under The Patriot Act (tm), is grabbed off the street, stuffed in a hole somewhere and denied access to legal counsel and a swift trial.

      • The Fifth Amendment means that when they torture you into confessing, it's not admissible in court? [...] What we really need is a way of punishing law enforcement for violating the rights of INNOCENT people

        When the cops break the law, the evidence is inadmissible. That's how we protect innocent people from being abused by law enforcement in this way, at least, when we actually follow the rules of evidence. However, when a non-cop breaks the law and gathers evidence, it may still be admissible. In this way, it is still possible for misdeeds to be uncovered when the law must be broken to do it. See: Whistle-blowers.

      • by Lakitu ( 136170 ) on Thursday September 24, 2015 @09:03PM (#50593945)

        As an American, I find the concept of throwing out evidence somewhat questionable is well, as in, if someone is guilty, they are guilty, no matter how the evidence was obtained.

        This should be "despite being American, ...". Guilt is determined by the courts and it is done so using evidence gathered. If a person of questionable guilt is found guilty in a court of law, then ALL evidence that was used against them to do so is suddenly retroactively converted into having no requirements for its gathering. The person is guilty because of the evidence, and the evidence is admissable because they will be found guilty. This might be a nice system if we could pause the universe and question God as to whether we're correct or not, but we cannot, and if we could, we would probably not need arcane concepts like legal systems in the first place.

        How could you possibly hold someone accountable for destroying your property if it's perfectly acceptable for them to destroy your property if you will eventually be convicted? It's just an incentive for everyone involved to convict you regardless of whether you did anything or not.

        Both you and the non-American OP are viewing this in a simplistic manner as if a trial exists of questions such as "did you do it?" with a yes or no response. They are not. A skilled prosecutor can make it seem like your 8:59 quick trip to a convenience store reeks of guilt when it was information you happily provided to police. If "evidence" were always as evident as a bloody knife, then the criminals would just clean up after themselves without fail.

        It's fucking crazy that a place like /., where people so greatly appreciate the overreaching of the NSA, some people can so quickly do a 180 and justify the same behavior so long as they come up guilty in the end! The 4th and 5th amendments, protecting searches without warrant and protecting you from having to testify against yourself, are intricately and irrevocably linked together. How can you justify not consenting to a search if you can be forced to consent to provide evidence incriminating yourself?

      • The Fifth Amendment means that when they torture you into confessing, it's not admissible in court?

        No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law;

      • The Fifth Amendment means that when they torture you into confessing, it's not admissible in court? As an American, I find the concept of throwing out evidence somewhat questionable is well, as in, if someone is guilty, they are guilty, no matter how the evidence was obtained. There should be more direct consequences for unlawfully obtaining evidence, because supressing evidence obtained by violating rights only protects the guilty, as you said. What we really need is a way of punishing law enforcement for violating the rights of INNOCENT people, as it is, they don't even say "I'm sorry". The best we can hope for is to actually get reimbursed for the property they destroy.

        The "exclusionary rule" requires courts to exclude evidence that is obtained unconstitutionally. There's a simple reason why the remedy is exclusion of evidence rather than punishing cops who torture people: practicality. Courts can't punish cops who torture people, because somebody would need to arrest them.

        The exclusionary rule was developed so that cops wouldn't have an *incentive* to abuse their power and gather evidence illegally. This in turn discourages them from doing so. We let bad guys go not

      • As an American, I find the concept of throwing out evidence somewhat questionable is well, as in, if someone is guilty, they are guilty, no matter how the evidence was obtained.

        Don't worry, you're not the only one. There was a study that found that 70% of juries still convicted based on the very hint of thrown out confessions (when no other evidence was present to corroborate the guilt of the accused).

        This has lead police officers to purposefully avoid mirandizing some of the suspects they arrest, and then interpret almost anything they say as a confession (while at the same time making sure that any recording of the so-called confession gets conveniently lost). Because once the d

      • The Fifth Amendment means that when they torture you into confessing, it's not admissible in court? As an American, I find the concept of throwing out evidence somewhat questionable is well, as in, if someone is guilty, they are guilty, no matter how the evidence was obtained. There should be more direct consequences for unlawfully obtaining evidence, because supressing evidence obtained by violating rights only protects the guilty, as you said. What we really need is a way of punishing law enforcement for violating the rights of INNOCENT people, as it is, they don't even say "I'm sorry". The best we can hope for is to actually get reimbursed for the property they destroy.

        So the drugs and child porn found in your apartment by Bob the Bad Cop (bought and paid for by someone you pissed off last week) who broke down your door and found them there, alone with no witness to contest his story...should be allowed as evidence in court against you?

    • by jafiwam ( 310805 ) on Thursday September 24, 2015 @06:14PM (#50593109) Homepage Journal

      ... equivalent to admitting that one is guilty of at least one thing that is just as bad as whatever it is they are being charged with, or that what one is being charged with is actually entirely accurate?

      Granted, they don't know exactly what that something one is evidently guilty of might be, but still...

      Maybe I'm being just a goofy non-American here, but I honestly don't understand the point. In the general case, would someone explain to me how this constitutional amendment protects genuinely innocent people?

      Yes.

      And. So what?

      Not having the 5th amendment opens the door to what would basically be torture. I think you want the government doing that less than you want the government to win this case.

      Anyway, they can go ASK THE FUCKING NSA about what was transferred between the phones. Oh, right, that wasn't a legal search either. Sometimes the parallel construction doesn't work I guess.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      Well, first let us look at the text of the 5th amendment:

      "No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a grand jury, except in cases arising in the land or naval forces, or in the militia, when in actual service in time of war or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of

    • by Lakitu ( 136170 )

      One of the major use-cases of the 5th amendment is avoiding having to take the stand during a criminal trial. It's not like the prosecutor can call you to the stand and ask you a bunch of innocuous questions like your name, birthdate, job, hometown, etc., which you must answer and then ask "did you commit the murder?" Because it is unconstitutional to force someone to testify against themselves, and because a prosecutor questioning a defendant in front of a jury could imply guilt like this, a defendant's la

  • by schwit1 ( 797399 ) on Thursday September 24, 2015 @09:08PM (#50593965)
    No one should be compelled to assist in their own prosecution.
    • You can be compelled to produce physical keys.

      Blood samples, hand writing samples, recorded voice samples, finger prints... All OK. Just not passwords.

  • We have been saying for years that only good can come from bringing economic fraudsters to trial. Put them on trial and....poof....our rights expand!

    Lets put some bankers up next, maybe we can get some more freedom.

"I am, therefore I am." -- Akira

Working...