PGP Ruled as Relevant For Criminal Case

waytoomuchcoffee writes "A Minnesota appeals unamimously ruled in a child porn case that "the existence of an encryption program" on the defendants computer could be admitted as evidence of criminal intent. The article doesn't mention if this can be taken into account for sentencing too."

Comments

Encryption use != evil

[zoloto]

"We find that evidence of appellant's Internet use and the existence of an encryption program on his computer was at least somewhat relevant to the state's case against him," Judge R.A. Randall wrote in an opinion dated May 3.

I find this very disturbing based on the attitude people have regarding encryption. It's seen in such a negative way as if everyone who uses encryption as evil. Let me put it this way:

ENCRYPTION != EVIL

I use this for my day to day communications. Either over IM, E-Mail or moving things from server to server (GPG, then sending the file via FTP etc.). How do we help the public to understand that just because someone wants to keep something secret, even under a mass of public scrutiny, it does not constitute someone breaking the law! I have a TON of letters to and from my girlfriend that are encrypted, that she herself does as well!

I'm not saying the guy accused of the crime shouldn't produce keys, he obviously was doing something totally heinous by photographing a 9 year old in sexual position, and then those pictures destroyed. Predators of this nature are f-ing sick creatures that need some bad rehabilitation.

My point is the attitude of the people. Admission of the fact that he had PGP on his computer shouldn't be a condemning factor of his behavior and should be based on his crimes. NOT THE FACILITATOR, MEANS, TOOL (Physical or otherwise) OR SOFTWARE to commit such crimes. He was using perfectly legal encryption utilities and software.

Just because they were for hiding his crimes/pictures should NOT be a factor in his punishment. What kind of precedent would the judge be inadvertently (or purposely??) placing on the use and ownership of encryption and the tools to do such?

~zoloto

Re:Encryption use != evil

[rhyno46]

I absolutely agree. In a murder case, the fact that the accused legally owns a gun does not show intent.

Re:Encryption use != evil

[Beryllium Sphere(tm)]

>Just because they were for hiding his crimes/pictures should NOT be a factor in his punishment.

We don't even know that much. All that was reported is that he had PGP installed, not that he had any encrypted pictures.

I wonder why the EFF wasn't mentioned.

I use PGP for clients's data myself.

Hey, if posession is a problem, what about all those recent Windows versions with EFS preinstalled?

Re:Encryption use != evil

[pHatidic]

I'm not saying the guy accused of the crime shouldn't produce keys

It also depends on whether he was using PGP to encrypt just his email or his HD, since newer vesions can do either. Personally I don't think he should have to produce the keys either way, but there is a difference. If he was just using PGP for email then it should be entirely irrelevant, since obviously no nine year old girl is going to have PGP on her email (or at least any 9yo girl who does should be smart enough not to hang around pedophiles).

Re:Encryption use != evil

[srw]

If you had carefully RTFA, you would notice that nobody is suggesting that encryption software is illegal. They included it as a component of their case to establish _criminal intent_. In other words, if he's hiding something, he knows he has something to hide, therefore he knows he's doing something wrong... not just really, really stupid. Again, they're not suggesting everybody that has encryption software knows they're doing something wrong... in this case, the fact that he was doing something wrong was established with other evidence. The fact that he knew that what he was doing was wrong was supported by the fact that he tried to hide it. The same argument would probably be made if he had locked the pictures in an industrial-strength safe. As usual, the FA is not as bad as the slashdot headline.

Re:Encryption use != evil

[Dunkelzahn]

There are certain creative ventures, notes from a series of novels I am writing, and many things that I intend to make a profit with that are fully legal and fully ethical, moral, you name it... that I can see encrypting (and do encrypt) simply to protect myself and my creations for reasons of well... I would prefer not to be plagiarized by unscrupulous authors...

When you're a writer, and you're good, people will plagiarize you. It's happened to me before, on three different unrelated occasions. When it comes to my flagship writing venture, I'd prefer to keep the good stuff under lock and key, lest I be plagiarized by some hack with a big name. So do I use encryption when sharing my material with beta readers and editors, you're damned right I do.

Re:Encryption use != evil

[irc.goatse.cx troll]

"My point is the attitude of the people. Admission of the fact that he had PGP on his computer shouldn't be a condemning factor of his behavior and should be based on his crimes. NOT THE FACILITATOR, MEANS, TOOL (Physical or otherwise) OR SOFTWARE to commit such crimes. He was using perfectly legal encryption utilities and software."

Legal tools being used for something illegal can easily add on to crimes. For example, I can sit around and listen to an RF scanner all day, but if I got caught doing a drug deal and were listening to cops radios on it, then it becomes illegal (in addition to the drug stuff.)

I'm sure there are other examples.

Re:Encryption use != evil

[zoloto]

I also mentioned that. I coudln't find any information regarding obstruction of justice as mentioned here

Re:Encryption use != evil

[MntlChaos]

FBI: You Tried to launder money to the Soviets, didn't you?

Person: No. I didn't.

FBI: Then how do you explain this encryption software on your computer. You obviously have something to hide.

Person: No. And if I did, that would be none of your business

FBI to jury: Yup. He's guilty.

You might as well say that "The fact he knew that what he was doing was wrong was supported by the fact that he didn't tell anyone about it." A right to privacy should be guaranteed. I shouldn't have to defend my use of tools which help ensure my privacy

Re:Encryption use != evil

[waytoomuchcoffee]

As usual, the FA is not as bad as the slashdot headline.

Sigh. My headline as entered was PGP ruled as "evidence of criminal intent"

Re:Encryption use != evil

[jadavis]

I think that the main point is that it should be admitted as evidence if he selectively encrypted some files and not others.

If you're just paranoid and you encrypt everything, then that's not really evidence that you were hiding anything in particular. A good example of this is using SSL connections to websites, which is used so often that it doesn't imply hiding anything at all.

However, if you selectively encrypt some files and not others, that implies that you were hiding them. I suppose you could use the 5th Amendment to refuse to turn over the keys though, but it seems like they had the evidence against him already.

Re:Encryption use != evil

[Anonymous Coward]

Unless, of course, the victim died of a gunshot wound.

In the case cited in the article, one of the accusations was that the defendant had child pornography on his computer.

PGP was ruled to be admissible as potential evidence of criminal intent. The defendant was convicted on much greater evidence than simply having PGP on his computer and having PGP on his computer was not what got him in trouble in the first place.

This is not directed at you, but at the general /. crowd: read the articles and give them some thought. You know that the headlines and the summaries generally don't reflect the the content of the article. Use your brain.

And post anonymously!

Re:Encryption use != evil

[jadavis]

But if you selectively encrypt some documents and not others, it implies that you may have a particular reason to hide those documents. That makes it unreasonable to claim that you didn't know it was wrong.

If all your documents are encrypted, or at least many documents that aren't related to a crime, there's no implication that you're hiding something in particular. Then you can make the "I didn't know" argument.

Re:Encryption use != evil

[Anonymous Coward]

What are these encrypted files in a folder named "Pumpkin", on a CD-ROM labeled "Porch", Mr. Hiss?

Re:Encryption use != evil

[Anonymous Coward]

yes, the judge is an idiot.

Basically what he is saying is that I (because I follow the company policy of always using ssh and scp over telnet and ftp) have criminal intent, but my moronic co-workers do not.

Re:Encryption use != evil

[Em Ellel]

You might as well say that "The fact he knew that what he was doing was wrong was supported by the fact that he didn't tell anyone about it." A right to privacy should be guaranteed. I shouldn't have to defend my use of tools which help ensure my privacy

Yeah, just like that amendment allows you to kill random people with your gun because you know, you have a right to your gun, and that right should be guaranteed, so anything you do with it is your right and thus cannot be questioned.

Re:Encryption use != evil

[fyngyrz]

Ok. Perv has bookshelves. Hides said photos in between the books. The brilliant, insightful courts:

"We find that evidence of appellant's bookshelf use and the existence of books in his house was at least somewhat relevant to the state's case against him"

If there is anything more ridiculous than blaming the weapon for the act of the person, I'm sure I can't think of it offhand.

The perv did the act, and the perv should get the attention. What he or she did it with has absolutely no bearing on the case -- but you can bet dollars to donuts that some moron is going to be all about banning PGP now because it "contributes to the child porn/perv problem."

There. Now I've used my brain.

Happy now?

Re:Encryption use != evil

[Gilk180]

Actually the 5th amendment probably wouldn't protect you in this case. If the police have a search warrant that includes the contents of those encrypted files you would have to turn over the key the same way you would have to turn over the key to your safe if they have a warrant.

Re:Encryption use != evil

[philipgar]

This case could be more analagous with the following added components:

FBI: You Tried to launder money to the Soviets, didn't you?

Person: No. I didn't.

FBI: We caught you exchanging money with operatives in soviet russia.

Person: Uh . . .

FBI: We also found this encryption software on your computer. You are likely to have something to hide.

Person: No. And if I did, that would be none of your business

FBI to jury: Yup. He's guilty.

Re:Encryption use != evil

[Anonymous Coward]

The way I read the article, the guy appeared to be appealing (saying that the conviction should be overturned) because inadmissible/irrelevant evidence (He'd installled PGP!) was used to convict him.

The Appeals court upheld the conviction since PGP wasn't central to the conviction, but the testimony of the victim, evidence in his browser cache, was the primary point of conviction. While not central to the case, PGP was "somewhat relevant", i.e. was not irrelevent enough to overturn the case.

Re:Encryption use != evil

[rpdillon]

Yes, but by this logic, if someone "takes the fifth", it could be used to incriminate them, which kind of destroys the purpose of the right.

Why is this relevant? Well, if he is using encryption, and they ask him for his key to decrypt the files, I'd say that would be him testifying against himself. Along those same lines, if he refuses to give the key (because he has the right NOT to incriminate himself), they are basically saying "Hey, we don't need the key, because he wouldn't be hiding anything if he had nothing to hide, so he must be guilty!"

This really represents a failure on the part of the judge. The only thing encryption represents is an unknown: not intent, not a particular set of data. You might as well hand they police a blank drive and infer from that "He must have erased it, and he wouldn't have done that unless he was guilty!"

Re:Encryption use != evil

[anagama]

Let me preface this by saying I know nothing of MN law or the facts of this case beyond the short article. However, I am a lawyer and I can guess at why the prosecution would want to get this evidence in the record and why it would be admitted.

The Prosecutor would likely argue that the existence of the encryption software demonstrates that the defendant knew that what he was doing was wrong and that he was trying to hide damning evidence. Hiding evidence against you is frowned on. If you know evidence could be used against you and then go about destroying it, in certain situations the court is entitled to instruct the jury to presume that the destroyed evidence would be harmful to your case.

Now, encrypted evidence may not be literally destroyed, but it is as good as destroyed as long as it remains encrypted. It's kind of like a shredded document -- although it is conceivable that it could be reassembled, if it is mixed with enough random material, reassembly is all but impossible.

Anyway, I don't see this as a suggestion that encryption is bad per se. I see it as an extension of basic evidence rules -- if there is other evidence suggesting you have bad files and you have intentionally made those file unreadable, the tools you used to do that are possibly relevant. Kind of like pointing out the defendant owned a shredder, there was huge pile of shredded paper by it, and the "smoking gun" documents are no where to be found.

Last, it doesn't exactly sound like PGP was a "factor in his punishment". Rather, it sounds like it was a factor in his conviction. If the court had ruled that the evidence was inadmissible, then a new trial might have been ordered. This would require a finding that the irrelevant evidence was prejudicial enough that it could have formed a basis for the conviction. If the error was not considered substantial, then no new trial would have been ordered. Obviously, one never reaches the punishment phase without conviction, but I didn't read anything that suggested the punishment was more severe by virtue of the PGP software (kind of like a firearm enhancement).

Re:Encryption use != evil

[Anonymous Coward]

Clearly you don't live in the United States.

Re:Encryption use != evil

[amliebsch]

We find that evidence of appellant's bookshelf use and the existence of books in his house was at least somewhat relevant to the state's case against him

And so it would be, because it directly corroborates the state's theory of the case! It may not be highly probabative as to guilt - but it is in fact relevant, because it strengthens, however incrementally, the state's interpretation of the facts.

Re:Encryption use != evil

[Vellmont]

Have you ever used an envelope to conceal your communications, or do you let just everyone see what you're writing? Have you ever used https in a transaction? If so I guess you have something to hide as well.

The fact that he knew that what he was doing was wrong was supported by the fact that he tried to hide it.

And if you had read the article carefully, you would have noticed that there's no evidence he tried to hide the files. From the article:

The court didn't say that police had unearthed any encrypted files or how it would view the use of standard software like OS X's FileVault.

Using your analogy it's more like they found an empty bargain-bin safe at the house, and used that as evidence against him. "The man had a SAFE! Only criminals have safes!". As far as comparing PGP to a "industrial strength safe", well that might be a good comparison.. if all safes were industrial strength and given away very cheap or free.

Re:Encryption use != evil

[yppiz]

Actually the 5th amendment probably wouldn't protect you in this case. If the police have a search warrant that includes the contents of those encrypted files you would have to turn over the key the same way you would have to turn over the key to your safe if they have a warrant.

I am interested in whether this is the case. If the police have a warrant to get files, is the accused required to tell them how to read the files? If so, this sounds like you can be compelled to testify against yourself.

Could someone with more legal expertise please explain what US laws or cases would require an accused to cough up an encryption key or password?

--Pat

Re:Encryption use != evil

[GlassHeart]

They included it as a component of their case to establish _criminal intent_. In other words, if he's hiding something, he knows he has something to hide, therefore he knows he's doing something wrong...

No, it would be wrong to conclude criminal intent based on the fact that his drive is encrypted. The prosecution should have to establish that he otherwise would not have encrypted his drive, because lots of people encrypt their drives for little or no reason. It's a few clicks away in MacOS X, for example.

Consider two MacOS X users who both accidentally download the same illegal pornographic picture. One of them has File Vault enabled. Should he therefore be treated as having criminal intent by virtue of that single fact?

Re:Encryption use != evil

[icecow]

That's still bunk, because if they break the code (or otherwise get to the picture) they have established the criminal intent they need. If they don't, the encryption tools on his computer should not merit criminal intent. To say 'ah ha! between the alegation and the encryption tools he is at this point partially guilty.' Correct my logic if I'm wrong. My perspective at this point is that they either do or do not have access to the evidence.

Re:Encryption use != evil

[jadavis]

I'm sure there are other examples.

If by "other examples" you mean "pretty much any form of physical or circumstantial evidence introduced at all," I agree.

(that was supposed to be funny, but the idea behind it is that I agree with you, and I just think you understated your point)

Nobody would ever get convicted if you first had to prove that every bit of evidence that you introduce is illegal in and of itself.

Re:Encryption use != evil

[j_w_d]

This case could be more analagous with the following added components:

FBI: You Tried to launder money to the Soviets, didn't you?

Person: No. I didn't.

FBI: We caught you exchanging money with operatives in soviet russia.

Person: When?

FBI: You know when.

Person: I do?

FBI: Just answer the question.

Person: What question?

FBI: Uh. Encryption! You have encryption software on your computer, don't you?

Person: Yep.

FBI: So, you have something to hide.

Person: Sure, my credit card numbers that I use on line, personal data that could be used for identity theft, business correspondence I don't want my competitors to read, accounting data, that kind of stuff.

FBI: So, you could use this program for illicit purposes.

Person: What's 'illicit?'

FBI: You also have steganographic programs on your system.

Person: Stegano- what?

[Jury member takes note: "Linux newby. Doesn't know just what the vast majority of the software that came with his distro is or does, yet."]

Re:Encryption use != evil

[amliebsch]

This is one of those rare cases when the slashdot headling is MORE accurate than the headline of TFA. That's because the court did NOT rule that PGP is evidence of criminal intent. Instead, it ruled that the existence of PGP was relevant to the state's case.

Consider the following analogy: I murder someone on the street and flee in a red car. An eyewitness can't identify me but testifies that they saw a red car speeding away. The state introduces my auto title showing that my car was red.

The fact that I own a red car is admitted into evidence! But not because owning a red car is itself proof of guilt! Rather, it's because it's relevant to the state's case, as evidence of a plan or simply the means of execution.

Thus, Slashdot is right - the court found it "relevant" - and TFA is wrong - encryption is not itself evidence of criminal intent.

Re:Encryption use != evil

[amliebsch]

Here's the key: "testify" != "present evidence."

Re:Encryption use != evil

[fyngyrz]

Next, we'll have the Librarian's law, where owners of bookshelves are registered for life on state websites. Oh, wait, we'll need a federal registry, too.

If the state can't prove this fellow had or produced child porn without referring to the simple fact that he has encryption software, the state has no business bothering him, in my estimation.

Encryption tools shouldn't be admitted as evidence of intent to commit a crime in any way, shape or form. Any more than owning fast shoes (sneakers) is a crime, even though you were walking in sneakers when you held up the bank.

The crime here is (should be) abusing the trust and/or corpus of an individual the state asserts is unable to manage their own sexuality (and the state should probably have to prove that, too.)

Anything beyond that is legal sophistry at best, and clueless babbling of a legal system completely out of control at worst.

Just because it is law, doesn't mean it isn't stupid. Quite the contrary.

Re:Encryption use != evil

[dextroz]

HOW DOES A FIRST-WORLD, DEVELOPED COUNTRY HAVE SO MANY FUCKTARDS RULING ON ITS *PRIME* LAWS!?!?

In this day and age there shouldn't even be any situation like this. I thought the US Govt and its "people" should have got their rear-in-gear after the VCR vs. MPAA court case 20 years ago!

Re:Encryption use != evil

[PakProtector]

No, if the victim died of a gunshot wound, posession of a gun on part of the defendant would not show intent. It would show means.

There are three things to remember:

1. Means
2. Motive
3. Opportunity

Owning a gun is means. Intent means crap. If I shoot a gun at someone with the intent of blowing off their kneecap, and later they die, I am guilt of Premeditated Murder, not of Assault with a Deadly Weapon. It doesn't matter that I didn't intend to kill him.

IANALBMDIAO (I Am Not A Lawyer, But My Dad Is Almost One)

Re:Encryption use != evil

[Anonymous Coward]

You are ridiculous. Let's just say you don't encrypt 99% of things, but your girlfriend who is out of the country likes to send e-mails with some dirty thoughts/words. Encrypting those says you're covering a crime?

Re:Encryption use != evil

[Anonymous Coward]

But if you selectively encrypt some documents and not others, it implies that you may have a particular reason to hide those documents. That makes it unreasonable to claim that you didn't know it was wrong.

The particular reason for encrypting certain documents may be so that your little sister won't read your diary. You don't care if she reads your term paper, so it isn't encrypted. There is nothing wrong, morally or legally, with the content of the encrypted documents. You simply want them to remain private. It is perfectly okay to keep documents or correspondence you don't want the world to read while at the same time keeping stuff you don't mind others seeing.

TFA doesn't say that the man used encryption to cover up illegal activity, but that the very existence of PGP itself indicated criminal intent, which is ludicrous.

Re:Encryption use != evil

[orangesquid]

Selective? Well, of course. I don't encrypt every single homework assignment or shell script I write!

I do encrypt things like bank records, sensitive databases, private letters, etc.

Of course, it's easier to just encrypt your whole $HOME directory. Put it on an encrypted partition. Then you can say, "I keep all of my data encrypted so my identity can't be stolen, so people can't poke into my private life, etc."

Maybe in fact I *should* encrypt my homework. At the university of delaware, the policy is, if someone cheats off of you, both them and you get in trouble. If I leave my laptop unguarded for a moment someone else in my class scp's the data to his computer, I'll get in trouble for it, when I've really done nothing wrong**. In that case, an encrypted $HOME directory would be useless, since if you're logged in, the whole directory would be unencrypted.

(** = Some may argue I should not leave my laptop unattended. Why? How about this---you leave your car parked unattended in your driveway, so it's okay for me to just walk up and take the engine out? Just because something's unattended doesn't make it OK to tinker with!)

Re:Encryption use != evil

[Anonymous Coward]

In other words, if he's hiding something, he knows he has something to hide, therefore he knows he's doing something wrong... not just really, really stupid.

Do you know you have something to hide every time you use an envelope when a postcard would do just as well?

The same argument would probably be made if he had locked the pictures in an industrial-strength safe.

Perhaps if the pictures were the only thing he ever encrypted, otherwise it's more like having the pictures in his house, which happened to have a lock on the front door.

Re:Encryption use != evil

[Anonymous Coward]

If someone pleads the fifth, they know they've got something to hide.

Re:Encryption use != evil

[amliebsch]

Encryption tools shouldn't be admitted as evidence of intent to commit a crime in any way, shape or form.

And it WASN'T. You're killing a straw man. The existence of PGP was held to be relevant only. Which clearly, as a piece of the overall case, it was, if marginally so. It was NOT introduced as proof of criminal intent.

If the state can't prove this fellow had or produced child porn without referring to the simple fact that he has encryption software, the state has no business bothering him, in my estimation.

It sounds like they had all the evidence they needed. I don't think anyone believes that had the state not brought up the existence of PGP, the guy would have been acquitted.

Re:Encryption use != evil

[philipgar]

have you read the article? In this case their is testimony from the girl. There is also likely countless other testimony. The usage of the PGP program was an accessory. It has not been used as primary evidence, but could possibly be used to explain why the photos allegedly taken were not found on his computer (as could simply deleting the photos and writing over the drive).

Its just like in a case of convicting someone of a stealing a car because they have video tape of the man stealing the car, eyewitnesses etc, but at the end of the day no one can find the car. The car could have been hidden or destroyed or chopped up etc. If none of these things were possible the fact that the defendent didn't have the car would likely mean he couldn't have stolen it.

phil

Re:Encryption use != evil

[TheLittleJetson]

A right to privacy should be guaranteed.

Should be, but it's not. Read the bill of rights. "Right to privacy" is not one of them. Privacy is a privilage.

That said, it is pretty silly that having encrytpion applications constitutes criminal intent. Encryption is built into OSX, and hell, I even use it for my home directory. Does that mean I have criminal intent? No! I simply don't want whoever steals my laptop to be able to access my stored passwords and such.

Re:Encryption use != evil

[networkBoy]

It's been suggested (though untested AFAIK), that a memorized key, with no copies written down, would not have to be divulged. And in any case you could "forget" and face only comtempt of court, which is likely to not be as bad as what the files would imply.
-nB

Re:Encryption use != evil

[Elshar]

Right, of course the victim (the 9 year old girl) probably doesn't even own a computer.

How 'bout the other child pornographers that he's likely sharing the pictures with? Oh, yea. Them. They'd probably also be using PGP, as I doubt they'd want their email sniffed/syphoned off and read in an unencrypted fashion.

And the last remark is uncalled for. Those children subjected to the whims of the pedeophiles might have no idea what they're doing, or they might be bullied, forced, coerced into doing so. How do you know? Maybe the pedophile is related to them?

Re:Encryption use != evil

[Anonymous Coward]

Laws and the interpretation of them are just bought and sold these days. There is no social justice left in the world anymore. It's not just the US, it's happening everywhere and we are entering a very dark age of ignorance, lies and fear imposed by government and big business, sustained by a sheepish compliance of a souless zombified population.

People don't like to be bored by conspiracy theories about 9/11 but unfortunately, I for one am having great difficulty in interpreting it any other way.

Re:Encryption use != evil

[Anonymous Coward]

"No encryptet files were found on his computer".

The guy didn't use PGP, he just had it installed. Just like I used to, before I found any use for it (now I have one encryptet file, the one containing passwords for sites I don't visit very often).

Re:Encryption use != evil

[Doctor_Jest]

Call me wacky, but:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated... (and so on...)

Has a privacy ring to it.... It's a right. If you want to keep something to yourself... this particular amendment provides a mechanism for which you are able to do that. Granted, it is not specifically stated "privacy", but applying the reasonable man test, you can see where privacy is upheld over public scrutiny. When privacy needs to be violated, it requires more work than just "LET ME SEE YOUR STUFF." :-) And for good reason, as evidenced by the groupings and subjects of amendments 1 - 10.

Which, if our courts weren't so broken, judicial review would toss out the "sneak and peek" provisions of the Patriot Act faster than you can say "Amendment IV".

Re:Encryption use != evil

[surprise_audit]

The Prosecutor would likely argue that the existence of the encryption software demonstrates that the defendant knew that what he was doing was wrong and that he was trying to hide damning evidence.

And Defence should have argued that existence of the encryption software proves nothing other than that there was encryption software on the system. It could conceivably have been part of the original system load and not even used by the accused. For example, doing a full install of RedHat very likely installs gpg or some other encryption software.

Assuming they also found encrypted files, that only proves that something was encrypted. Could be bank statements, tv listings, photos of his dog, anything.

Re:Encryption use != evil

[TeraCo]

Let's just say you don't encrypt 99% of things, but your girlfriend who is out of the country likes to send e-mails with some dirty thoughts/words.

No, but if it was a crime, the fact that you encrypted them goes a long way towards showing that you knew it was illegal.

Re:Encryption use != evil

[pHatidic]

I agree, that was uncalled for. I apologize.

Re:Encryption use != evil

[realityfighter]

Of course, IANAL, but it seems to me that this would presuppose the defendant's guilt by virtue of allowing this evidence to be used in court. To me, that would be enough to contest and ask for a retrial. But then again, I'm no lawyer and I don't know all the rules.

Don't they have the investigative right, once you've been charged of a crime, to simply do whatever it takes to decrypt the files? Presumably, this would merely involve sitting down at your computer and using the same tool you used to encrypt them. I don't see why the existence of the encryption tool would be admissable. If you know that the tool was there, surely your warrant goes so far as to allow you to use it.

Unless, of course, there aren't any encrypted files to be decrypted. In which case you can either prove that the files were deleted or moved off the original computer with about the same amount of difficulty as actually decrypting those files. Otherwise how can you even know that he used the software once he downloaded it?

Of course, I could be going in entirely the wrong direction here. Maybe they wanted to keep the defendant from pleading insanity.

Re:Encryption use != evil

[Anonymous Coward]

You really need to reread the post to which you are replying, and apparently so do the moderators. This is not evidence of guilt, this is evidence that the defendant knew he was doing something wrong.

Re:Encryption use != evil

[A beautiful mind]

You know, this reminds me of some parody of how things can be twisted. While the example i'm going to bring up is not directly related, i think there is a lot of parallel between the reality and the parody version:

Bread Kills!

Have you had your daily bread?

1. Almost 100% of gun owners have eaten some form of sliced bread.

2. Over 99% of all hunters make their sandwiches using bread on both sides.

3. All people carrying concealed weapons are found within two miles of bread.

4. Convenience stores that have armed holdups carry bread and bakery products.

5. It is a well known fact that criminals ate bread before they committed crimes.

6. The police often stake out areas known to have fresh bread (and donuts).

7. There is a very high, over 94% rate of conviction, from among bread eaters.

8. Lawyers are too stupid to bake bread - but they will steal yours.

9. Judges can not recognize bread loaves and therefore deny that bread exists.

10. More than 98 percent of convicted felons are known to be bread abusers.

11. Government run institutions are full of musty old stale bread.

12. HALF of all children who grow up eating bread score below average on tests.

13. Bread always falls jelly side down into the carpet.

14. Every piece of bread you eat brings you nearer to death.

15. Bread causes death and disease, nearly all sick people have eaten bread.

a. 99.9% of all people who die from cancer have eaten bread.
b. 100% of soldiers have eaten bread sometime before they went to war.
c. 96.9% of all undertakers have eaten bread near dead bodies.
d. 99.7% of the people involved in air and auto accidents ate bread.
e. 93.1% of Mafia members eat bread frequently with their spaghetti.

16. Evidence points to the long-term effects of bread eating: Of all the people born since 1839 who later dined on bread, there has been a 100% mortality rate.

17. Bread is made from a substance called "dough." It has been scientifically proven that as little as a teaspoon of dough can be used to suffocate a lab rat. The average American eats more bread than that in one day!

18. Primitive tribal societies that have no bread exhibit a very low incidence of cancer, Altzheimer's, Parkinson's disease, osteoporosis and lawyers.

19. Bread has been proven to be addictive. Subjects deprived of bread and given only water to drink, begged for bread after as little as two days of withdrawal.

20. Bread is often a "gateway" food item, leading the user to "harder" items such as butter, jelly, peanut butter, and even cold cuts.

21. Bread has been proven to absorb water. Since the human body is more than 90 percent water, it follows that eating bread could lead to your body being taken over by this absorptive food product, turning you into a soggy gray, gooey bread-pudding type person.

22. Young children can choke on bread - Always keep your loaf securely locked up.

23. Bread is baked at dangerous temperatures as high as 400 degrees Fahrenheit! That much heat can kill an adult in less than one minute after they get into the oven.

24. Most bread eaters are utterly unable to distinguish between true significant scientific facts and utterly meaningless statistical babbling found on websites.

My opinion is that the mere fact that there was such program on the harddrive of that guy is not enough. That would be the bread-eater-killer comparison, but even IF the court can prove that he used pgp to deliberately hide data, all it would mean like in a case when a murderer hides a victim's remains in his high security safe. I don't think that it would me more aware or more deliberate because someone has hidden pictures or a body somewhere. The fact that someone did what he did matters.

Re:Encryption use != evil

[MoneyT]

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated

I believe having a whitness willing to testify in court to your illegal activities is grounds to make seach and siezure reasonable.

Re:Encryption use != evil

[draxredd]

Encrypting is not evil, i agree.
But i guess the real meaning behind this statement is the the guy knew he was doing something "sensitive" as he went as far as crypting the data.
so he can't say he wasn't aware of it.

remove tinfoil hat and use brain from time to time.

Re:Encryption use != evil

[Keeper]

They didn't say that the very existence of PGP indicated criminal intent, it say that it may be used to prove criminal intent. Slightly different.

Re:Encryption use != evil

[noidentity]

Anyway, I don't see this as a suggestion that encryption is bad per se. I see it as an extension of basic evidence rules -- if there is other evidence suggesting you have bad files and you have intentionally made those file unreadable, the tools you used to do that are possibly relevant. Kind of like pointing out the defendant owned a shredder, there was huge pile of shredded paper by it, and the "smoking gun" documents are no where to be found.

Wait a minute... if they had the "smoking gun" documents already, why would it matter if he shredded his copies? If they did not have the "smoking gun" documents, how do they know they even exist? If they knew they existed, wouldn't that have allowed them to make copies?

Re:Encryption use != evil

[fyngyrz]

It was not my intent to mis-state how the issue was involved; my lack of familiarity with terminology failed me here. It shouldn't have been even mentioned, is what I'm trying to say.

The only valid issue should be, child porn, or no child porn. Not encryption. Did the defendant have some, or not? Did they produce some, or not? Did they distribute some, or not? If you have to point to the fact that the defendant has a means to hide information in the course of trying to villify them for creating, possession, or distribution of child porn, then you and your case suck, just as bad as the laws that allow you to bring such complete and utter irrelevancy into the courtroom do. Hopefully that was clear enough, precise legal terminology aside.

The reason that smart people are upset about this is that encryption technology stands a risk of being tarred by the same brush that society is using to paint your basic perv, and that brush is already dangerously out of hand.

And they are absolutely right. That could happen.

Re:Encryption use != evil

[Anonymous Coward]

the judge is wrong.

That's like saying locking your doors is evidence you knew you were doing something wrong while running your meth lab.

Locking your doors is a normal and irrelevant thing-- just like encrypting your data before your send it through the internet.

Re:Encryption use != evil

[Baricom]

If they didn't need the car for the conviction, why should they need the contents of the encrypted files?

Re:Encryption use != evil

[Wavicle]

This case would be more analogous with the following added and modified components:

FBI: You Tried to launder money to the Soviets, didn't you?

Person: No. I didn't.

FBI: We caught you exchanging money with operatives in soviet russia.

Person: I didn't know that was wrong.

FBI: We found encryption software and encrypted files on your computer from the same time we caught you exchanging money with the soviets. You knew it was wrong.

Person: Encryption is irrelevant to this case!

Re:Encryption use != evil

[mboverload]

How are you "coerced" over THE INTERNET?

Re:Encryption use != evil

[mboverload]

The protection form self incrimination applies. You don't need to tell the police the combination to a safe, you dont need to tell them the combination to your PGP disk.

Re:Encryption use != evil

[Green Salad]

You mean you'd let actual facts get in the way of a good discussion? So be it.

Knowing he was doing something wrong has more to do with eliminating the insanity defense than establishing guilt in a crime. Sheesh! I thought everybody who watched "Law and Order" on TV knew that. You guys spend too much time on the net when you could be watching TV.

Re:Encryption use != evil

[Wavicle]

If the police have a search warrant that includes the contents of those encrypted files you would have to turn over the key the same way you would have to turn over the key to your safe if they have a warrant.

Can you provide any case law to support this? It is my understanding that, under the 5th ammendment, the court can only compel you to do so if you are given blanket immunity for any crime that might be uncovered by what is discovered in either the files or the safe or you voluntarily give them the key. No warrant or other court order can ever force you to incriminate yourself.

Re:Encryption use != evil

[textnode]

( Poster.Has("Girlfriend") && Poster.Is("Slashdotter") ) I think not!

Re:Encryption use != evil

[kpansky]

Umm... you just pointed out the very obvious conundrum when anyone pleads the fifth. Its not a failure of the judge, its a consequence of logic.

Anytime you plead the fifth you most likely have something to hide (maybe not directly relevant to the case, such as a mistress).

Re:Encryption use != evil

[Doomwizard]

Ok, but consider that if you buy 30 feet of plastic sheet, a shovel, 20 lbs. of lime and a map of the near-by wilderness, those things are going to be entered as evidence also.

I think you might have over-estimated the impact of this news.

Re:Encryption use != evil

[drgonzo59]

I don't think the car analogy works. The car would be in your driveway, while the laptop would be in a public place. If you had sensitive information there, say you worked for CIA or FBI, that someone could steal, then I think you,the owner of the laptop, should be partially liable. The homework is somewhere in between. You shouldn't expect total privacy at the university but homework is also not quite a top secret and classified document. I did have my backpack stolen in the library of my university when I fell asleep. I really felt stupid telling the police that I left it open beside my desk couple of feet away from where I dozed off. I blame the thief but I also blame myself for not taking care of my stuff better.

Re:Encryption use != evil

[Anonymous Coward]

It's called grooming and there have been cases of kids meeting up with and being attacked by people they met over the Internet.
In the UK there are laws against this. See: http://www.timesonline.co.uk/newspaper/0,,173-1132 151,00.html

Re:Encryption use != evil

[GoCoGi]

For such cases StegFS http://stegfs.sourceforge.net/ or something similar is wonderful. You turn over some keys, but not the ones that can access the sensitive hidden data.

Re:Encryption use != evil

[Anonymous Coward]

"From long before the age of legends blurred into the dawn of history": sorry, my friend, it might not be justified to indict you based on using cryptography, but for cliche and an inflated sense of your own creative ability, GUILTY!

Re:Encryption use != evil

[Patrick May]

Anytime you plead the fifth you most likely have something to hide

Not true. If the state is attempting to prosecute me, I have every reason to just keep my mouth shut. There is absolutely nothing I can say to them (as opposed to my own lawyer) that will improve my situation. The default position should be to take the fifth.

Re:Encryption use != evil

[Anonymous Coward]

Perhaps he is not marketing to elitists with an inflated sense of their own artistic tastes. I bet you enjoy anime. I would put money down... that you enjoy hentai.

Re:Encryption use != evil

[kyb]

The only way we'll sort this out is for programs like Thunderbird to come with GnuPG and enigmail installed as default. As long as it requires an hour of extra downloading and fiddling with the setup to be able to encrypt email and files well, then of course any encrypted file or email will draw official attention.

If we want freedom of speech on the internet then encryption must become pervasive, and fast - before the laws solidify.

The only way for this to happen is if every open source program that can sensibly make use of encryption insists on having it set up during the install step.

Re:Encryption use != evil

[calambrac]

Here's the analogy: it's legal to go to a salvage yard. It's illegal to steal someone else's car. A way to profit from stealing a vehicle is to salvage the vehicle. If the only information you have is that a person visited a salvage yard, there is no way you can prove that the person stole a particular vehicle. However, if you have other evidence that a person stole a particular vehicle, the information that the person also recently visited a salvage yard becomes relevant, in that it provides a legitimate explanation of why the car cannot be found.

Applying it back to the case at hand: it's legal to use encryption software. It's illegal to possess child pornography. A way to hide child pornography is to encrypt the child pornography. If the only information you have is that a person uses encryption software, there is no way you can prove that the person possesses child pornography. However, if you have other evidence that a person possesses child pornography, the information that the person uses encryption software becomes relevant, in that it provides a legitimate explanation of why the offending material cannot be found.

IANAL, so I don't know if this line of reasoning is a valid legal argument, but this was how I understood the comparison the GP post was trying to make. I'm not awake enough to decide if I personally think this should be valid or not...

Re:Encryption use != evil

[bani]

So in other words, if I have a grudge against you and I know you encrypt your private data (say, credit cards, financial data, maybe an embarassing adulterous fling or two), I can make a false accusation of child porn against you.

The police don't find anything on your PC, but hey -- you have encryption! That means you must be hiding something incriminating. And oh, you can't provide proof that you're not hiding encrypted child porn, so we're going to assume you are.

Sounds very convenient to me.

Re:Encryption use != evil

[Jace of Fuse!]

This case could be more amusing with the following added components:

FBI: You Tried to launder money to the Soviets, didn't you?

Person: No. I didn't.

FBI: We caught you exchanging money with operatives in soviet russia.

Person: When?

FBI: You know when.

Person: I do?

FBI: Just answer the question.

Person: What question?

FBI: Uh. Encryption! You have encryption software on your computer, don't you?

Person: Yep.

FBI: So, you have something to hide.

Person: Sure, my credit card numbers that I use on line, personal data that could be used for identity theft, business correspondence I don't want my competitors to read, accounting data, that kind of stuff.

FBI: So, you could use this program for illicit purposes.

Person: Why? You wanna see?

FBI: Got any good porn?

Person: Sure. What do you like?

FBI: Children. Young boys preferably.

Person: Man, I'll bet you get to see some really freaky shit in your line of work.

FBI: Man, we feds have the largest porn collections anywhere. And the best drugs, too.

Re:Encryption use != evil

[gartogg]

This case would be more analogous with the following added and modified components:

FBI: You Tried to launder money to the Soviets, didn't you?

Person: No. I didn't.

FBI: You use encyption software.

Person: In Soviet Russia, encryption software uses you!

Re:Encryption use != evil

[Anonymous Coward]

So here it is my gentle little nerd friends... the root of the issue is above.

If perv had bookshelf, and had hid the pictures of a 9yo girl/boy with legs akimbo in said bookshelf it would be a damn sight more relevant than the fact that he had PGP installed on his PC. There is no suggestion that encrypted files were found so this is not the damning piece of evidence you paranoid little sunlight dodgers think it is.

Basically this sicko pervert kiddie fiddler was caught with a whole load of evidence proving quite conclusively that he had done some horrific things to the next generation and as a sideline there was a small amount of evidence that he may have had intent to try to cover his tracks.

This is like walking into a tobacco company office and finding a memo dated in the 50's from the CEO saying 'yeah we know smokes are REALLY bad for people but fuckit, why don't we keep selling them' RIGHT NEXT TO THE SHREDDER. It is the document that is the damning evidence however the shredder may be considered relevant in some small way as a means of covering up this evidence.

HOWEVER NO F**KER IS EVER GOING TO TRY TO BAN SHREDDERS!

And that means that in this case:
NO F**KER IS EVER GOING TO TRY TO BAN PGP BECAUSE OF THIS CASE!

In case any of you long haired bandwidth monkeys did not read that correctly I shall repeat.

NO F**KER IS EVER GOING TO TRY TO BAN PGP BECAUSE OF THIS CASE!

PGP is a small factor in this case, hell it is not really a factor at all. The guy was not convicted for having PGP he was convicted for TAKING OBSCENE PHOTOS OF CHILDREN

Now as for the 'how will this affect those who have EFS on their Windows box or encryption on their Mac or the triggers to the worlds nuclear arsenals on their Linux boxes'

IT WON'T

Say there is a hit and run...

You have a driving licence.

Not particularly relevant.

Say there is a hit and run...

You do not know how to drive.

REALLY RELEVANT
Because if you can't drive, odds on you were not out driving around at the time the hit and run happened.

Say there is an armed robbery...

You own a gun which has recently been used

Maybe slightly relevant.

Say there is an armed robbery...

Everyone in your street/block/state/country owns a gun which has recently been used

NOT AT ALL RELEVANT

So if you have not figured it out by now...

If everyone has encryption software then it ceases to be relevant in cases like this. It is only now because PGP and the like is the preserve of the penguin hugging elitist coffee slurpers that it can be considered relevant.

So, the moral of the story is stop whining about how the government is clearly trying to prevent you from hiding the fact that you could be jerking off to pictures of little girls and concentrate on explaining to people out there that PGP is little more than an envelope for your email, a safe for your documents and a lock for your front door.

Re:Encryption use != evil

[Fred_A]

If you install pretty much any Linux distribution, GPG is part of the basic package install (usually to check the package signatures).

All Linux users therefore have criminal intents.
At least in Minnesota.

And at the rate the US exports its legislation, I might as well start learning Windows now before the men in black come knocking... :-/

Re:Encryption use != evil

[mrogers]

Nice server you got here. Sure would be a shame if it ended up on the Slashdot front page...

Re:Encryption use != evil

[ninewands]

RTFA. It said no encrypted files were found on the computer. He was convicted on the testimony of a 9 year old "model" he had photograpehed and a repeated history of web searches for "Lolitas."

This ruling is really really evil. It could be extended to "Having nmap and ethereal installed on your computer is evidence of criminal intent of to crack systems."

Re:Encryption use != evil

[Anonymous Coward]

The law does make provisions for intent. For example, it's a more serious crime to plan and kill someone than it is to do it in the heat of passion. It also establishes a predecent for criminal cases that encryption of incriminating data can be used to rebut a "I didn't know it was wrong" defense. I can't see that defense working for a child porn case, but I'm sure there are other crimes where it would be useful.

Legal arguments aside... Be honest. I bet you'd feel more comfortable, as a jury member, voting to convict a guy if the prosecutor could demonstrate the defendant knew what he was doing was wrong. It may mean the difference between "Deranged individual who thought he was expressing his love for a child" and "Sick bastard who needs to be locked away forever." Remember that the legal definition of "sane" is way looser than the everyday definition!

Re:Encryption use != evil

[Macgruder]

The argument is something like this...

State > "You have kiddie porn on your PC"

Defendent > "It's not mine! I got from surfing the web, and accidently clicked a link"

State > "If it was an accident, why did you encrypt it and archive it, instead of erasing it? Hmm? Hmmm? HMMM?"

Defendent > "Damn"

The presence of an encryption program (in this case, PGP) merely contributes that the defendent KNOWNINGLY did somethin illegal (by trying to hid his trail), and it wasn't a mere accident.

Re:Encryption use != evil

[anthony_dipierro]

The particular reason for encrypting certain documents may be so that your little sister won't read your diary. You don't care if she reads your term paper, so it isn't encrypted.

Anything's possible. It's up to the jury to decide whether that's reasonable. Maybe the guy didn't even have a sister. If he did, and the sister regularly used the computer, then maybe this is something the defense could bring up.

TFA doesn't say that the man used encryption to cover up illegal activity, but that the very existence of PGP itself indicated criminal intent, which is ludicrous.

If that's true, then I'd suggest TFA is wrong. Her's what I read:

"We find that evidence of appellant's Internet use and the existence of an encryption program on his computer was at least somewhat relevant to the state's case against him," Judge R.A. Randall wrote in an opinion dated May 3.

Without knowing more about the case, I can't say if I agree or not.

Re:Encryption use != evil

[s4m7]

Wait a minute... if they had the "smoking gun" documents already, why would it matter if he shredded his copies? If they did not have the "smoking gun" documents, how do they know they even exist? If they knew they existed, wouldn't that have allowed them to make copies?

I think you are hitting a key point here which the rest of the "it's not that big of a deal" crew is missing.

Think Framer intent. They honestly wanted us to be free to criticize the government both publicly and privately. This is a concept which is steadily losing ground thanks to "the war on terror" and really was already going by the wayside as early as the first wiretapping provisions.

If the shredder metaphor holds (which it doesn't as I'll soon show) then you are assuming without any evidence to base the assumtion on, that the shredded document was in fact incriminating. People shred all kinds of innocent , but, say for the sake of identity theft or a host of other reasons, potentially damaging, documents. A pile of shredded paper does not, as grandparent implies, constitute an attempt to cover up anything, until said documents are reassembled and demonstrated to represent such an act. Any interpretation of US law that suggests that "because it might be wrongdoing, it is wrongdoing" is a downright travesty..

Further, the fact that encryption software of some kind is defacto installed on every modern OS, and as components of most major software packages, is another reason the presence of it implies no guilt. If every office came with a shredder...

The real kicker for me is that the only way to refute the implicit assumption of guilt is to turn over your keys and expose the hidden data. What if these were unpatented trade secrets which then some member of the courtroom decided to patent on their own? What if they were secretive cries for the dismantling of the federal system? Any cry for some political cause which is unpopular with the majority of jurors will surely set back the defence, whilst having no practical bearing on the case at hand.

Now the thing about a document shredder is, if it does its job, the document is unrecoverable, including by the shredder and not just the prosecution, or officers of the court. Encryption software, on the other hand, allows the keyholder to decrypt the information therein, so it is not by any concievable stretch of the imagination destroyed, only hidden. for which, in a free state, there are innumerable reasons to do so for any type of document, depending of course on your level of trust of those around you, including any law-enforcement which has jurisdiction over you.

The only reason I could see this being admissible evidence is if the defence pleads insanity, and then only if the prosecution is capable of proving beyond a reaonable doubt that the encrypted materials in fact are evidence in the case that the defendant was trying to hide. it's much easier to prove that an unencrypted document matches an encrypted one than trying to unencrypt a document without having any clue what the content might be.

Re:Encryption use != evil

[TheKnave]

Criminal intent... possibly more to the point is conscious knowledge of willful wrongdoing.

If you're a paedophile you're probably pretty sick in the head. However, if you're a paedophile who encrypts his (or indeed her) stash then you obviously know you're doing something wrong and want to avoid being punished for it.

It'd be pretty hard to plead insanity to such a calculated and premeditated action.

On the other hand, if the encryption software hasn't actually been used for that purpose... then nothing much has been proved at all.

So - I suppose the answer is - yes - it may be relevant. If it isn't (hasn't been used specifically for that coverup) it'll be a bit of a gift to the insanity plea defence.

Re:Encryption use != evil

[anthony_dipierro]

Locking your doors is a normal and irrelevant thing-- just like encrypting your data before your send it through the internet.

If all he had on his computer was a web browser with HTTPS, that'd be true. But he had PGP, which isn't very common at all. Should we trust a jury to make the right decision when given this evidence (along with presumably a defense showing just how many other reasons he could have had PGP)? I really don't know. I suppose it depends in part on how strongly the defense objected to the evidence before it was presented. Since he wasn't actually using the PGP to encrypt anything I would probably lean toward not admitting the evidence. But is this reversible error sufficient to overturn a ruling? I can't say it is without knowing the details of the case.

Re:Encryption use != evil

[anthony_dipierro]

Don't exaggerate. This ruling wasn't that anyone with PGP has criminal intent. It was that a judge admitting the fact that the criminal had PGP into evidence wasn't reversible error. If pretty much every Linux distribution had GPG included, and you had such a Linux distribution, it would be quite easy for the defense to put this into evidence.

Re:Encryption use != evil

[Performaman]

It sounds like the inclusion of PGP as evidence is similar to the way that accounts in the Caymans are used in fraud cases. Yeah, it's not illegal, but it is very likely that it helped the defendant do something illegal.

Re:Encryption use != evil

[The-Bus]

So, for some things in the mail you might send via a plain old envelope. Other things might be sent via mail with a security envelope.

By the judge's opinion, the things sent via mail with a security envelope are illegal.

This sets a bad precedent. Child pornographers are depraved monsters. However, using encryption should not make anyone automatically a child pornographer.

Re:Encryption use != evil

[anthony_dipierro]

This wasn't about an insanity defense, which is an affirmative defence which would have had to have been raised at the beginning of the trial. Rather, this is about the mens rea element of the law.

I know you've heard that "ignorance is no excuse" for the law, but that's a gross oversimplification. Rather than explain mens rea to you, I'll point you to the Wikipedia article, which does a better job of it than I can.

In New York v. Ferber, 458 U.S. 747, 765 (1982), the Supreme Court upheld a broad child pornography statute but cautioned that, "[a]s with obscenity laws, criminal responsibility may not be imposed without some element of scienter on the part of the defendant."

Re:Encryption use != evil

[FhnuZoag]

Why not draw an analogy with search warrants?

Being forced by a warrant to admit police into your house is pretty similar to being requested by law to give up your encrypted data. The first is not a fifth amendment issue, so the second should not be either.

Maybe?

Re:Encryption use != evil

[zotz]

"[Jury member takes note: "Linux newby. Doesn't know just what the vast majority of the software that came with his distro is or does, yet."]"

Linux - plausible deny-ability comes standard.

all the best,

drew
--
http://www.archive.org/search.php?query=creator%3A %22drew%20Roberts%22

Re:Encryption use != evil

[anthony_dipierro]

I can guess at why the prosecution would want to get this evidence in the record and why it would be admitted.

Sure, to prejudice the jury by introducing facts that they aren't going to understand.

if there is other evidence suggesting you have bad files and you have intentionally made those file unreadable, the tools you used to do that are possibly relevant.

OK, but what if there isn't evidence suggesting you intentionally made those files undreadable? "The court didn't say that police had unearthed any encrypted files"

Kind of like pointing out the defendant owned a shredder, there was huge pile of shredded paper by it, and the "smoking gun" documents are no where to be found.

In this case though, they seem to have merely pointed to the existence of the shredder in the first place. Of course, I haven't read the actual ruling, as I can't find it. But from what I read in the article it seems that erred in allowing the evidence. Whether or not that amounts to reversible error I won't even speculate, though.

Re:Encryption use != evil

[Snaller]

Again, they're not suggesting everybody that has encryption software knows they're doing something wrong

Just that they all have something to hide from the police state. And that must be wrong, surely?

Re:Encryption use != evil

[Maestro4k]

I'm not saying the guy accused of the crime shouldn't produce keys, he obviously was doing something totally heinous by photographing a 9 year old in sexual position, and then those pictures destroyed. Predators of this nature are f-ing sick creatures that need some bad rehabilitation. In the US I don't think you can be forced to hand over your encryption keys as the 5th amendment applies. So from a stance of what is and is not allowed by the US constitution, no he shouldn't (and likely can't) be made to turn over his encryption keys. The nature of the crime isn't important, the precedent would have horrid implications for all of us. Personally I'm not willing to give up my 5th amendment rights even if this guy did everything he's accused of. They'll just have to find another way to convict him that doesn't trample his rights.

I should note that I agree about people of this nature needing rehabilitation (and using the word predator is in bad form, you've already convicted him of the crime and are using an emotionally charged word to draw negative responses towards him, whether intentionally or not) but the US justice system has an extremely poor track record of rehabilitation for ALL criminals across all areas of crime. They're even worse when it comes to dangerous sex offenders (leaving out the statutory rape and mooning offenses here). The advent of Megan's Laws has made the situation worse -- requiring sex offenders to register is seen as a way of keeping them in check, whereas the reality is it just makes it a tad easier to find suspects when some child goes missing.

If we, as a society, really want to stop this type of stuff we need to invest in really working on rehabilitation and treatments. The current standard treatments are all positive and negative reinforcement routines and those require the active cooperation of the offender (so if they want to lie about what they're thinking the treatment will have no effect).

Re:Encryption use != evil

[gmag3]

Actually, in civil cases in U.S. federal courts, adverse inferences may from the assertion of Fifth Amendment rights. See Baxter v. Palmigiano, 425 U.S. 308 (1976).

Re:Encryption use != evil

[Anonymous Coward]

This is an outstanding idea however it has one flaw... the whole ethos behind firefox and thunderbird is that you get the basics and you add what you want. If you want an overloaded feature set with a whole bunch of sh!t you do not actually want just head to Redmond.

It appears you are writing a letter... do you want me to help you?

Re:Encryption use != evil

[quintiusc]

Written documents are no longer protected forms of speech when it comes to criminal prosecutions. Before people start complaining that this isn't right it's been this way since before you were born. In fact, it's been this way since about when the Magna Carta got passed. Before that private diaries weren't admissable in court. After that they were fair game.

I regard this as a good thing because crooked lawyers could argue that a signed check is protected under the fifth amendment and keep legitamate evidence out of the court.

Re:Encryption use != evil

[Ithika]

You're assuming he *did* save and encrypt the alleged files. They're not mentioned anywhere in the articles I've read; merely that he had software installed. Considering most Linux distros come with GPG, Mac OSX comes with FileVault and Windows comes with EFS this proves nothing.

If he *had* encrypted files, then they'd have evidence to show for it - a virtual "locked safe", which at the very least arouses suspicion. Just having a safe with nothing in it implies nothing.

I think, apart from ignorance of the prevalence of encryption technologies in computers, the judge is conflating cryptology with steganography. Encrypting the files would make them more obvious, and couldn't account for the fact that they are not to be found.

It's my opinion that the prosecution are encouraging this confusion in an attempt to vilify the defendant, to gloss over that fact that their only other evidence is the word of a nine-year-old girl. If there is more to the case I'd be interested to find out what, but the articles I have read do not reveal much:

http://www.corante.com/importance/archives/2005/05 /24/mere_presence_of_encryption_on_pc_relevant_to_ criminal_acts.php
http://techdirt.com/articles/20050524/1639237_F.sh tml

Re:Encryption use != evil

[quintiusc]

One thing you forgot to mention is that this was the ruling of an appeals court. The fact that he had PGP on his computer was mentioned in the case but what he was really convicted on was personal testimony of some of the girls.

If the appeals court had said that PGP had absolutely no relevence to the case the perv would have needed to be retried (at the taxpayers cost) just to get convicted based on personal testimony again. By saying that the fact that he had PGP on his computer was relevent the judges were saying not that it was a criminal act but that whatever was said about it (which isn't mentioned in the article) applied to the case enough to not throw it out. This is like a phone call that has a little relevence to the case but isn't the bulk of the prosecution's argument.

Re:Encryption use != evil

[jack_csk]

Those judges that have the mindset of encryption = criminal intents really push United States closer to a police state (I am not saying countries that outlaw encryption, such as France, are not).
So far, PGP / GPG might be needed for any communication mean that the users don't want the e-mail content being sniffed. Encryption itself does not tell if you are police or criminal - it just encrypts.

Or shall we worry if the administration has plan to require PGP/GPG users to submit their secret keys for easier decryption?

Re:Encryption use != evil

[arkanes]

Apparently, the existence of PGP (not of encrypted documents, note, simple the existence of PGP) was used as evidence in his trial. His appeal claimed that evidence was irrelevent and should not have been admitted. The appellate court ruled that it's appropriate to present the existence of an encryption program as evidence of criminal intent, *even in the absence of any supporting evidence* is reasonable. The guy is trying to get off on a technicality, but the judge is going the wrong way in closing off that loophole. His Internet use is more reasonable, although "lolitas" is a common porn term for young(ie, "just turned 18") girls and a web search for that is unlikely to turn up anything more illegal than a regular porn search (say, "boobies") would.

Re:Encryption use != evil

[arkanes]

It sounds like they had all the evidence they needed. I don't think anyone believes that had the state not brought up the existence of PGP, the guy would have been acquitted.

The whole point of the appeal is that the evidence was irrelevent and that it may have influenced the jury. If it's not relevent, then the prosecution has no business bringing it in the first place, for exactly this reason - this guy will appeal again, and I hope that a higher court rules differently. And wouldn't it be fucking terrible if this guy is guilty, and he gets off because some dumbfuck of a DA decided that having encryption software was worth introducing as evidence?

Re:Encryption use != evil

[arkanes]

TFA excplicitly states that the case made no mention of encrypted files being found, only of the software being present. The existence of kiddie porn is evidence, the existence of software is not. In fact, according to the summary, no kiddie porn was found at all - he was convicted on the testimony of a model.

Even if there were files found, a simple re-reading of your argument clearly points out the fallacy. The existence of the *encrypted kiddie porn* is the evidence, not the existence of software which may or many not have been used to encrypt that file.

Re:Encryption use != evil

[Doctor_Jest]

True,

But thankfully, (well until recently I can't believe I'm saying "until" about the 4th amendment..yeesh!), it still required a judge to get to the search/seizure. A guy couldn't come up to the cops on the street and say "X has illegal Y in his house", and the cops rush over there to get whatever "Y" is without first going before a judge and presenting evidence. Not every judge is swayed by witness testimony alone either. There are exceptions to every rule, of course.

It was made deliberately difficult to do for the express purpose of privacy, as well as the paper trail necessary to nail the abusers of the court. (of course there are probably a few that get through with bogus witness testimony....but conspiracies like that require a lot of work, thankfully.) If you don't get buy-in from the incidental players in your conspiracy, they'll roll over on you under the slightest pressure. :)

Of course, that's all a big wash now with the Patriot Act...

Re:Encryption use != evil

[LWATCDR]

Why should he not have to produce the keys? With a court order there is no longer a right to privacy. The constitution protects you from illegal searches not from legal searches. Your medical records, bank transactions and telephone bills. Why should you not have to turn over encryption keys?

Also being a victim of a pedophile has nothing to do with how smart a child is. A brilliant child could still be a victim of a pedophile.

Re:Encryption use != evil

[gr8_phk]

"However, if you have other evidence that a person possesses child pornography, the information that the person uses encryption software becomes relevant, in that it provides a legitimate explanation of why the offending material cannot be found."

If you don't have the offending material, you don't really have a case do you? Oh, but in this type of case you may have a kid testifying, and then a refusal to provide the decryption key looks pretty bad. OTOH, how bad does it look when someone reserves their right to not testify under the 5th amendment? It doesn't mean their guilty, but most people would hold it against them at least a little. So did this guy hand over the keys or is he keeping a secret? If he hands over the keys then there isn't any reason for their existence to suggest anything. Time for me to RTFA :-)

Re:Encryption use != evil

[swv3752]

Circumstantial evidence is not evidence nor may it be used in a court of law. For those that don't get it, encryption software is cricumstatial evidence.

Re:Encryption use != evil

[Aeiri]

Why should he not have to produce the keys? With a court order there is no longer a right to privacy. The constitution protects you from illegal searches not from legal searches.

If the feds find a safe they cannot crack, do you have to supply a combination? I'm seriously asking, as I'm unsure.

I thought that this sort of thing would fall under the "right to remain silent". You have the RIGHT to not incrimination yourself in a crime. Does encryption/safe combinations fall under this, or does it?

The problem with forcing this guy to do reveal this information is that now they can force ANYONE by precedent to reveal encryption keys. I don't like pedophiles either, but I also don't want random people rummaging through my personal affairs.

Re:Encryption use != evil

[Anonymous Coward]

Right to protection against unreasonable search and seizure has been held by the court to be in effect a right to privacy. If you've ever bought a condom in your life, you've probably exercised the rights granted under that court case (a court case in Connecticut overturning a law against birth control as an unconstitutional infringement to the right to privacy).

Re:Encryption use != evil

[Sgt_Jake]

in Soviet Russia, your money launders YOU! (jesus... I'm sorry. I don't know what happened there but I couldn't stop myself...)

A right to privacy _is_ guaranteed (currently), and you don't have to defend your use of tools to help insure your privacy. This guy wasn't protecting his privacy, he was trying to hide his illegal child pr0n. Your right to privacy isn't going to protect you if you have a safe full of cocaine either, but if your on welfare and have a $3000 safe full of coke... you bought the safe to protect your coke, not your privacy (and it'll be used as evidence that you weren't just 'holding it for a friend'...). The guy that locks his pr0n in a safe is a guy who knows it's not normal pr0n. Or he's way too into bondage...

[btw - I didn't RTFA, i'm just assuming they meant he's encrypted the files on his hard drive that held those files, so ... ah, there you go.)

Re:Encryption use != evil

[PingXao]

If I could mod this higher than 5 I would. The day is not so far off when everyone will have to prove themselves innocent on a regular basis. That's the reason I'm against drug testing. Not because doing drugs is a good thing, but because it's a matter of privacy.

It started with the testing of transportation and safety workers because, well, nobody wants their train driver to be spaced out on drugs. Then it spread to testing grade school and high school students because no parents want their kids on drugs.

Now it has spread to professional sports in a big way. Somebody tell me again, please, why it's so important that Congress get involved in the whole steroid issue? Who's lives are at stake if Major league Baseball doesn't test for steroids and there are players using them?

We really need a Constitutional Ammendment that strongly protects citizens' privacy in no uncertain terms. But I'm not holding my breath. Every special interest group in the country would fight against it tooth and nail, from marketing firms to law enforcement.

Re:Encryption use != evil

[Aeiri]

I don't think the car analogy works. The car would be in your driveway, while the laptop would be in a public place.

A parking garage is a public place.

Re:Encryption use != evil

[NekkidBob]

I don't know, declaring encryption use as criminal intent could have it's benefits. Now, all the US Government is evil and has criminal intent. But then most of /. thinks that anyway without a Court ruling this, except now State governments think it too.

Re:Encryption use != evil

[datajustice]

This ruling would have been unlikely for any case except child pornography. Child pornography is so inflamatory that bad case law seems to be the rule rather than the exception.

I have worked for both the prosecution and the criminal defense sides of child pornography cases. I have watched the jury members when they are forced to view the vile images of babies being raped. They want someone to go to jail for making them view the pitures. Judges are frequently not that much different than jury member and they are also repulsed by the images. The impartial stand on rulings must be very difficult when they too are repulsed by the photos.

In addition to this case I know of a court case that essentially ruled, If you receive an illegal file and delete the file, you had control of the file because you deleted it, therefore you possessed the file.

Have you ever had your browser hijacked?

Did you delete the files your received while hijacked?

Turn yourself in.

With child pornography and computers there must be a friend of the court to give a professional unbiased opinion about computer evidence. In our adversarial system frequently the side with the best lawyer wins. I have found this to be very true with electronic evidence because technology changes so fast the courts can't keep up. If a win at all costs lawyer finds a qualified expert the case law will continue to be bad and restrict the honest citizen.

Re:Encryption use != evil

[99BottlesOfBeerInMyF]

Consider the following analogy: I murder someone on the street and flee in a red car. An eyewitness can't identify me but testifies that they saw a red car speeding away. The state introduces my auto title showing that my car was red.

Your analogy is flawed and I'll show you why this is a concern.

Consider the following analogy: I murder someone on the street and flee and I'm black. An eyewitness can't identify me but testifies that they saw a black man running away. The state points out that I'm black.

Is the fact that I am black relevant? Yes it is, but it is also possibly prejudicial since many people are prejudiced against blacks. Now in this particular case, no one saw a red car speeding away, or a black person, or any use of encryption to hide child pornography. This is a lot more like the following:

Consider the following analogy: I murder someone on the street and flee and I'm black. An eyewitness can't identify me and does not know the race of the person running away. The state points out that I'm black.

You see where this is a problem?

Re:Encryption use != evil

[Intron]

US law protects you from self-incrimination. You cannot be forced to deliver anything that can be used against you.

Re:Encryption use != evil

[Anonymous Coward]

hmm... first, let me say that i am an advocate of privacy, i derive a modest sense of enjoyment out of messing with public databases (e.g. trading "customer appreciation" cards with strangers, &c.)... but:

You might as well say that "The fact he knew that what he was doing was wrong was supported by the fact that he didn't tell anyone about it."

that's not a valid comparison.
not telling anyone about something is a passive case of inaction.
encrypting files is an active measure.

perhaps a better analogy would be:

You might as well say that "The fact he knew what he was doing was wrong was supported by the fact that he did it in a windowless, soundproofed extension which he had dug under his basement."(sic)

Re:Encryption use != evil

[crowemojo]

I think, apart from ignorance of the prevalence of encryption technologies in computers, the judge is conflating cryptology with steganography. Encrypting the files would make them more obvious, and couldn't account for the fact that they are not to be found.

This is only true if he was using PGP to individually encrypt the files. If he instead had a PGP disk, then there is no telling what is on that disk, just how big the disk is. It could be 100 megs of encrypted empty space, but then again, it could be thousands of pictures of child pornography, but all you see is a single flat file, disk.pgd

Something tells me that if he was trying to hide his tracks, he wouldn't have files like kiddieporn.jpg.pgp laying around.

Re:Encryption use != evil

[(H)olyGeekboy]

Circumstantial evidence is not evidence nor may it be used in a court of law.

What planet are you on? Defense attorneys may use the prosecution's circumstantial evidence to point out a weak case and try to create reasonable doubt in the minds of jurors, but evidence is evidence and if it's ruled admissible, circumstantial or not, it IS evidence and it CAN be used.

Re:Encryption use != evil

[nelziq]

IAAL (in training). Circumstantial evidence is used to "prove" many aspects of a crime. For proving criminal mental states such things as intent, you have only circumstantial evidence unless there is a confession.

Re:Encryption use != evil

[Anonymous Coward]

I will repeat what the parent post said -- RTFA. Here's what the judge wrote in his opinion:

" . . .existence of an encryption program on his computer was at least somewhat relevant to the state's case against him."

It's not as if the whole case was built on the fact that he was using PGP. Instead, it was something that the judge felt was relevant. I'm not familiar with the case, but the article doesn't say that he was charged with possession, so I'm assuming the photos were never found. Although, the article did say that they weren't able to get any photos out of the PGP container. The court simply raised the possibility that the PGP container could have been used to conceal these photos. It would have been ignorant and irresponsible to not mention this possibility.

Your post wasn't very insightful at all. It was skewed, wacky, and knee-jerk. Good ole' Slashdot.

Re:Encryption use != evil

[PacketScan]

I Personally Encrypt Everything I can. Why should I leave some information laying around on my computer that a hacker might be able to use to defraud me or worse steal my identity.. If that comment holds up about intent because he had encryption installed.. It surely is a sad day.. Because as we know it Juries are Dumb the lawyers want it that way. If you have a decent head on your shoulders there is a good chance you will not be chosen as a juror

Re:Encryption use != evil

[Bongzilla]

I for one advocate increased access to healthy adult vaginas to curtail the desire among otherwise healthy adult males to search for 2 dimensional static renditions of bizarre sex acts to make them more inclined to have sex with a hand.

I also advocate a healthier sense of our sexuality but, HAHA, yeah right.

Re:Encryption use != evil

[stewarsh]

Actually the Right to Privacy does exist in the United States. It was established as a penumbra from the rights guranteed by the US Constitution by The US Supreme Count in Griswold v. Connecticut (1965).

Re:Encryption use != evil

[Alan]

My point is the attitude of the people. Admission of the fact that he had PGP on his computer shouldn't be a condemning factor of his behavior and should be based on his crimes. NOT THE FACILITATOR, MEANS, TOOL (Physical or otherwise) OR SOFTWARE to commit such crimes. He was using perfectly legal encryption utilities and software.

I thought that this was america, where you sued the fast food companies for making you fat, the cell phone companies for producing a device that allows you to talk while driving and got you in an accident and the camera company for producing a camera that you got punched in the face for taking a picture of sean penn with (old bloom county ref)!

$deity bless the lawyers!

Re:Encryption use != evil

[Anonymous Coward]

"suspected murderer (by gunshot) has gun case, with suspicious empty slot, the outline of a gun faded into the felt backing, but no gun found..." we find this relevant.

Im as much of a freedom nazi as anyone else, but if you have strong valid reasons to suspect someone has done something, and you find circumstantial evidence that they might have done (hiding evidence is more likely when you find encrypted files on a machine) then it does seem relevant to me.

Re:Encryption use != evil

[Rob the Bold]

If encryption software is evidence or criminal intent, then so are locks, car keys, envelopes and phone booths. Why not add doors to that list, too?

Re:Encryption use != evil

[Anonymous Coward]

If you know evidence could be used against you and then go about destroying it, in certain situations the court is entitled to instruct the jury to presume that the destroyed evidence would be harmful to your case.

But encryption does not destroy data.
This is more accurately compared to me locking
my door when I'm not home, and the police then
claiming that as evidence that I must be hiding something I knew was illegal inside.

Re:Encryption use != evil

[Anonymous Coward]

The FA points out that he just had PGP on the drive and that they didn't find any encrypted files. So, does it still mean it should be admisable as evidence?

Re:Encryption use != evil

[Suidae]

Ones Fifth Amendment right to avoid self-incrimination does not apply to the password for encrypted files. This is analogous to not providing the key or combination to a safe that may contain evidence. If the court demands to see what is in your safe or encrypted files, you must comply. Failure to do so will result in contempt of court charges and possible jail time.

If you want more information, you can find articles on the 'net written by real lawyers.

This is why a deniable encryption system like what RubberHose is/was supposed to be is so important. One should be able to give a password to an encrypted system that reveals only the information one choses to reveal, and the system should give no indication of if there is more encrypted information. This is like hiding a safe. If the court doesn't know its there, they can't penalize you for hiding its existance.

Re:Encryption use != evil

[bhirsch]

Call me wacky too, but inferring from that passage that one has the right to anonymously check out communist literature from a public library, though a matter of privacy and anonymity would not seem to be guaranteed right.

Re:Encryption use != evil

[tkg]

IANALEBIWLAOAL (I Am Not A Lawyer Either But I Watch Law And Order A Lot) :o), but I believe intent is one factor that defines the difference between murder and manslaughter. The example you used would likely be manslaughter or, at worst, second degree murder, but not premeditated murder. A charge of premeditated murder (murder in the first degree) requires proof of forethought (premeditation) and intent (if you thought it over, you likley had intent) to kill.

Of course the various charges and degrees are not a means of determining guilt or innocence with respect to the crime of taking a life, but a means of determining the severity of sentence. In this respect, intent is relevant.

Perhaps a real lawyer can enlighten us.

Re:Encryption use != evil

[zoombat]

Yeah, or how about if you had a high security safe in your house with a combination lock? Could you be forced to give them the combination, or could you tell them they had to get their safe-crackers and try to open it themselves?

Re:Encryption use != evil

[amliebsch]

And wouldn't it be fucking terrible if this guy is guilty, and he gets off because some dumbfuck of a DA decided that having encryption software was worth introducing as evidence?

There is a doctrine of appellate law as it applies to the granting of new trials called "harmless error analysis." Essentially, the rule is that the mere fact that a mistake was made during your trial is not sufficient to warrant a new trial (unless it is a constitutional violation.) You must further demonstrate that there was a reasonable likelihood that but for the mistake, the outcome would have been different. Here, that seems highly unlikely.

Re:Encryption use != evil

[A Commentor]

If you know evidence could be used against you and then go about destroying it, in certain situations the court is entitled to instruct the jury to presume that the destroyed evidence would be harmful to your case.

Ok, IANAL, but aren't these "certain situations" for Civil not Criminal cases?

To me, this case would be more along the lines of: Someone was accused of murder, the court allows that they have 'criminal intent' because they own a washing machine and some detergent that claims it can get out blood stains...

Defendent: But.. but, that is just the brand I use to wash my cloths...

Prosecutor: Nope, we see that it helps get blood stains out, you only got this detergent to destroy the evidence, you must have 'criminal intent'...

Re:Encryption use != evil

[forlornhope]

Not exactly. Physical keys are not protected by the 5th amendment. Thats because they are physical and the goverment can demand anything physical from you through due process. But encryption keys tend to be knoledge. Meaning something you know and that is the basis of any testimony. The police/procecutor/etc. asks you a question about something you have knowledge of and you answer. Thats what the 5th amendment gives you protection against.

In fact, I believe that if your door is locked by a key code that you memorized, then the police can't make you tell them the code. They can break the door down to gain access, and in the same way they can break the encryption, but they can't force you to tell them something. Same reason why the police can't make you tell them where the dead body is.

Re:Encryption use != evil

[Artifakt]

IANALE*
A similar analogy would be buying a 55 gallon drum of concentrated H2SO4. It's not illegal (most places), but If there were other reasons to suspect you of a murder, and your defense included demanding the state produce the body to show the victim was actually dead, it would certainly become relevant. You could still defend yourself by producing the unused drum, or showing what legitimate process it had been used for instead to account for any missing volume.
In this case, a legitimate user of encryption could open the resulting files, perhaps in chambers if they were legal but business or personal type sensitive. If they are government type sensitive, it's way past time to get a judge who is recognized as able to review such evidence and let him pass a statement to the trial judge. If you were using encryption for some illegal purpose, but not child porn, you could refuse to open them, but would have to plead the 5th and take the resulting risks.
In this case, there's the software, but apparently no files. Possible defenses still abound. Why hasn't the state found the actual files? Why hasn't the state found extra-strength erasing software to go with the encryption software? Is the state really claiming that the plantiff is simultaniously a highly proficient expert at using encryption software and a clueless newbie at using browser software (so as to leave the lolita references)? Which is it, Mr. DA, which is it? By the FBI profiles, don't most pedophiles collect, and aren't they typically very reluctant to destroy their collections?
If such questions weren't raised, the defendant had an incompetent attourney. Alternately, they weren't brought up because the state had unpleasantly good answers. Or they were raised as needed, form part of the total decision the Jury made, and we are simply not hearing about it in this article.

*I am not a lawyer , either!

Re:Encryption use != evil

[Ithika]

Grooming is nothing like coercing:

coerce
1. To force to act or think in a certain way by use of pressure, threats, or intimidation; compel.
2. To dominate, restrain, or control forcibly: coerced the strikers into compliance.
3. To bring about by force or threat: efforts to coerce agreement.

Coercing is the opposite of grooming - using strong-arm tactics rather than talking/convincing the person of your point of view.

Re:Encryption use != evil

[CharlieHedlin]

Circumstantial evidence may not be strong evidence, but it has certainly been used. IANAL and could be wrong, but it seems I have heard about enough cases being built on circumstantial evidence. Many failed as a result, but there were trials.

Re:Encryption use != evil

[DavidTC]

Manslaughter is weird because it's one of the few times you can have a crime without intent. Or, at least, very little intent.

As far as I know, there is no way to 'accidently' abuse children, so 'intent' is completely irrelevant in this case.

Assuming he's guilty, it doesn't matter if this guy spent two weeks carefully setting up an encrypted system where he wouldn't get caught, or decided to do it on the spur of the moment. That can be a factor in some crimes, but not this one.

And thus I don't know how they'd use PGP to argue that he was planning something. It sounds to me like they're using PGP to argue why they couldn't find any evidence, which is fucking stupid. PGP doesn't hide evidence.

Re:Encryption use != evil

[cbreaker]

"It's my opinion that the prosecution are encouraging this confusion in an attempt to vilify the defendant, to gloss over that fact that their only other evidence is the word of a nine-year-old girl."

This is what's so frightening about the legal system.

I'm a fairly stand-up guy, I try to do what's right and just go about my life. But all it would take is one 9 year old to say I was a child pornographer and I'd be locked up without a key in the mind of the public - with judges that will allow such ridiculous "evidence" into the court room.

While I'm not in a position that this would ever happen, some people are. A swim coach at my old high school got convicted of raping students, only to have the truth come out two years later that it was all just a lie. He was released, but he'll never get the two years back.

I hate child pornography and obviously rape should be punished firmly. But it's a farse that people get convicted of such crimes every single day with testimony only, no evidence.

Re:Encryption use != evil

[Anonymous Coward]

There is a standard joke in the law enforcement community that goes something like this:

What do you call a perp that talked to the police at the scene?

Inmate.

EricF

Re:Encryption use != evil

[DavidTC]

No, you can't be forced to say something that can be used against you. People are ordered to deliver things that can be used against them all the time, hence search warrants and supenaes

That said, yes, the court cannot force you to tell them your passphrase.

They can, however, issue a warrant ordering you to decrypt the files under their supervision, and hold you in contempt if you fail to do so.

The Fifth amendment applies to things in your head. Enrypted files are not in your head, and you can be ordered to produce them in an unencrypted form.

Re:Encryption use != evil

[arminw]

... you would have to turn over the key...

No you wouldn't! Nobody can be legally forced to give evidence that would incriminate themselves. Even if the judge ordered the defendant to give up the keys and the defendant refused to obey, the worst the judge could do is to hold the defendant in contempt. If it was a capitl case, whatever punishment the judge could impose for contempt would be still far less than getting convicted and executed based on the evidence withheld. In this case of course the defandant was convicted by evidence external to the encrypted information.

No one has ever made a physical safe that could not be broken into, but some encryption is considered unbreakable at least for now.

In other countries of course the police will beat the information out of you and summarily shoot you.

Re:Encryption use != evil

[Doctor_Jest]

Anonymity != privacy. (You can be private without being anonymous.)

Buy communist literature with cash (and send someone else to buy it for you if you're really paranoid) if you want anonymity. Privacy means that because you bought a communist book or something of the sort, that does not grant the government the right to search your belongings or personal effects just because you bought a communist booklet or checked it out from the Library. (But hey, the Patriot Act modifies that somewhat... which is, as I mentioned in the original reply, the problem.)

Re:Encryption use != evil

[DavidTC]

What everyone's forgetting is this guy has been charged with taking pictures of children, and even assuming that his use of PGP was to hide stuff, it could easily be to hide downloaded porn.

Now, of course, said porn could be illegal, or it might be 'pretend illegal' (A hell of a lot of 'child porn' is fake. If you see an ad for it, it's probably fake child porn.), or it by be completely legal porn he was trying to hide.

Assuming that 'trying to hide something==that thing is illegal' is idiotic. Plenty of people encrypt perfectly legal porn.

And even if he was downloading illegal child porn, that's not what he was charged with. They're trying to use this as evidence he took pictures, which is just stupid. I'm not pro-downloading-child-porn, but it's not the same crime as making-child-porn.

Re:Encryption use != evil

[megarich]

Your not on trial you don't have to defend why you use privacy tools. And what do you expect from a justice system which lives by rules like "if it doesnt fit you must aquit!"

Anyhow, I can't believe I'm saying this but regardless of my past point, i still think they made a good point using the pgp. No not everyone uses it for evil but you know those who do evil use it. No smart criminal is gonna broadcast their info over unencrypted lines "hey i'm breaking the law here's my info arrest me at will". It's the rats, umm lawyers job to bring up a case anyway possible and if this may help establish criminal intent so be it.

I just think this whole issue is blown out of proportion. I plan to use heavily encryption in the future and you know what, I'm not going to defend it nor care about getting arrested because I'm not going to look at kiddy porn nor do any other nefarioius activities that'll have the fbi breathing down my neck.

Re:Encryption use != evil

[bhirsch]

People infer anonymity from privacy, which they infer from the fourth amendment. Unreasonable search and seizure is not a blanket protection of our privacy. The PATRIOT Act enables law enforcement officials to violate our privacy in various ways, but few people with a strong understanding of the law find these violations unconstitutional, even those judges who tend to apply more expansive interpretations of the constitution.

Re:Encryption use != evil

[arkanes]

I agree, at least on the face of it. He is, naturally, arguing in his appeal that that is exactly what happened. Hopefully, of course, the next level of appeal will reject the lower courts opinion on PGP but decide that it didn't have an effect on the verdict and maintain the guilty verdict. But the possibility of this sort of thing, and "getting off on technicalities" are why DAs should just simmer down. Any time anyone is able to overturn a verdict on procedural grounds, or on technicalities like this, the prosecuting attorneys and other responsible parties (like offices not following rules of evidence, etc) should be censured, instead of the common response, which seems to be blaming the courts and lobbying for the overturn of these technicalities that preserve our freedoms.

Re:Encryption use != evil

[rpdillon]

We're not discussing logic here, we're discussing what is admissable in court. I daresay you would be hard pressed to find a case in which the prosecution is able to make an argument or pursue a line of questioning that uses the fact that the defendedant took the fifth against them.

IANAL, and I certainly do not have a good background in case law, but it would seem unconstitutional to me.

Re:Encryption use != evil

[arkanes]

Incidently, even faked child porn is illegal in a lot of places. There's been some constitutional challenges to these but I'm not sure how they've turned out. I know Ohio had a law that banned even synthesized "child porn" with no actors/models/whatever involved.

Re:Encryption use != evil

[DavidTC]

Intent doesn't matter with child porn. Possession, period, is illegal. Yes, even accidental, so keep the file shredder handy if you're downloading legal porn from unknown sources.

And I really dislike this decision. The only reason PGP was introduced was to put doubt in the jury's mind that he might have encrypted pictures somewhere...which he did not have, or they would have been found, but the jury is probably not familiar with PGP.

Re:Encryption use != evil

[MoneyT]

sigh,

1) Patriot Act does nothing of the sort. No warrants or searches are granted without court oversight.

2) They already had a warrant, the guy has already been convicted. This is an appeal. the fact that they are appealing on something like this shows that they had a warrant and everything was in order.

Re:Encryption use != evil

[DavidTC]

If you know evidence could be used against you and then go about destroying it, in certain situations the court is entitled to instruct the jury to presume that the destroyed evidence would be harmful to your case.

No they aren't. That only becomes true after you've been told not to.

If they cops knock on your door and you run and flush all your drugs down the toilet, too bad for them. If they prove you did that, they have you for the original drug possession, but not for flushing them down the toilet.

It's destroying or tampering with evidence that's illegal, and 'evidence' only exists after the court or police declares something to be evidence and tells you.

In other words, it's perfectly legal to cover up a murder you just committed.

Re:Encryption use != evil

[LWATCDR]

"I thought that this sort of thing would fall under the "right to remain silent". You have the RIGHT to not incrimination yourself in a crime. Does encryption/safe combinations fall under this, or does it? "
No it does not. Can a court order you to surrender documents that may be incriminating? Of course it can. It can not make you testify that your pass phrase is "yummynakedlittleboys" in court but it can make you decrypt those files with a court order.
If not then any company could hide files in some bus locker and refuse to tell where they are because they may incriminate them.
The way the law works is the court can not force you in court to say or write anything that may incriminate you.
Of course you do not random people rummaging through your personal affairs. That is why they can only do it with a court order.

Re:Encryption use != evil

[Anonymous Coward]

The US Supreme Court ruled laws like those are unconstutional about a year ago. The logic is that child porn is illegal because of the inherent harm to minors involved in its creation. If it's faked (3D rendered, whatever), and no child was involved in its creation, it isn't 'child porn'.

Re:Encryption use != evil

[Anonymous Coward]

Actually PGP has had encrypted disk functions for years. I've been using it for 5 years or so.

Re:Encryption use != evil

[Cromac]

Unless, of course, the victim died of a gunshot wound.

Wrong, that still doesn't show intent. That would maybe show means but shows absolutely nothing about intent.

Re:Encryption use != evil

[Anonymous Coward]

It's useless to whine about this here--you're just preaching to the choir. Take it out in the world where they need to hear it.

Re:Encryption use != evil

[Cromac]

How are you "coerced" over THE INTERNET?

Probably the same way they are in person, via threats to the victem or their friends and/or family. A child, hell even some adults, may not be able to see through a bluff threat that gets the pedophile real information to locate the victem.

Re:Encryption use != evil

[calambrac]

Or they were raised as needed, form part of the total decision the Jury made, and we are simply not hearing about it in this article. yes, the probability that a 500 word blurb does not convey the entire body of relevant facts of a legal proceeding is pretty high :)

Re:Encryption use != evil

[Anonymous Coward]

If you had carefully RTFA

I you had carefully RTFA, you would have noted that they apparently did not find any encrypted content.

Re:Encryption use != evil

[bckrispi]

Bullshit! Rules of Evidence 101 will tell you that Circumstantial Evidence is *just as valid* as direct evidence. The questions are 1) Is the evidence relevant to the case at hand. 2) How much faith does the jury put into it.

Tell Scott Peterson that Circumstantial evidence is inadmissable. I'm sure he'll get a chuckle

Re:Encryption use != evil

[Anonymous Coward]

If you had carefully RTFA

If you had carefully RTFA, you would have noted that they apparently did not find any encrypted content.

I own a gun. If someone is murdered in the small town where I live, does this make me a suspect in the case? If you follow the reasoning used in this case it would. I own a gun so I had criminal intent.

Re:Encryption use != evil

[vettemph]

Reminds me of a bumper sticker I saw two weeks ago:

Guns kill people, just like spoons.

Re:Encryption use != evil

[budgenator]

Where I'm from if you leave the keys in the car and it's unattended, you've broken the law and can be fined, if the car is stolen and some 13 year old hooligan kills somebody, the victims can sue you as well as the parents of the hooligan because you've created an attractive nuisance.

Not uses encryption and reasonable time-outs on your 'puter can be used to show a lack of "due diligence" and can get you some substantial fines if the data on your machine is stolen. An unattended lap-top is easily considered an attractive nuisance, perhaps you should consult with an attorney about these issues. I just read in yesterdays WSJ about a company that paid for a years worth of credit monitoring for people at $129.00 a person in regards to a stolen lap-top and personal data lost.

Re:Encryption use != evil

[dewke]

I'm not saying the guy accused of the crime shouldn't produce keys

However horrible his crime, he should not be forced to violate his 5th amendment rights. I don't know of ANY other instance where a defendant is forced to produce evidence to help convict him. Lets hope that the government doesn't go down that track.

Re:Encryption use != evil

[vettemph]

>In other words, if he's hiding something, he knows he has something to hide.

Replace "hide" with "protect".

I'm an inventor who protects all ideas until they are ready for disclosure, usually to my employer. I protect everything I do. You can't rely on Windows to protect your work. Windows will blab everything on your hard drive for a song. Our IT department supplies laptops with encrypted drives so that we can safely take them out of the building.
Even a computer based artist/musician/photographer etc. should protect his/her work until its ready. That what copyrights, trademarks and "evil IP" are all about. You have to prove that you are the original. If someone else releases your work before you, how do you prove anything? An encrypted drive is just a light layer of protection. It's not taboo, Don't let them brainwash us into thinking so.

Re:Encryption use != evil

[Cromac]

How about this---you leave your car parked unattended in your driveway, so it's okay for me to just walk up and take the engine out? Just because something's unattended doesn't make it OK to tinker with!

You're correct, however the law doesn't always look at it that way. In some states/towns you can be ticketed and fined for leaving your car running and un-attended. As you said, just because it's running and no one is there doesn't mean it's Ok to steal it, but you can still be fined for doing so.

Re:Encryption use != evil

[zCyl]

And so it would be, because it directly corroborates the state's theory of the case! It may not be highly probabative as to guilt - but it is in fact relevant, because it strengthens, however incrementally, the state's interpretation of the facts.

As long as this is only used to this extent as a component, then yes, it sounds like valid evidence. If the state's theory were that pictures were being hidden in a bookshelf, and there were no bookshelf, then this would be good evidence that the theory is wrong. However, similarly, if there were a bookshelf and searching through it yielded no such pictures, that would also be evidence. It sounds from the short summaries here like there were no encrypted files found (which would be an important additional component to finding encryption software), but perhaps there were more significant details to this than have been presented here.

You could think of encrypted data in a case of someone already found guilty of something by other means as equivalent to finding a big pile of burnt paper ashes outside of Enron headquarters. Ashes don't make Enron guilty, and having ashes doesn't say what was burnt. But if someone is guilty by other means, and an important piece of paper is missing and a pile of ashes is in its place, then the absence of that piece of paper is not much of a defense. Its absence is also not much of a case alone either, but it can be a component of forming a cohesively whole theory.

Re:Encryption use != evil

[Rakarra]

Ok. Perv has bookshelves. Hides said photos in between the books. The brilliant, insightful courts:

"We find that evidence of appellant's bookshelf use and the existence of books in his house was at least somewhat relevant to the state's case against him"

No, no, no. If you insist on using the bookshelf analogy, then write is as this: "The defendant had a bookshelf that we have reason to believe has been used to hide evidence but the defendant refused to let the authorities search through the bookshelf. We find that refusal somewhat relevant to the state's case against him."

It's not the encryption itself. It's the encryption, the charges, and the defendant's refusal to turn over the keys that gets the perv in trouble with his files.

I doubt that encryption will be banned, but I can see more cases like this where a defendant's refusal to turn over keys will be used against him.

Now.. this is all assuming the defendant was asked to turn over the keys, but he refused. I mean, I can't imagine any half-competent investigator not demanding them! The article doesn't mention it though.

Re:Encryption use != evil

[rleibman]

You don't need to do misterious readings of other ammendments to come up with the conclusion that "The People" have a right to privacy. It is VERY clearly spelled out in ammendments 9th and 10th:
"IX. The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people."
"X. The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people."

Re:Encryption use != evil

[BitterOak]

Interesting reasoning.

So, if they suspect you of murder, but haven't been able to find the body, can they order you to produce it and hold you in contempt for not doing so?

Re:Encryption use != evil

[coopex]

An exerpt:

Those children subjected to the whims of the therapists, the district attorneys, police and parents might have no idea what they're doing, or they might be bullied, forced, coerced into doing so (accepting the suggestions of bizarre abusive behavior). How do you know? Maybe the therapists, the district attorneys, police and parents are related to them?

Check out the truth about children's testimony

DA: Isn't ruining someone's reputation so I can seem successful great?
Therapist:Hell yeah, and this case will finally pay for my new Ferrari.

Re:Encryption use != evil

[Cpt_Kirks]

In theory, yes.

In practice, if the penalty for the crime that will be proven by turning over the body (or passphrase) is more than the penalty for contempt, who would turn over the body (or passphrase)?

Re:Encryption use != evil

[Doctor_Jest]

Uh no. The Patriot Act allows a lousy court clerk to issue warrants (i.e. NOT a judge).

Relaxing that weakens the 4th amendment.

I was not commenting on this guy's warrant per se, rather the implication that encryption assumes guilt.

Re:Encryption use != evil

[Anonymous Coward]

How can it be enforced? If someone is ordered to give the password and refuses to do that - what can they do? Threaten with a harsher sentence if they get convicted? But in that case that someone might gamble and refuse to give the password if the other evidence doesn't seem to suffice to get any sentence (or if that someone knows that the evidence accessible with the password would be evidence of an even worse crime).

Re:Encryption use != evil

[DavidTC]

If you're carrying the body around, yes, in theory. If they know you have it, you have to turn it over.

But they'd have to prove you had it before they could hold you in contempt, and, duh, if they could prove you had it they'd just take it!

But if you want an example: Let's say the police suspect you of murder. But you break and steal the body before they can do an autopsy, and hide it.

The police arrest you for that, and you are found guilty of taking it. At that point, yes, they can order you to hand over the body, and charge you with contempt if you fail to do so.

Re:Encryption use != evil

[philipgar]

... Actually I'm pretty sure the defendent could come to some sort of agreement that any files found to be illegal for other reasons (such as shady business deals etc) can not be used as evidence in future trials. He might have to outline exact stuff thats hypothetically there, but I'm pretty sure such a plea for privacy would be respected to the extent allowable. I'm pretty sure such tactics have been used before in other types of cases, but I don't really know for sure.

Phil

Re:Encryption use != evil

[Anonymous Coward]

The fact that I own a red car is admitted into evidence!

Actually, in the real world it might let the cops get a search warrant but "a red car" is way too circumstantial to be of any value as evidence.

Re:Encryption use != evil

[Anonymous Coward]

I don't want to say this is another 'think of the children' anecdotes, but it is. If younger kids who play sports see their Heros using it, they might feel its the way to do things, without having the foresight or the capacity to understand the side effects of it.

Re:Encryption use != evil

[vettemph]

I forgot to mention that my employer freely hands out 512MB USB Pendrives with encryption.

Re:Encryption use != evil

[Some_Llama]

"People are ordered to deliver things that can be used against them all the time, hence search warrants and supenaes"

Actually I don't think this is correct, the warrant allows the officers of the court to search an area defined in the warrant, it does not force anyone to assist the officers.

E.G. if they are searching your house for a dead body or drugs you do not have to tell them where it is located just because the have a warrant for search.

There was a similar situation that someone I knew experienced.

The officers had a warrant to search his car, they opened the trunk and found a box with a lock on it, they had to get another search warrant for the box and when they did promptly chopped the padlock off the box to open it, the suspect did not have to supply a key even though they had a warrant.

Subpoenas are different as they are issued as an order for an appearance before a court, but even if you are subpoenaed, you do not have to give information that can incriminate yourself.

Re:Encryption use != evil

[Citizen of Earth]

I'm not saying the guy accused of the crime shouldn't produce keys

Also, anyone accused of murdering someone and hiding the body must be required to tell the police where the body is. If he didn't hide any body, then that's just too bad for him. He can spend the rest of his life in jail for contempt of court.

Similarly for any accused of any crime: they must be required to turn over all the evidence that the police want or can spend the rest of their lives in contempt of court.

Re:Encryption use != evil

[DavidTC]

They could have gotten an order requiring him to turn over the key, and technically the search warrant for the box was probably enough.

That doesn't mean they need to, if they can get in another way. (In fact, if he offers them the key, they have to use it, instead of cutting in.)

Re:Encryption use != evil

[LWATCDR]

Easy they are guilty of contempt of court. You go to jail do not collect 200 dollars no nothing. You then have to go to court that you are NOT in contempt of court. In theory they can keep you locked up forever on a contempt charge.

Re:Encryption use != evil

[dilvish_the_damned]

Thats very brave of you to admit your hiding something.

Re:Encryption use != evil

[Majestix]

You sure about that? That doesn't sound right to me. Granted if i murdered someone I would certainly want to cover it up. But the fact that it hasn't been discovered yet doesn't mean its not evidence.

Using your analogy of "flushing drugs". If they can prove that you flushed some drugs you did have, then they have you for "possession" and "destruction of evidence" (or is it tampering). Not only were you in possession of an illegal substance, but you attempted to thwart the police in their ability to bring you to justice.

While i see your point. I would love to hear someone with a legal background respond to your supposition. I think its silly to think that someone who has committed a crime isn't going to try to hide proof of that crime. I'd also like to hear someone define when evidence becomes evidence.

Eh, thats my 2cents.

Re:Encryption use != evil

[Anonymous Coward]

A (quite hypothetical) follow-up question in that case: Do crimes ever expire in the U.S.? I asked the first question but am only familiar with the Swedish and Finnish justice systems and in Sweden all crimes expire after 20 years whilst in Finland some crimes expire after 10 years but serious crimes such as e.g. murder never expire. "Expire" meaning that nobody can be convicted of the crime anymore once that much time has passed since it was committed. The limit of twenty years is a bit of an issue in Sweden right now since it's been twenty years since our prime minister was murdered and no one has been convicted (because the police has demonstrated incredible incompetence but that's another story...).

Re:Encryption use != evil

[Anonymous Coward]

Damnit! I forgot the rest of my question regarding crimes expiring, that is - if crimes do expire after a certain period of time, wouldn't someone in that case choose to be in jail for contempt of court until the (more serious) crime has expired?

Re:Encryption use != evil

[Chandon Seldon]

I'm pretty sure the bill of rights guarantees the right to privacy. The 10th ammendment perhaps?

Re:Encryption use != evil

[Anonymous Coward]

Heck, how can something even be child porn if there is no child?!

Re:Encryption use != evil

[arose]

But he had PGP, which isn't very common at all.

Good doorlocks aren't very common either.

Re:Encryption use != evil

[DavidTC]

Attempting to thwart the police in bringing you to justice is not illegal.

Lying to the police can be illegal. Tampering with stuff that has been declared evidence or a crime scene is illegal. Helping someone else thwart the police makes you an accessory after the fact.

Even just plain screwing around with an investigation underway can be illegal. If someone gets killed and you start laying blood-soaked rags around to confuse the police, even outside the crime scene, you can, and probably will, be charged with interfering with a police investigation.

But hiding a crime you committed from the police is part of the crime. (Hence how helping someone with that makes them an accessory.)

And as such, they cannot charge people for it, anymore than they can charge someone who's speeding at 75 miles an hour for speeding at 74, 73, 72, etc miles an hour as they slowed down.

In fact, if they charged you with interfering with an investigation, they'd probably have to drop the charges if you actually committed the crime.

Re:Encryption use != evil

[Geoffreyerffoeg]

Just because they were for hiding his crimes/pictures should NOT be a factor in his punishment.

Shouldn't it be a factor? This is an appeals court; he was already convicted. Once the lower court decided he was a child pornographer, it becomes far more relevant that he has encryption. It's kinda like owning a book on how to pick locks isn't a crime in and of itself, but it becomes important evidence once you're on trial for breaking and entering, and really relevant once a lower court has convicted you. You are already believed to have committed the crime; the job of the appeals court is to see if that conviction was false, not to redetermine the whole thing starting from tabula rasa.

Re:Encryption use != evil

[Anonymous Coward]

Exactly. He is a convicted pedophile and he had tools that would help him facilicate whatever he was doing even more.

Come on people. If cops made a drug bust and found the guy with a lot of money and some guns (and some drugs) they would assume he was dangerous. If they pulled someone over in a routine road stop and they found nothing but a gun and the person checked out for the proper handgun licenses they would let him go.

Still I agree that they should have left the encryption out of it since they didn't find any encrypted files nor have any records of him sending or recieving any encrypted files.

Nothing wrong with using everything they can on this guy in my book though.

Re:Encryption use != evil

[Anonymous Coward]

No fair citing the 4th amendment! Next thing you'll be telling us is that the US Constitution does not recognize a class of individuals called "enemy combatants"!

Re:Encryption use != evil

[Anonymous Coward]

Only because not everyone drives a red car. I think it would be hard these days to find a computer that does *not* have encryption software on it. How else are millions of people getting secure access to their bank accounts via a web browser?

Re:Encryption use != evil

[onemorechip]

Wrong. There is no such legal standard as "way too circumstantial". IANAL but I'm quite sure of this one.

Re:Encryption use != evil

[Anonymous Coward]

the information that the person uses encryption software becomes relevant, in that it provides a legitimate explanation of why the offending material cannot be found.

No, it doesn't, since no PGP-encrypted files were found. Were the files encrypted and deleted? Where the files just deleted? Did the files never get saved to the hard disk in the first place? Is this the right computer? I dunno.

It's irrelevant.

Re:Encryption use != evil

[LWATCDR]

It depends on the crime. There is a statute of limitations it depends on the state and the crime. 1 to 7 years is usual some crimes like murder have no limit. Contempt is different. Every few days you are brought before a judge and ordered to comply if you do not then comply you have committed the crime again so the clock would start over again. Eventually the judge would just sentence you for x years or grow tired of it or the charge would be overturned by a higher court or an number of other outcomes. To get a court order you would have to have "just cause" the judge does not just hand them out.

Re:Encryption use != evil

[petermgreen]

if the feds can't crack a safe with the tools they have then they will presumaablly get more powerfull tools until they can

i'm sure that almost any safe could be cracked with sufficiant use of explosives etc

one possiblity is to build a self destruct mechanism into the safe but in many countries that in itself may be illigal (depending on how its done if it setriously injures people etc)

Re:Encryption use != evil

[anthony_dipierro]

What everyone's forgetting is this guy has been charged with taking pictures of children, and even assuming that his use of PGP was to hide stuff, it could easily be to hide downloaded porn.

I don't see how that's at all relevant to the matter we're discussing.

They're trying to use this as evidence he took pictures, which is just stupid.

Actually, if you read anything, you'd realize that they're using it as evidence that when he took those pictures he did so with criminal intent.

Re:Encryption use != evil

[anthony_dipierro]

I don't think introducing the fact that you had good door locks into a case would be reversible error though, do you?

Re:Encryption use != evil

[tylernt]

Hmmm. The bumper sticker I'm familiar with goes:

"Guns kill people, just like spoons made Rosie O'Donnel fat."

Re:Encryption use != evil

[Anonymous Coward]

I see the distinction you're trying to make that anonymity is not derived from the 4th Amendment. That's correct. However, anonymity was supported and used by our founding fathers. The best examples being Publius and Richard Saunders.

The Supreme Court has ruled many times that anonymous speech is protected by the 1st Amendment. In McIntyre v. Ohio Election Commission:

"Protections for anonymous speech are vital to democratic discourse. Allowing dissenters to shield their identities frees them to express critical, minority views . . . Anonymity is a shield from the tyranny of the majority. . . . It thus exemplifies the purpose behind the Bill of Rights, and of the First Amendment in particular: to protect unpopular individuals from retaliation . . . at the hand of an intolerant society."

Re:Encryption use != evil

[gilroy]

Why I'm trying to get in so late in the thread, I'll never know, but...

You might as well say that "The fact he knew that what he was doing was wrong was supported by the fact that he didn't tell anyone about it." A right to privacy should be guaranteed. I shouldn't have to defend my use of tools which help ensure my privacy

Yeah, just like that amendment allows you to kill random people with your gun because you know, you have a right to your gun, and that right should be guaranteed, so anything you do with it is your right and thus cannot be questioned.

No, this case is more like, "You own a gun. That's evidence of your intent to shoot someone." You might want to shoot someone. You might like hunting. You might like going to a firing range.

However, it's much more like "You own a safe with a lock. You could be hiding child porn in it. Therefore you might be guilty of being a child pornography -- and the mere fact that you have the safe implicates you." Never mind that the safe has many many legitimate other uses. Never mind that it's perfectly legal to own a safe. Never mind that they haven't found child porn in your safe. Because you merely bought a thing that might hide child porn, you are suspect.

And don't cry me a river about "Well, they showed he was guilty with other evidence." If they used the PGP argument, it means the DA thinks it helps. If they could prove it without the PGP stuff, then society loses nothing by dropping the PGP stuff (because after all, they proved him guilty with the other things). And if it made a difference, then things are even worse -- because possession of a perfectly legal thing turns out to be enough to prove someone guilty.

Anyone remember "guilty until proven innocent"?

Re:Encryption use != evil

[Anonymous Coward]

Golly Gee, lets see. You use Linux on your computer at college. Your room-mate finde out about this and charges you with cheating because linux was the original home of PGP and ghostview and the Gimp. That means also that you have Kaffeine, and other nice programs whose presence on your computer means that you are equipped to steal a copy of Star Wars Episode III and encrypt it. Now you louse cheatin
bloodthirsty murderin tallywacker, we new Nazis...oh er 'Homeland Security", MI-6, CSIS, KGB, NKVD, MPAA, Gestapo, RIAA, Surete just know that you are goin to be our free labor the rest of your life, Because possession is nine points of the law, and the end justifies the means, and all power flows from the barrel of the guns of the secret police. Because you got the stuff and we have an open case, this gives we cops the right to bsst you for anything we want to. He, how about it Clancy, is'nt it time we finally closed the whatever _________ case from 20 years ago. He look, he looks 50 or so, he could have been around. Yeah and that rape case, this joker has a penis, so he has the equipment!
While we split hairs on the fine points of laws that appear to permit outrages against the human rights of defendants, those rights are being rationalized away by the very people who would appear to be most likely to need them!

Re:Encryption use != evil

[Mark Bainter]

I'm not saying the guy accused of the crime shouldn't produce keys

I am. perhaps you should review the fifth amendment.

Sure, it's unpleasant now. Nobody wants someone like this to walk free (if he's guilty) but what about the guy who is innocently charged, but doesn't want his private files reviewed? Or those who might have something incriminating on another topic? You might say that's ok, he should go to jail then, but remember that laws are not always just.

Re:Encryption use != evil

[mollymoo]

Ok. Perv has bookshelves. Hides said photos in between the books:

"We find that evidence of appellant's bookshelf use and the existence of books in his house was at least somewhat relevant to the state's case against him"

If there is anything more ridiculous than blaming the weapon for the act of the person, I'm sure I can't think of it offhand.

Let's try that again with crowbar shall we? I have a crowbar, I was using it today in fact. I'm not a burglar, but not everybody has a crowbar. I would fully expect that fact that I posess not only a crowbar but a wide array of tools which could be used to break into houses would come up in court if I were charged with burglary.

This is just hysteria. This decision does not say that encryption software alone is an indicator of criminal behaviour, just as my owning a crowbar alone doesn't indicate I'm a burglar.

Re:Encryption use != evil

[TheLittleJetson]

I'm pretty sure the bill of rights guarantees the right to privacy. The 10th ammendment perhaps?

10th ammendment is states' rights. 4th is closer, but it's only when searching is involved. Privacy has much broader meaning. For example, a cop can walk up to your car when you're making out with your sweetie, and interrupt your privacy, but not be violating your constitional rights (unless they forcibly search your car or person). Mormons can ring your doorbell and try and toss you some line of crap about Jesus, and as long as it doesn't cross the line into harrassment, it's not breaking any law (but it does disturb your privacy).

Re:Encryption use != evil

[j_w_d]

Yep, my very point.

Re:Encryption use != evil

[j_w_d]

Yes, I read the article, but even though I did not mark it as such, the conclusion is meant to be humour. Note for instance that my version lacks any mention of the case. Second, no where does it mention linux that I noticed. Also, I don't know whether you use linux, or have ever installed a major distro such as SuSE. However, there are a LOT of encryption utilities available on some distros as well as specifically steganographic ones - which made a splash a while back when our illustrious leaders were claiming that middle eastern bad guys were using such programs to communicate.

Consequently, during an install, a newby just getting impatient and checking everything can flood their harddisk with such programs without having a clue as to what they are or how to use them. I expect that the prosecutor just decided to take the omnibus approach to evidence and argue that only the guilty flee and the presence of PGP must imply guilt. Lazy, sloppy prosecutor.

Regarding the actual case, another possibility is that the alleged pictures never were on that drive.

Re:Encryption use != evil

[Anonymous Coward]

"However, if you're a paedophile who encrypts his (or indeed her) stash then you obviously know you're doing something wrong and want to avoid being punished for it."

Not necessarily. He may know that it's illegal, but that doesn't mean that he thinks that it's wrong. For example, political dissidents in Red China may encrypt or try to hide subversive literature, not because they think that it's wrong, but because they know that it's illegal.

My limited understanding, from what I've read, is that many pedophiles don't think that having sex with children (or, in this guy's case, taking pictures of them naked) is wrong. They hide it because they know that it's illegal. It's similar to many people who use illegal drugs.

Re:Encryption use != evil

[Artifakt]

You're absolutely right. Judges have often given what's called blanket immunity for evidence that might point to another crime but help prove the person is innocent of the one actually charged. There are also some cases where the potential immunity doesn't extend to some more serious charges. In a case like this, that would probably be limited to manslaughter 1 through murder, or something along those lines.
While we are at it, if you could get out of a 10 year sentence for child molestation only by taking a 10 year sentence for something like bank fraud instead, wouldn't you? You'd have a good chance of getting a country club prison instead of harder time, and even if you still went to the same joint, your new associates wouldn't be nearly so tempted to get medieval on your hinie.

Re:Encryption use != evil

[DavidTC]

What pictures?

As far as I can tell, there's no evidence of any pictures at all, much less ones in his computer. No evidence was introducing WRT to his computer except that it had PGP on it. They didn't even assert he'd had files and wiped them.

The evidence is that a girl testified he'd taken pictures of her. There's no computer involved at all.

I have to agree with this guy's lawyer. The only reason PGP was introduced was to create uncertainity in the minds of the jury that there might have been encrypted files transfered via that computer, when there was absolutely no evidence of that at all, or that it was in any way involved in the crime.

It's completely absurd to introduce something as evidence and say 'He did this in advance so his crime would be easier to hide' when he did not, in fact, use that in relation to the crime at all!

I agree with what someone said. This is like saying your purchases of lime indicate that your murder of someone was premeditated, despite the fact the body was found without any lime on it.

Or introducing evidence that someone owes a gun in a relation to an assault charge where no gun was present. It's just a blatant attempt to prejuidice the jury.

Oh, but I forgot, he's an evil child molestor, so obviously we should just make up crap so he gets a longer sentence.

Re:Encryption use != evil

[suitepotato]

You may have nothing to hide, but it is still your nothing. Hiding your car under a tarp doesn't mean it was stolen, putting your family jewels in a safe doesn't mean they were ill-gotten, having intestines in your body and condoms in your pocket doesn't mean you're a drug mule. Are you hiding something because you don't report it to all and sundry 24/7/365 just in case they missed the news, as if their not knowing == you are doing something wrong?

The notion that selective use of encryption implies something to hide from the state is like saying not putting your beat up pick-up truck under a tarp while putting your Trans Am in a garage implies grand theft auto. Utter horsecr*p.

Re:Encryption use != evil

[anthony_dipierro]

What pictures?

The ones he took of the 9-year-old girl.

As far as I can tell, there's no evidence of any pictures at all, much less ones in his computer.

A girl said that she was made to pose nude for him, and presumably said that he then took pictures of her. That's evidence. Now the story doesn't go very deeply into that evidence, because that's not what the story is about, but I'm sure the jury didn't base its entire case on the possession of PGP.

The evidence is that a girl testified he'd taken pictures of her.

Geez, first you say there's no evidence of any pictures, then you admit that there is.

I have to agree with this guy's lawyer. The only reason PGP was introduced was to create uncertainity in the minds of the jury that there might have been encrypted files transfered via that computer, when there was absolutely no evidence of that at all, or that it was in any way involved in the crime.

Maybe. More likely the prosecution was just stupid enough to believe that him/herself.

It's completely absurd to introduce something as evidence and say 'He did this in advance so his crime would be easier to hide' when he did not, in fact, use that in relation to the crime at all!

You and I have absolutely no idea whether or not he used it in relation to the crime. He might have, he might not have.

Oh, but I forgot, he's an evil child molestor, so obviously we should just make up crap so he gets a longer sentence.

Of course not, we should let him go free because some prosecution lawyer told the jury that he owns PGP.

Re:Encryption use != evil

[nametaken]

I don't have to hear that they found encrypted images of children. If they find child porn, they see repeated searches for what commonly returns child porn, and his encryption software is prominently engaged for the purpose of hiding downloaded internet content or sending emails, and he claims "Please! I toss myself on the mercy of the court! I didn't know they were underage, I didn't know what I was doing was illegal!"... then together they suggest criminal intent.

Re:Encryption use != evil

[DavidTC]

Maybe. More likely the prosecution was just stupid enough to believe that him/herself.

I don't know exactly what your point is. The prosecution being stupid is not a valid reason to allow prejudical evidence to be introduced.

You and I have absolutely no idea whether or not he used it in relation to the crime. He might have, he might not have.

He did not. Remember that 'innocent until proven guilty' thing? Well, it works on all levels. Until the state proves that he used PGP to encrypt pictures, he didn't. As they didn't even suggest that, we must assume he didn't.

And, BTW, we do know he didn't use PGP, or there would have been other computer evidence introduced. Like wiped areas of the hard drive, or encrypted files.

Geez, first you say there's no evidence of any pictures, then you admit that there is.

And this is arguing semantics, which I should expect from you. There is no evidence that pictures were taken. Testimony is not, in fact, 'evidence', and you have proven me utterly wrong and thus you 'win' the argument because I used that word to describe testimony. Congratulation.

In the real world, however, I'm not 'fighting' you and I was correct. There's no evidence there were any pictures, just some testimony. There's no evidence or testimony that these hypothetical pictures were on a computer. There's no evidence or testimony that PGP or even the computer was used in relation to this crime at all.

Of course not, we should let him go free because some prosecution lawyer told the jury that he owns PGP.

No one's even vaguely suggesting he go free. People are saying was a mistrial because the state introduce irrelevant and prejudical evidence implying something that wasn't true. A mistrial, of course, results in another trial.

Re:Encryption use != evil

[Anonymous Coward]

I like the water version better.

Re:Encryption use != evil

[Anonymous Coward]

From the official opinion:

Appellant argues that his "internet use had nothing to do with the issues in this case;" "there was no evidence that there was anything encrypted on the computer;" and that he "was prejudiced because the court specifically used this evidence in its findings of fact and in reaching its verdict." We are not persuaded by appellant's arguments. The record shows that appellant took a large number of pictures of S.M. with a digital camera, and that he would upload those pictures onto his computer soon after taking them. We find that evidence of appellant's internet use and the existence of an encryption program on his computer was at least somewhat relevant to the state's case against him. See Minn. R. Evid. 401.

Minnesota Law Library

Re:Encryption use != evil

[anthony_dipierro]

The only reason PGP was introduced was to create uncertainity in the minds of the jury that there might have been encrypted files transfered via that computer

Maybe. More likely the prosecution was just stupid enough to believe that him/herself.

I don't know exactly what your point is.

My point was that I think you were incorrect about the reasoning.

The prosecution being stupid is not a valid reason to allow prejudical evidence to be introduced.

I never said it was.

You and I have absolutely no idea whether or not he used it in relation to the crime. He might have, he might not have.

He did not. Remember that 'innocent until proven guilty' thing? Well, it works on all levels.

Just because someone is presumed innocent until proven guilty in a court of law doesn't mean the person actually is innocent until proven guilty. In any case, this person was proven guilty in a court of law.

Until the state proves that he used PGP to encrypt pictures, he didn't. As they didn't even suggest that, we must assume he didn't.

No, you're absolutely incorrect. I don't have to assume anything. Besides, in the case of an appeal, the burden of proof lies on the person bringing the appeal.

And, BTW, we do know he didn't use PGP, or there would have been other computer evidence introduced. Like wiped areas of the hard drive, or encrypted files.

Do you have a transcript of the trial somewhere? Because I don't know that there wasn't other computer evidence introduced. Even if I did, I wouldn't take the fact that evidence wasn't introduced as proof that the thing never happened.

Geez, first you say there's no evidence of any pictures, then you admit that there is.

And this is arguing semantics, which I should expect from you. There is no evidence that pictures were taken.

But surely there is. You don't think the jury convicted a man of taking pictures without any evidence whatsoever, do you?

Testimony is not, in fact, 'evidence'

While we're arguing semantics, yes it is. In fact, testimony is the most common example of direct evidence.

There's no evidence or testimony that these hypothetical pictures were on a computer. There's no evidence or testimony that PGP or even the computer was used in relation to this crime at all.

Hey, can you send me the URL of the transcript of the trial where you're getting all this information from?

No one's even vaguely suggesting he go free. People are saying was a mistrial because the state introduce irrelevant and prejudical evidence implying something that wasn't true. A mistrial, of course, results in another trial.

Fine (of course, the purpose of having a new trial is that he might in fact wind up going free). But I'm not going to argue semantics. Let's just declare a mistrial whenever the prosecution lawyer says anything that doesn't directly prove a person's guilt.

Re:Encryption use != evil

[hesiod]

> Do crimes ever expire in the U.S.?

Yes, it's called "Statute of Limitations." Murder, as well as maybe a few other crimes, do not have a Statute of Limitations -- or if technically SoL covers more than just time, with murder it doesn't expire. Of course, IANAL.

Re:Encryption use != evil

[hesiod]

> But if you selectively encrypt some documents and not others, it implies that you may have a particular reason to hide those documents.

Because I don't give a shit if Jimmy Blowe Jr. gets a copy of krnl32.dll. What I care about is him getting "Passes and CC nums.txt," so I encrypt that one file, not the whole fscking disk!

Re:Encryption use != evil

[hesiod]

> Enrypted files are not in your head,

They already have the encrypted files. It's the key that's in your head.

Good. Encryption is a tool too

[Dancin_Santa]

And with other evidence, why shouldn't it be? In fact, the presence of it ought to lead prosecutors to tack on the charge of conspiracy.

Just like the presence of a gun during a robbery lifts the crime to armed robbery, the presence of encryption ought to imply not only that the culprit intended to commit the crime but also intended to cover it up as well.

A load of crap.

[Xizer]

This is a load of crap. So using a form of encryption automatically means you're doing something illegal? This is purely circumstantial and shouldn't be allowed.

Oh come on

[cmad_x]

They can't be serious. According to their own logic, whoever has a knife at home has murderer intent. Where's the common sense people?

Re:Oh come on

[StratoChief66]

Exactly. Locking my house is not evidence that I'm doing something wrong there! I can think of hundreds of reasons I would encrypt stuff on my computer that is not illegal in nature. If someone steals my computer, I can be thankful that I encrypted my personal information and he will never crack it.

Re:Oh come on

[wankledot]

Wrong. This is simply adding intent and conspiracy elements to the crime, it would be the same as you killing someone with a knife and then buying five gallons of bleach to clean up the blood splatters on the walls. Buying bleach is of course legal, and no one is questioning that, but adding the fact that you bought/used the bleach for a specific purposes related to the crime absolutely shows that you a) knew what you were doing b) had the presence of mind to clean up after yourself c) intended to conceal the crime.

This is one of those cases where use of a legal tool to aid or cover up a crime can absolutely be part of the case, and it is NOT an indictment of the tool.

Re:Oh come on

[Moridineas]

You're completely incorrect--I don't think you're thinking about the situation rationally.

Encryption is merely a tool that this man used to commit his crimes. Should video cameras the defendant used not be admitted? Should video TAPES? What about any other equipment he used in the filming process? They clearly (I think you'll agree) should be admissible as evidence. Why not the fact that he went to great lengths to hide his creations? Encryption is JUST a TOOL. It's not magically special just because it's on computers.

Re:Oh come on

[FifthRaven]

That is not the point. It was simply admitted as evidence of possible criminal intent. If you are a suspect in a murder case where a knife was used, a knife could be admitte as evidence. In this case he had the encryption program in order to hide naked pictures of a 9 year old. That is illegal use and is evidence of premeditation and thought and can be used by a court to show that this sick man needs to be locked up because he is a danger to society. The fact that he had the encryption software isn't proof of his crime but it is proof of his ability to commit the crime. If he didn't do it, then the evidence would prove nothing. Sometimes nerds forget to think illogically.

Re:Oh come on

[Narchie Troll]

Um, there was no evidence presented that any files involved in the alleged crime were encrypted.

Only that the person involved had an encryption utility on his computer. You might as well enter into evidence that he had knives in his kitchen, with the obvious intent to kill the victim before she could testify.

There are legitimate uses for encryption, even for criminals. Unless the prosecution could present evidence that the encryption utility was used to conceal a crime, it is entirely irrelevant to the case.

Re:Oh come on

[RedBear]

Wrong. This is simply adding intent and conspiracy elements to the crime, it would be the same as you killing someone with a knife and then buying five gallons of bleach to clean up the blood splatters on the walls. Buying bleach is of course legal, and no one is questioning that, but adding the fact that you bought/used the bleach for a specific purposes related to the crime absolutely shows that you a) knew what you were doing b) had the presence of mind to clean up after yourself c) intended to conceal the crime.

No, I would say this is more like you killing someone with a knife and simultaneously having a bottle of bleach at home in the laundry room, and they have no evidence of you buying or using it for any other reason than doing the laundry, and yet it is somehow taken as "supporting evidence" that your crime was thought out in advance, with you having the bleach on hand specifically to clean up after the crime. Obviously the bleach could have been used to clean up some blood, so that must have been your intention in owning it.

Your mistake is in comparing this to a non-ordinary amount of bleach and suggesting they had some sort of evidence that you used the bleach to clean the blood off the walls. This encryption software is just an everyday, regular size, common bottle of bleach sitting in the laundry room, just like almost anyone would have in their home if they happen to have a laundry room. It indicates absolutely nothing. Thinking otherwise is an extremely dangerous logical fallacy. And it absolutely IS an indictment of the tool. Encryption software is not the logical equivalent of five gallons of bleach.

Re:Oh come on

[Jussi K. Kojootti]

This wasn't about admission as evidence. This was about proving criminal intent. His intent was 'proven' with the existence of encryption software -- so GPs analogy was actually quite accurate.

Re:Oh come on

[RedBear]

You're completely incorrect--I don't think you're thinking about the situation rationally.

Encryption is merely a tool that this man used to commit his crimes. Should video cameras the defendant used not be admitted? Should video TAPES? What about any other equipment he used in the filming process? They clearly (I think you'll agree) should be admissible as evidence. Why not the fact that he went to great lengths to hide his creations? Encryption is JUST a TOOL. It's not magically special just because it's on computers.

It is you who are completely incorrect. Encryption software is just a tool, with no direct relation to his crime. They have no evidence of encrypted photos. They have no evidence that he has the software for any particular reason. They won't say how it's any different from built-in encryption support like Apple's FileVault or Windows' Encrypted Filesystem support. This is NOT like video tapes or video cameras (was the defendant making his own child porn? If not, WTF would video cameras or tapes have to do with it either?). If this is just some stuff he downloaded to his computer from the Internet, video tapes or cameras would have absolutely nothing to do with the case, and rightfully would either never be mentioned or never taken as supporting evidence of guilt.

You're right, encryption is not magically special because it's on a computer. It is you and they who are treating it as magically special, when it's really just a generic tool. It indicates absolutely nothing with regards to the defendant's crime, unless they can give direct evidence of the software being purchased or used specifically to commit this crime or to help hide this crime. If they can't establish some kind of direct link between the crime and the software, it shouldn't even be part of the case. If there is no link, there is NO reason to consider it as even "supporting" evidence. Period.

Re:Oh come on

[surprise_audit]

intent was 'proven'

Except that "The court didn't say that police had unearthed any encrypted files" (from TFA). I have a truck and a case of beer. Should I be convicted of drunk driving if I've never been stopped and breath-tested?? You'd say yes, apparently - possession of a vehicle & alcohol would prove intent to drive while drunk.

Re:Oh come on

[Anonymous Coward]

Your example is totally correct; however, it's irrelevant to the GGP's example: You can use a knife for all sorts of things (killing included); but, as far as I know, you can only use beer for one thing (to get drunk).

Re:Oh come on

[cmad_x]

Should have RTFA; didn't realise the decision was specifically for that very case.

Re:Oh come on

[Anonymous Coward]

The article didn't mention anything about finding any encrypted files, only "...and the existence of an encryption program on his computer was at least somewhat relevant".

Existence of the program, not the existence of encrypted files.

You mention "it is proof of his ability to commit the crime.". Encrypting files is not a crime. Possession of certain files can be though.

Re:Oh come on

[Alsee]

a tool that this man used to commit his crimes.

the fact that he went to great lengths to hide his creations?

You must have read a different story than I did. Neither of those 'facts' existed in the story that *I* read.

-

Re:Oh come on

[Jussi K. Kojootti]

I'm sorry I left out the sarcasm tags (I thought it would have been a little too obvious...).

Better dump XP Pro for XP home

[hotspotbloc]

In the same vein since XP Pro includes file/folder encryption I guess that too would be "criminal intent".

What a stupid ruling.

Re:Better dump XP Pro for XP home

[Moridineas]

Encryption is a tool, nothing more. If he had had a video studio in his house, etc, should THAT be admitted as evidence?

Re:Better dump XP Pro for XP home

[SB5]

That begs the question, did he use the video studio for illegal purposes, what about remote illegal purposes?

Then you have to wonder, did he encrypt the video? Because the MPAA owns the patent on encrypting video.

Re:Better dump XP Pro for XP home

[Gilk180]

It could be admitted as evidence that he had the means to commit the crime, but not as evidence of intent, which is the issue at hand. Having a video studio in your house does not show intent to shoot kiddy porn. It shows intent to shoot a movie.

If there is no other use for a tool or it was actually used to cover up a crime, then it shows intent. I own a mop. If I shot an intruder in my home, does that mop show that I intended to murder the victim because I have something to cover it up.

If the police have encrypted files that contain videos, that shows intent, not having encryption software.

Wow, that's scary

[bad_outlook]

So if someone is intelligent enought to know how to protect him/herself, they're more likely to be a criminal? Where is 'innocent until proven guilty' these days? bo

Re:Wow, that's scary

[Fookin]

It sounds more like "guilt-by-application" to me ...

Investigator: "Hmmm ... mIRC, eDonkey, BitTorrent ... nothing here ... holy crap! PGP! Cuff 'im!"

Re:Wow, that's scary

[StratoChief66]

In this case, its 'Innocent until proven too smart for his overlords'

Re:Wow, that's scary

[Anonymous Coward]

People fear intelligence..

How many times at school were you accussed of a deed because you happened to be smarter than the other kids and actually capable of it.

There's an old joke and the punchline states that having breasts must make you a whore because you have the capability.

So, too, having a brain or being more intelligent than someone certainly makes you more able to perform a smart crime!

Re:Wow, that's scary

[Sancho]

"innocent until proven guilty" hasn't changed. Read a few other Slashdot posts with an open mind. Try not to kneejerk. The point is that he was trying to hide what he was doing, which implies conspiracy and that he knew what he was doing was against the law--all things which change the degree and penalties for the crime.

No one said that PGP is a crime or that it makes someone more likely to be a criminal.

Re:Wow, that's scary

[BiggerIsBetter]

That reminds me of a joke...

A lawyer is sitting in a bar having a drink when a beautiful women sits down next to him. The lawyer seeing oppurtunity buys the women a beer and proceeds to hit on her. He then asks her, "Would you sleep with me for a million dollars?"

The women looks at him and says, "You know for a million dollars, sure."

The Lawyer then asks, "Would you sleep with me for 20 dollars?"

The women is instantly upset and yells, "Twenty dollars, what do you think I am some kind of whore?!"

The lawyer then looks at her and says, "Well, we have already established that fact. Now we are just negotiating."

Re:Wow, that's scary

[mrchaotica]

The point is that he was trying to hide what he was doing

No, the point is that YOU DON'T KNOW THAT!

For all you know, he only ever used PGP to encrypt his email. To be able to say he was trying to hide his crime, you'd have to find a file named "kiddie_pr0n.jpg.pgp" or something.

Re:Wow, that's scary

[MoneyT]

However, it is possible in a criminal case to say:

"We have this evidence, this evidence, this evidence and this. The only reason we don't have the smoking gun is because we believe it was destroyed. We further believe it was destroyed by the defendant because he had access to X tool which can be used to destroy this smoking gun."

Re:Wow, that's scary

[Anonymous Coward]

It was funnier when Winston Churchill said it.

Re:Wow, that's scary

[anthony_dipierro]

Where is 'innocent until proven guilty' these days?

Where it has always been, in the hands of the jury. The doctrine that you are considered innocent until proven guilty beyond a reasonable doubt does not imply that every single piece of evidence introduced into the case must be able to single handedly prove that guilt.

Re:Wow, that's scary

[DavidTC]

Except PGP no more destroys evidence than a safe destroys it.

Re:Wow, that's scary

[MoneyT]

You obviously know nothing of PGP's secure wipe features.

Furthermore, if you have evidence that you have made impossible for authorities to gather, for all intents and purposes it is destroyed. A shredder doesnt' destroy documents, but piecing it together is all but impossible, hence it's considered destroyed.

Re:Wow, that's scary

[DavidTC]

If they can't detect the existence of wiped data, the lab is not doing its job.

Yes, piecing it back together is impossible, but it very obviously has been wiped.

Re:Wow, that's scary

[MoneyT]

Not neccesarily. There are secure wipe programs that instead of just doing random data wipes actually write over it with the temp files on your computer.

Re:Wow, that's scary

[DavidTC]

Yes, but not PGP.

Not a good result, even if it was child porn

[lavalyn]

Yes, the crime is reprehensible and unforgivable.

But that doesn't mean the presence of encryption tools meant he was guilty. Encryption tools have many uses, some of which are good - like authentication and assurance of confidentiality. It's great to have encryption tools like PGP when you're sending an email to your broker that you want to issue a stock trade from your investments account. Or to be reasonably assured that discussing a prototype / secret business proposal will not be intercepted.

Encryption is merely a tool, to be used for both good and evil. A mail envelope can contain mail, or it can contain anthrax. An encrypted document could be a plot by terrorists, or it could be just any other email.

Re:Not a good result, even if it was child porn

[amliebsch]

But that doesn't mean the presence of encryption tools meant he was guilty.

That wasn't the question. The question is whether this is relevant to a jury for the purpose of assessing guilt.

I really wish slashdot would stop encouraging amateur lawyering. The law is a vast, complicated subject, with many non-obvious doctrines.

Re:Not a good result, even if it was child porn

[zoloto]

...Encryption tools have many uses, some of which are good...

I would like to believe that MOST of the reasons for encryption use is good. Let's not outweigh the frequency of "wrong" uses with the actual numbers of good reasons.

Real national security issues.
Business uses.
Classified government files (fbi, cia, nsa etc)
Personal uses that are not illegal

vs. covering up crimes or crimes in progress

That's my arguement anyhow.

Re:Not a good result, even if it was child porn

[killjoe]

"Encryption is merely a tool, to be used for both good and evil"

Not in the court of law apparently. Either way you will never convince a jury 12 ordinary Americans of that. They KNOW for sure that only terrorists use encryption, they know this because the man on the TV told them so.

Re:Not a good result, even if it was child porn

[NanoGator]

"But that doesn't mean the presence of encryption tools meant he was guilty."

He wasn't found guilty for having it. They said it was relevent.

You can shake your head if you like, but which looks worse:

a. Finding child porn on somebody's computer with little indication of how it got there.

b. Finding an encrytped filer/folder that contains a bunch of child porn that he obviously tried to hide it with. (note: I don't know if this was the case, so please take this as a hypothetical question.)

Criminal cases aren't just about the act, but about the intent. It would be really irresponsible of the justice system to not take these things into account. I don't see why I need to make this speech, though, since the encryption bit of it wasn't what nailed the case closed.

Re:Not a good result, even if it was child porn

[Incy]

Good thing IE doesn't have any encryption built into it....

Re:Not a good result, even if it was child porn

[Creepy Crawler]

---The law is a vast, complicated subject, with many non-obvious doctrines.

Why should it be? Shouldnt the law be plainly readable and understandable by the majorit of the people?

There's soo much crud in the legal system in that you SHOULD be able to legitimately claim ignorance of a law if its an uncommon or rarely used law. That and I remember some lady who tried to buy a subscription to Lexis-Nexis (or one of those Law archives) and THEY REFUSED.

Given the set of precedance, some po-dunk hick judge in the hills of 'Kan-tuck-eee' can legislate directly to.. well... The whole state. And from there on, the USA.

I guess Hitler was right. Make enough laws and have everybody criminals so they CANT do anything against you. By the way, you better stay in that "Free Speech Box or the pigs'll come and arrest you.

Re:Not a good result, even if it was child porn

[Anonymous Coward]

I really wish slashdot would stop encouraging amateur lawyering. The law is a vast, complicated subject, with many non-obvious doctrines.

...and I really wish people would stop assuming that Lawyers should set the moral imperative for society.
Which is EXACTLY what you are doing, by assuming that people that are not lawyers no nothing of the law.

Buy a clue FUCKER!

Re:Not a good result, even if it was child porn

[amliebsch]

Why should it be? Shouldnt the law be plainly readable and understandable by the majorit of the people?

The answer is because, like it or not, law is a highly technical field. You might as well ask why the field of medicine isn't more plainly understandable by the majority of people. Or particle physics, or topological mathematics.

Now, when it comes to statutory criminal law, I would argue that the vast majority is freely available, plainly readable, and as easy to understand as any technical writing can be. It defines most of its terms and is organized in logical fashions. But this is about evidence trial law, a much more complicated and technical (and often case-law-dominated) subject.

Re:Not a good result, even if it was child porn

[Anonymous Coward]

Which is EXACTLY what you are doing, by assuming that people that are not lawyers no nothing of the law.

It is a safe assumption in most cases. Non-lawyers rarely know as much about the law as they think they do. If people wanted to have informed opinions, that would be great. Instead, though, they find it sufficient to flame against that about which they have little knowledge and no wisdom.

Re:Not a good result, even if it was child porn

[jadavis]

That's why the defense is allowed a lawyer and given an opportunity to refute the claims of the prosecution.

If the client really is innocent, it should be easy to refute that claim by cross examining a prosecution witness and asking if they've ever shopped online using SSL encryption.

Re:Not a good result, even if it was child porn

[pHatidic]

Really? I have never seen anything about encryption on TV at all, let alone hearing people say it is bad. What TV shows do you watch?

Re:Not a good result, even if it was child porn

[killjoe]

Virtually every TV drama has dealt with terrorism or is about terrorism. Virtually every one has talked about encryption at one point or another.

Do you watch TV at all?

Re:Not a good result, even if it was child porn

[Anonymous Coward]

We are not required to obey medicine (the combination of words don't even make sense), laws of phisics and math are natural laws, i.e. laws that it is not possible to break.

But laws, we are required to obey them, but yet they are deliberately written to be so "highly technical" that we have no chance of understanding what we are supposed to obey.

Re:Not a good result, even if it was child porn

[maxpublic]

The answer is because, like it or not, law is a highly technical field. You might as well ask why the field of medicine isn't more plainly understandable by the majority of people. Or particle physics, or topological mathematics.

If the law isn't understandable by a majority of the citizens, the government has no business holding those citizens accountable to the laws.

Unlike particle physics or topological mathematics, laws are solely constructed at the whim of the people. If the laws aren't comprehensible to the average citizen then the law has been drafted in this fashion to the benefit of someone who isn't an average citizen, most likely a lawyer who profits from the fact that Joe Smith can't make heads or tails of it on his own.

Max

Re:Not a good result, even if it was child porn

[tricorn]

If there was evidence of files being encrypted with PGP as part of the crime, the the existence of PGP on his computer would be relevant. Even if the files were encrypted with something else, you might use the existence of PGP to show he is familiar with encryption technologies. But absent any indication of encryption as part of the crime (or covering it up), I don't see how PGP is any more relevant than a paper shredder or matches and a fireplace. "We didn't find any actual pictures, nor any burnt pictures, but since the defendant has access to a fireplace and has matches, we think that shows his intent to burn the pictures."

Re:Not a good result, even if it was child porn

[DavidTC]

I think everyone who didn't read the article should shut the fuck up.

There was no child porn found on his computer. None unencrypted, none encrypted that he refused to decrypt, none encrypted that he decrypted. In fact, it appears there were no encrypted files at all.

There was no child porn at all.

He was convicted of child abuse mainly based on the the testimony of a child who says he took pictures of her.

In fact, I'm vaguly confused as to what a computer has to do with this case at all.

Now, we can argue whether or not the testimony of a 9 year old is enough to have someone convicted, but the encryption software shouldn't have been admitted, and was only there to sway a jury who doesn't understand this stuff into thinking he must have hidden pictures somewhere.

Re:Not a good result, even if it was child porn

[poot_rootbeer]

But that doesn't mean the presence of encryption tools meant he was guilty.

No one (well, no one INFORMED about the facts of this case) is arguing that it does.

The guy getting caught doing something that's against the law means he is guilty. The presence of encryption tools is to be used as an argument that he KNEW he was guilty, even before he was caught. The jury is still free to reject that argument; all the court has done is rule that the prosecution is allowed to present it in the first place.

absolutely ridiculus

[cryptoz]

This is totally outrageous! I mean, it's like saying that because you own a gun that you will be found guilty for a murder or something. The main reason that the courts can function while saying that the presence of encryption technology is harmful is because of the widespread ignorance.

This is the sort of thing we need to fight. There are more legit. uses of cryptography than anyone can shake a bloody stick at! And if they're going to start ruling in such a manner where this becomes a pattern, it won't stop soon. Just watch, within a few years it may be illegal to use crypto for unknown purposes. And in a decade it will be illegal to possess technology in order to do so. These ideas are not crazy; governments have been doing this will all sorts of weapons for a long time, and we all know that they've also been treating strong crypto as a weapon for just as long.

As I said, this is the sort of thing that needs to be fought. Strongly.

Re:absolutely ridiculus

[wankledot]

You don't get it. This case is not claiming his use of encryption is/was illegal, it's not even adding the use of it to the charges, it's simply showing *criminal intent*

If you built an underground cavern with a hidden door, security cameras, and multiple locks to hide the dead bodies from your killing rampage, the fact you spent all that time doing it should be evidence in the case of your intent.

This person is not being indicted for using crypto, his use of it is simply being used to show intent... why is that so wrong?

If you hide evidence in the course of any crime, the fact that you hid it is a perfectly reasonable thing to be brought up at trial, is this any different?

If someone gets arrested with bolt cutters breaking into a building, it's reasonable to use the presence of the bolt cutters at trial, just as it's reasonable to show any other tools (such as crypto) that were used to commit a crime.

Re:absolutely ridiculus

[Trillan]

I agree in the case of your analogy, it'd be reasonable. But your analogy is flawed in this case. It's a bit more like getting with bolt cutters... and having the fact that the cops found a ski mask (and skis) in your closet be entered as evidence against you.

Okay, granted, that might be a little extreme the other way, since they had browser history available to show the computer was at least somewhat involved in this guy's obsession. But I certainly consider this a dangerous precedent.

Re:absolutely ridiculus

[Anonymous Coward]

"If you built an underground cavern with a hidden door, security cameras, and multiple locks to hide..."

To hide what... that you are paranoid? You need more evidence than that for the search warrant. Having a home security system, no matter how impressive it is, is not illegal.

Re:absolutely ridiculus

[Anonymous Coward]

"(such as crypto) that were used to commit a crime."

so, crypto was used to commit the crime? interesting.

Re:absolutely ridiculus

[Anonymous Coward]

"You don't get it. This case is not claiming his use of encryption is/was illegal, it's not even adding the use of it to the charges, it's simply showing *criminal intent*"

I have a door lock on my house so that I can protect my house from intruders, but more importantly, I have a lock on my door to keep people from casually entering when they have not been invited. Perhaps I have dirty socks and underwear on the floor and I do not want people to see them. In any case, it's my damn privacy.

My door lock is not proof of criminal intent. It shows nothing but the concept of me protecting my privacy.

If the police want to get a search warrant to enter my home, they will need a little bit more than "your honor... he has a deadbolt on his front door...gasp"

Certain rights are just too difficult for some people 'to get'. Thank god that they are protected even in their ignorance.

Re:absolutely ridiculus

[syousef]

If someone gets arrested with bolt cutters breaking into a building, it's reasonable to use the presence of the bolt cutters at trial, just as it's reasonable to show any other tools (such as crypto) that were used to commit a crime

If the bolt cutters were a tool of legitimate trade, this would be looked on differently.

Equally admitting a kitchen knife as evidence with no specific evidence linking the specific knife would be seen as barely relevant. It's a common thing to use a kitchen knife.

I'd argue that crypto software is a common tool to protect business information. Hell I try not to make any internet transactions for personal use that aren't encrypted.

Another example. How would you like it if someone busted down your door and confiscated your computer whilst charging you with counterfeit because you own a printer?

Re:absolutely ridiculus

[maxpublic]

This person is not being indicted for using crypto, his use of it is simply being used to show intent... why is that so wrong?

Because you, like most of the slashdotters arguing in favor of this ruling, apparently haven't read the fucking article. There is no evidence whatsoever that the man used encryption for ANYTHING AT ALL, much less hiding child porn. None. Nada. Zip.

It was present on his computer. That's it. It's also present on your computer if you use WinXP, Win2000, or have just about any distro of Linux. And we'll be sure to use it as 'evidence' of your intent to 'hide your crime' should we ever suspect you of doing anything illegal.

Max

Re:absolutely ridiculus

[RedBear]

No, you don't get it (and apparently neither do the mods). The things you say are true, hiding evidence is a crime, but they have no bearing on this situation. The point is, they have no evidence of the software being purchased or used for purposes of committing or covering up this crime (or any crime). Your analogy to going through a bunch of specific actions that can be linked directly to the crime is totally fallacious. Everyone who is saying this is a dangerous and stupid ruling is correct. The simple presence of the software is being taken as proof that it was intended for a criminal use. It is not his "use" of it that is being used, it is the "presence" of it on his computer that is being used against him.

And there you go again at the end of your post with another fallacious analogy, comparing encryption software to bolt cutters, as if it is obvious that its presence alone implies criminal intent. That's extremely dangerous reasoning. Just because I want to encrypt something does not mean I am encrypted child porn. Are you buying child porn whenever you enter a secure website that uses SSL? THINK about it. Think real hard. It's a subtle but extremely important distinction.

Same thing with someone above who compared encryption software to having a gun during a robbery. WTF? Guns, five gallons of bleach, bolt cutters, all these things have very limited uses and can be easily related to the crime in the analogy, but it will still require some sort of evidence that the defendant actually intended to use the item to commit a crime. If a guy gets caught breaking into something and happens to own a pair of bolt cutters that are stored in his shed at home, the bolt cutters have absolutely nothing to do with his crime. If a person owns a laundromat that has a clothes washing service, it would not be out of the ordinary for them to have a lot of bleach on hand. The fact that they had a bunch of bleach and used it to clean up some blood after they killed someone with a knife could not be used as supporting evidence that the crime was thought out beforehand. It just happened to be there. The fact that they used it to clean up the blood is the only fact that can be brought in as evidence, and it could only support the accusation that they were conscious afterward of having committed a crime, and trying to cover it up. The simple presences of the bleach could not have any bearing on the case.

Encryption software is a tool with many uses. Without direct evidence of its specific use, it cannot be used as supporting evidence for anything criminal. All the comments I've seen say they do not have any direct evidence of it being used in the crime, or being purchased for use in the crime, therefore it should not be admissable as supporting evidence of criminal intent. Do you get it now? It's like if you had a hammer in your desk drawer and they took it as supporting evidence that you were going to download child porn and hide it. It's totally nonsensical unless a direct link can be provided by the police.

Argh.

Re:absolutely ridiculus

[MoneyT]

They had more evidence. Namely a witness willing to testify in court. The encryption software was icing on the cake.

Re:absolutely ridiculus

[MoneyT]

And in a court, you can say something along the lines of:

"We have evidence, A, B, C and D. The reason we believe we don't have E the smoking gun is we believe the defendant destroyed E. We believe this because he owns this device G which can be used to destroy E."

In this case, there doesn't have to be encrypted files, PGP can do secure wipes.

Re:absolutely ridiculus

[MoneyT]

Sigh. If you would RTFA, you would note that the police did have more than he had encryption software. They had a witness willing to testify in court.

Re:absolutely ridiculus

[Anonymous Coward]

If you built an underground cavern with a hidden door, security cameras, and multiple locks to hide the dead bodies from your killing rampage

Did anybody say 'loaded question'? You're assuming the security system was built with killing rampage in mind, but that's what you've got to prove! Also you forget that all of us Mac owners effectively have a Killing Rampage Security System (TM) built into our OS by default, you know, just in case we get the urge.

Re:absolutely ridiculus

[Anonymous Coward]

That cake shouldn't have any icing on it.

Re:absolutely ridiculus

[Alsee]

In this case, there doesn't have to be encrypted files, PGP can do secure wipes.

And your still wrong.

Not only was there no indication that he encrypted porn, but there was no indication that he wiped anything either.

Had a wipe been done it would have been forensically OBVIOUS. The normal contents of 'empty' areas of a harddrive are miscelaneous file fragments, not systematically scrubbed sectors. Now assuming the police are not incompetent and they actually analyzed the harddrive, this means that the harddrive itself is actual evidence that no wipe was done.

You want to 'get the bad guy' and you are allowing it to bias the evidence in the case. You are imagining things he may have done that there is absolutely no indcation that he actually did, and you are allowing your imagination to be used as evidence.

The actual evidence is that nothing was encrypted. The actual evidence is that nothing was wiped.

This is exactly why certain things are supposed to be excluded from evidence. The prosecution cannot toss in irrelevant and prejudical items to get the jury to think X when the actual evidence is that X never happened.

God forbid someone actually does have an encrypted file on their computer - a very personal diary - and gets accused of some crime and gets you on the jury. You are going to jump to the FALSE conclusion that the encrypted file is evidence of guilt, even when there is absolutely no actual indication of any connection between the file and the alleged crime.

2 plus an imaginary 2 does not equal 4. If 2 is enough to convict then fine, convict based on the 2. If 2 is not enough to convict then you should not be throwing in an imaginary 2 to change a not guilty into a guilty and to convict a likely innocent person.

-

Re:absolutely ridiculus

[Anonymous Coward]

Aww, but then it tastes like poo-poo!

Re:absolutely ridiculus

[MoneyT]

Without having the orginal case and just the scurrent decision at hand, there does appear to be evidence that he used the encryption program:

the "evidence tends to show that an encrypting capability was employed by the Defendant;" and there are "occasions that indicate that there was advance notice of that so called surprising and thorough search warrant" executed at appellant's home.

furthermore:

We are not persuaded by appellant's arguments. The record shows that appellant took a large number of pictures of S.M. with a digital camera, and that he would upload those pictures onto his computer soon after taking them.

yet the files a nowhere to be found, hence the first statement and the second make the existance of PGP RELLEVANT to the state's case.

You can read the whole decision here:

http://www.lawlibrary.state.mn.us/archive/ctappub/ 0505/opa040381-0503.htm

and note that nothing about PGP is being used to imply his guilt in anything directly. Merely that the existance of PGP and his computer usage patters are relevant to the state's case.

Install Winzip/Winrar...

[galdur]

... go to jail

Re:Install Winzip/Winrar...

[Moridineas]

If the defendant had had other tools he used to create and store the pornography, are THEY relative? video camera? video tapes? etc? If they are admissibile as tools of his actions, why not encryption?

You're spreading the basest of FUD.

Re:Install Winzip/Winrar...

[galdur]

...could be admitted as evidence of criminal intent

Is owning a video camera evidence of criminal intent? What about digital cameras? Compression programs? Bittorrent? Computers? Electricity? Granted this case deals with very serious offenses, but being labeled as a (would-be) criminal simply for having encryption-capable software a computer I find quite ludicrous.

Re:Install Winzip/Winrar...

[amliebsch]

but being labeled as a (would-be) criminal simply for having encryption-capable software a computer I find quite ludicrous.

And indeed that is not what happened in this case. The evidence as to the existence was relevant because it was an instrumentality of the criminal act, not as evidence of intent.

Uh, who DOESN'T use encryption software?

[Anonymous Coward]

Considering that OS X has shipped with an encrypted file system, that Quicken encrypts its financial data when password protection is turned on, and most browsers, DVD players, and digital cell phones also include encryption features... I can't see anyone buying this as an argument.

can anyone say...

[remove office]

dangerous precedent?

Re:can anyone say...

[Erik Hensema]

Why? Most tools used by burglars aren't illegal. Yet they are relevant in a burgary case. Encryption tools aren't illegal either, yet they are relevant in some cases.

In don't understand the fuss.

Re:can anyone say...

[Corrado]

Right, so your saying that currently you can be questioned|arrested just for having burglar tools in your possession, and your OK with that?

Does that mean that if I use encryption I should be able to be questioned|arrested as well? I am a criminal for wanting to protect my privacy? What about if I lock the door on my house or don't want to let you search my car - well I *must* be hiding something!

Re:can anyone say...

[Threni]

> Why? Most tools used by burglars aren't illegal. Yet they are relevant in a
> burgary case. Encryption tools aren't illegal either, yet they are relevant in
> some cases.
> In don't understand the fuss.

Suppose you were carrying a knife to work (you're a builder or a chef or something). Some attacks you for no reason, and you use the knife in self defence and kill the attacked. You're saying you don't see the fuss if you're charged with murder, rather than a lessor offence, simply because you happened to work in a role which requires a knife?

Re:can anyone say...

[Tim C]

you happened to work in a role which requires a knife

Which will be brought up at the trial. No-one is going to accuse a chef or a butcher or whatever of going equipped when they're merely carrying the tools of their trade.

Seriously, this sort of thing happens all the time. No-one has made carrying a crowbar illegal, yet a burglar caught with one is going to get smacked down harder than a burglar caught without any tools.

Re:can anyone say...

[Threni]

> Which will be brought up at the trial. No-one is going to accuse a chef or a
> butcher or whatever of going equipped when they're merely carrying the tools of
> their trade.

Apparantly just using encryption is `going equipped` according to this court case, it would appear.

Any relationship to gun ownership?

[bad_outlook]

So if someone owns a gun should it be revealed for any criminal offense they commit to show that they *could* use it to kill someone? Should we include anyone who owns a knife, owns a car to run people down, owns a hammer to smash someones skull? Come on.

bo

Re:Any relationship to gun ownership?

[Sheetrock]

I think the relationship they're trying to draw is similar to finding locksmithing tools in the jacket of a suspected burglar.

The unfortunate thing about encryption is that it's not as pervasive as it should be. Virtually everybody has a lock on their house, and only rarely are they trying to conceal a criminal act. Virtually everybody puts mail -- particularly sensitive mail -- in envelopes before sending it, and again this is to retain privacy rather than deter law enforcement. But encrypted files are uncommon and therefore draw attention, right or wrong.

This is another example of where our justice system has gone round the bend when it comes to understanding new (and not even -that- new) technology and its relation to currently accepted practices in other parts of life. Locksmithing tools are specific to that practice, but encryption tools are general purpose and not only legal but encouraged for use by average citizens to retain their privacy.

Horrible precedents are usually set over reprehensible crimes, when said crimes represent only the tinest portion of the larger picture. Hopefully that won't be the case here when everything shakes out, but I have a feeling encryption will be severely curtailed in years to come as average people become more familiar with it and it becomes harder for law enforcement to deal with.

Re:Good. Encryption is a tool too

[zoloto]

From what I read, the man has already been convicted:

Ari David Levie, who was convicted of photographing a nude 9-year-old girl, argued on appeal that the PGP encryption utility on his computer was irrelevant and should not have been admitted as evidence during his trial.

Why should having encryption be a basis of arguing his sentancing. There are no laws against it, his crimes have already been exposed and been convicted. LEt the punishment fit the CRIME.

There is no crime in encryption and encrypting. Only one's intent. I coudln't find it, but there wasn't an obstruction of justice charge in there

Tibet: Encryption = Safety

[Anonymous Coward]

In Tibet, the presence of encryption on the computer owned by a Tibetan implies only that he is trying to protect himself. If the Chinese discovered that he is e-mailing eyewitness accounts of Chinese brutality against Tibetan children (i.e. raping the children), then the Chinese would likely kill the Tibetan.

Re:Good. Encryption is a tool too

[cryptoz]

Are you serious?

The main issue here is the presense of cryptographic software on the machine. Not a gun with his prints! They have no way of knowing what the software was used for.

It's like saying that they found rope with which he could have used to tie her. Or it could have been used to fix a mechanical problem in his house, or to wrap around bundles of wood, or anything. The presence of cryptographic software should have absolutely nothing to do with the case. Plain and simple.

Ooops

[Anonymous Coward]

I guess I should toss my shovel over the bridge along with my gun next time?

Troubles with encryption

[Neo-Rio-101]

But how will a judgment about encryption like that work when everyone uses encryption?

Ok, I know that this is a special case where there obviously seems to be other suggestive evidence for criminal activity... but if you were to take the idea that encryption = evil intent, then you open a can of worms.

Also, if the installation of encryption software alerted to possible encryption of files, then all someone has to do to avoid suspicion is to encrypt data over to a remote machine with no encrytion software - except a few "hot spare unformatted hard drives" which are apparently "unused"

5th Amendment violation?

[Fookin]

IANAL, but if you refuse to give up your private key and you have something to hide, can the state force you to reveal it? Or is that tantamount to forcing you to incriminate yourself? I would think that any information concerning encrypted data in that scenario would be inadmissable since it would probably prejudice a jury.

As a side note, with that earlier /. article about the MS guy saying to write your passwords down, is encrypting my password list an act with criminal intent?

Re:5th Amendment violation?

[Anonymous Coward]

Even More Important is the fact that you may be storing information in your brain that you have refused to decrypt and make public for investigators. Just as a disk may be encrypted and thus prosecutors are unable to determine whether anything important lies within, so too is your brain capable of hiding information that cannot be unveiled by prosecutors. What we need now is to prosecute people for having brains as potential encrypted information storage devices.

Re:5th Amendment violation?

[Anonymous Coward]

i think they can charge you with interfering with a law enforcement investigation. i saw this somewhere where a user wouldnt give up a password or something, and the district attorney pulled that charge on him.

Re:5th Amendment violation?

[Anonymous Coward]

IANAL, but if you refuse to give up your private key and you have something to hide, can the state force you to reveal it? Or is that tantamount to forcing you to incriminate yourself?

Good point, but any competent policemen would secure that evidence before arrest with a keylogger or similar. If you have enough evidence to arrest and press charges, you have enough evidence to get a court order to allow you to install a keylogger and duplicate the hard disk, surely?

Re:5th Amendment violation?

[MartinB]

In the UK? Yes. Which is plainly absurd.

Re:5th Amendment violation?

[Anonymous Coward]

If you are worried about such a situation, you might want to take a look at the TrueCrypt project at http://www.truecrypt.org/. Check the documentation about plausible deniability. Basically, according to the docs, an encrypted volume contains no signature, and no way to prove it is anything besides random data. You can also create hidden volumes inside encrypted volumes. So, if you are forced to decrypt the volume, you can have a few files in there that look like something you might want to protect, but the real info is still hidden.

I may not be explaining this perfectly, as I don't use this feature. Might be worth checking out though. Also, I think this product is only for Windows, but similar options are probably available for other systems.

Re:5th Amendment violation?

[WhatAmIDoingHere]

You can say you forgot, and as long as you stick to it, they can't do anything about it.

Re:5th Amendment violation?

[mikeee]

Sure they can. They can disbelieve, declare you in comtempt of court, and throw you in jail indefinitely.

Re:5th Amendment violation?

[WhatAmIDoingHere]

You're both wrong and stupid.

If you say you forgot, there is no way for them to prove that you haven't forgotten.

WWMD? What did Mitnick do? He said he forgot the password. They couldn't prove that he was lying.

If I remember correctly, I have the right to a fair and speedy trial.

Re:5th Amendment violation?

[Anonymous Coward]

The state would issue a separate subpoena for the key.

Re:5th Amendment violation?

[nugneant]

Fair and speedy are funny words.

"FAIR AND SPEEDY". An irrelevant /. tangent in one-act script form.

[SCENE. A pale off white police cell. Nothing terribly frightening about the place, unless one's an interior decorater, or has primarily been spending time in facilities built after the Red Scare (1950s for those of you not buff on retro-current events). WHATAMIDOINGHERE, a male in his early-middle 20s, sits in a chair. He takes on a very political, positive, business demeanor as the GOVERNMENT TEAM enters.

The GOVERNMENT TEAM consists of four men: LAWYER WHO DOES ALL THE TALKING, GOOD COP, BAD COP, and WEIRD QUIET FUNNY DUDE TAKING NOTES AND LOOKING AROUND WHILE THINKING ABOUT THE UPCOMING YANKEES GAME (for independant productions, WEIRD QUIET FUNNY DUDE can be replaced by INTERN or TENURED MIDDLE SUPERVISOR, as they both serve the same non-function). They look like people. Speak English too.]

GOVERNMENT TEAM: [all lines spoken by the LAWYER, but BAD COP continiously nods, as if agreeing. GOOD COP takes a seat after introducing himself in lines deemed "irrelevant to the central tangent at hand". WEIRD QUIET DUDE is weird and quiet. Perhaps he's staff at the police station and not directly part of the government team in any way]

So, we hear you forgot your password to your computer. And here we were trying to prosecute you for <some crime that by now is irrelevant>. Hey, that's okay, it happens to us all the time. Heh, Paul here [gestures to GOOD COP] forgot the password to his department's main network! Oh, those were some wacky times.

But let's get serious. We got this guy in the Vice President's chair. Boy oh boy is he squirming scared. Thinks the terrorists are out to get him. These next three years are going to feel like decades to the poor man.

You? Oh, we'll definitely get around to looking into that "fair, speedy" trial of yours. In a couple years. In the meantime, please sit peacefully in this cell and try not to upset that group of anti-social hulking possible-sociopaths waiting for their fair and speedy trial on tresspassing, breaking and entering, loitering, and physical threats made to an officer of the law. And don't worry about your job / friendships / family, we're sure you have vacation time, your friends won't grow old or change or do anything fun (or boring) with their lives, and gramps' cancer isn't spreading THAT quickly. Hehe, you can pass the time rewriting the law in QBASIC for your robot lawyer.

Don't get excited. That was a joke. Us men in the government, we like a good joke too.

So, anyway, see you in a couple years, and remember - we're not advising you one way or the other, but part of what keeps those revolutionaries in jail is that they keep filing MOTIONS. Motions disgust us. The more work you make for us-- well. No need to threaten, I'm sure you're a smart man and understand.

Remember, Dick would love to be in your shoes, sir. Two years, maximum. We promise. Or we think we promise. Maybe we won't remember either. And of course we'll have shuffled things around by then, and Dick won't be around for our clever governmental analogy, so we may have to rely on good ol' Storm Thurmond. You hated him too, didn't you? Yeah, yeah, so did we. Took, what, thirty years to get rid of him? Boy, now THAT'S a long time.

Sure you don't remember that password?

[GOVERNMENT TEAM exits to go read /., digging up the parent post and laughing at the words "wrong and stupid"]

WHATAMIDOINGHERE: [taking a deep breath, finally mutters in frustration to himself] What am I doing here!?!?

Re:5th Amendment violation?

[WhatAmIDoingHere]

Did the nice man with the clean white coat forget to deliver your medicine today, Sally?

Re:5th Amendment violation?

[nugneant]

Good job at dodging the issue.

With all that youthful "can do" ambition, I'd peg your age at 16.

Maybe in a couple years you'll figure out that you're not quite as 1337-tough as your hormones tell you, and you'll understand why I gave you a heaping helping of poppycock to illustrate the flaws in your argument.

Re:Good. Encryption is a tool too

[rhyno46]

I didn't RTFA... But if a crime was committed in the dining room of your home, and a (legally owned) gun which was not used in the crime was in your bedroom, should that gun be used as evidence against you?

Awesome.

[cfalcon]

I used Fedora Core 2. Encryption built right in, 256 bit in any of a few flavors. I encrypt my journal, which has nothing illegal in it. But, if I'm unwilling to let someone read my personal files, why not accuse me of any number of terrible things? Terrorist? Necrophile? Hell, rack'em up boys! If he has an encryption program, he's obviously a criminal?

Good citizens have nothing to hide, after all. Why don't we just ban encryption entirely? And we'll install the cameras here and here...

Seriously...

I'm not totally familiar with what this means legally, but I know it's a bad thing. And a reason for every OS to include it by default, PRONTO!

If this stands up, privacy will take a beating.

Re:Awesome.

[amliebsch]

I'm not totally familiar with what this means legally, but I know it's a bad thing.

You have no idea how ignorant that sounds. Please leave trial law to the lawyers. Watching CSI does not make you a legal expert.

Re:Awesome.

[zoloto]

This is the dangerous precident I mentioned above. (here). I really hope other investigations don't use this as such to set a precident.

What a terrible price the public would pay. Where is my government, and who put this one in it's place?

Beuller... Beuller... ?

Re:Awesome.

[cfalcon]

"You have no idea how ignorant that sounds."
You have no idea how arrogant that is.

"Please leave trial law to the lawyers."

Perhaps I'll leave it to my elected officials instead?

I'll let you trust the lawyers. I know a few of them, so I'm smart enough not too. Additionally, I've gone to jury duty and seen them quizzing the jury, using every dishonest marketing technique they could (like picking someone who was going to parrot the view they wanted, and quizzing them on an issue so that the things they said sounded more reasonable not coming out of their own mouths).

What I mean, for those not smart enough to pick it up off the first read, is that I'm not sure if they mean "you can plausibly use presence of encryption software as something to establish guilt" or "in the presence of 'beyond a reasonable doubt' evidence, you can use the presence of encryption software to show that he was up to something bad".

EITHER ONE IS A BAD THING

The first, because it lets you paint technoknowledgeable people as criminals pretty much at will.

The second, because it takes what should be present in *every* household, standard on every device, and makes it questionable. In addition to the fact that it's undoubtably going to be used in the mindfuck game that is hypnotising the jury to come to the conclusion that you want- "LOOK HACKER UTILITY", etc.

And I don't watch shitty TV shows. But perhaps you do, what with your cowboy attitude.

Re:Awesome.

[Wild Wizard]

You have no idea how ignorant that sounds. Please leave trial law to the lawyers. Watching CSI does not make you a legal expert.

And what does CSI have to do with law or lawers?
Perhaps if you mentioned Law & Order instead you wouldn't now look like a fool.

Re:Awesome.

[Anonymous Coward]

"Perhaps if you mentioned Law & Order instead you wouldn't now look like a fool."

I'm pretty sure he was destined to look like a fool.

Re:Awesome.

[amliebsch]

I will admit ignorance when it comes to television. All I know about CSI is that it has something to do with criminal cases and it plays hell with our juries. The expectation for forensic evidence in cases like, I kid you not, disorderly conduct, has been directly attributed to the popularity of this show.

Re:Awesome.

[jumbledInTheHead]

The odd thing is necrophille isn't illegal in most places. It's a little frightening, but then again it doesn't matter to me once I'm dead; however, the thought of it now is disturbing.

Re:Awesome.

[noidentity]

Good citizens have nothing to hide, after all. Why don't we just ban encryption entirely? And we'll install the cameras here and here...

People use encryption to hide data from entities other than law enforcement. I have a social security number, credit card number, etc. that is worth hiding, but not from the government or even credit profile companies, since they already have the information.

Re:Awesome.

[Bacchuss]

I use MS Windows XP (EFS, MSIE, MSOE) and Mozilla Firefox and Thunderbird, FlashFXP, Cygwin/OpenSSH, GnuPG, Trillian, Skype and many more. All of these applications use some kind of crypto, would that mean I try to hide some illegal action?

I use crypto every day, almost every hour that I'm awake. (Yeah, I'm a geek ;-) ) Everyone using a PC on a regular basis has once used crypto and there are many people using crypto daily without knowing.

BTW: I have some envelopes here too, I could hide naughty pictures with little boys in them, you know.

Re:Awesome.

[typical]

I remember seeing someone charged with desecration of a corpse, so at least in some places in the States, it is. Seriously, I don't care. You're dead, you don't care, and if it makes someone happy, go to. 'course, some people refuse to be organ donors, so what can I say...

All Mac Users are now guilty

[toupsie]

Since all modern Macs ship with FileVault as an option for securing their home folders and you also can create encrypted disk images with the Disc Utility tool in Mac OS X, this now can be used against Mac users in a court of law. Somehow, I suspect Bill Gates is behind this. No doubt, in a couple days, we will be see Microsoft ads touting that if you use a Mac, you will go to jail.

Re:All Mac Users are now guilty

[cryptoz]

The main problem with this statement is that Windows XP includes encryption software as well. So do most modern Microsoft products.

Re:All Mac Users are now guilty

[Anonymous Coward]

Except in the case of the Mac, it actually works with no security issues. Other than that, yeah, the same thing is in XP.

Re:All Mac Users are now guilty

[Trillan]

Windows XP Pro encryption does work, believe me. A little too well. I even knew my password and still couldn't decrypt my files. :)

Re:All Mac Users are now guilty

[Grim Leaper]

> Somehow, I suspect Bill Gates is behind this. No doubt, in a couple days, we
> will be see Microsoft ads touting that if you use a Mac, you will go to jail.

The fact that someone modded this insightful is hilarious.

c'mon stupids

[Anonymous Coward]

Read the article! Quit posting in a vain attempt to be first.

He already committed the f'ing crime.

Levie's conviction was based on the in-person testimony of the girl who said she was paid to pose nude, coupled with the history of searches for "Lolitas" in Levie's Web browser.

The guy wasn't convicted because of the crypto. It's like finding the dead body... and then finding the shovel, the canvas bag, etc.

Re:c'mon stupids

[Anonymous Coward]

"The guy wasn't convicted because of the crypto. It's like finding the dead body... and then finding the shovel, the canvas bag, etc."

In this case it is more like the police finding a canvas bag and a shovel in the guys garage that have no connection with the dead body. And then using that evidence to come to the conclusion that the guy clearly planned a murder.

Re:c'mon stupids

[surprise_audit]

One thing that the police didn't find, or at least if they did they left it out of evidence, was any encrypted files. Making the jump from "there's an encryption program installed" to "therefore he's guilty" would be like, to use your analogy, finding a body and a shovel and convicting the guy as a mass murderer. Obviously if the guy killed once and owns a shovel, there must be numerous shallow, unmarked graves containing his other victims...

Note I'm not defending this lowlife, just questioning the jump from "encryption" to "criminal intent".

Re:c'mon stupids

[RedBear]

Who cares what other evidence there was? So he was guilty, that's not the point. The crypto was still used as "supporting" evidence, even though it didn't support the case because they had no actual evidence linking it to the crime. The fact that it was still declared supporting evidence by its mere presence is still a dangerous precedent. It's like using the fact that a defendant owned a pair of running shoes as supporting evidence that he was planning the robbery he committed. It would rightfully be seen as an indictment of running shoes as a whole, and one step away from the criminalization of the owning of running shoes.

Re:c'mon stupids

[gl4ss]

ok.. you'll get busted next friday.. because of riaa. and you have "mp3" files on your computer so you knew what they were for - you also had windows file encryption enabled so you had something to hide. so that is used as an evidence for you to have copied the latest hit song from artist x. you have the means, you have a soundcard - but they can't find the song - but they say that doesn't matter because they 'know' you were on p2p.

child porn cases makes for 'easy' precedents because of the "THINK OF THE CHILDREN!!" attitude which brings the pitchforks into the game. and frankly, in usa anyways, anything under 30y is labeled as "teen porn" for some friggin reason.
paid to pose nude? how eeeeeevil. if there's enough evidence otherwise - WHY DID THEY BRING THE EXISTENC EOF PGP AS EVIDENCE? don't they have the 'body'? or do they just have a body, a canvas bag and not the.

or how about if you're suspected of inside trading? and the court uses a precedent that it's damning evidence that you have pgp installed? in many industries if you communicate with certain companies you HAVE to have pgp. the pgp could also be used for encrypting communications to some friends that your stock is going to boom or fall, but that shouldn't be taken as certain.

Re:c'mon stupids

[Anonymous Coward]

Pretty weak evidence he was guilty at all. The testimony of a 9 year old, and a web browser history? Suppose a co-ed accuses you of raping her, and they find a google search for "rape" in your web browser history. Does that make you a rapist?

Re:c'mon stupids

[WhatAmIDoingHere]

If he was making "artful" works, it's not against the law to take nude pictures of children. If it was, all our mothers would be pornographers. You can't tell me your mom doesn't have a photo of you from when you were 2 or 3 running around the yard naked..

Re:c'mon stupids

[bitslinger_42]

I read TFA, although admittedly after I'd already written one somewhat scathing post (trying to get a foe, I really am :-)

TFA left me somewhat curious. I wish there was more specific information about what the other evidence was. It isn't unheard of for a child to accuse someone of a crime (Salem witch hunt, anyone?), and I'm not sure what the specific searches were for. On the one hand, searching for "Lolitas" plural is one thing, but a Google for "Lolita" also turns up information on the Nabakov novel that was required reading in several classes I took in college. If the testimony of one person, and a person that the state considers unfit to make decisions about her own sexuality at that, a potentially vague Google search, and the highly-prejudicial use of the "PGP as indication of criminal intent", I can see the possibility that this guy was railroaded.

Porn bad. PGP good.

[rice_burners_suck]

I would not view this decision as a threat against PGP in particular or encryption software and/or algorithms in general. The court is merely trying to determine the intent of the defendant.

The encryption software here is treated in the same manner as an item such as a large bag would be treated in a shoplifting case. That is, if you go into a store, see something you like, grab it, and run, the court would likely view that as something that you did at the spur of the moment, without putting much forethought into it. The crime, while still very much a crime, would likely be treated as a stupid action you took because you didn't stop to think if it was right or wrong, and the sentence would likely be applied with some leniency. In such a case, assuming the item costs less than $400.00, the crime would be treated as a misdemeanor. On the other hand, if you had entered the store with an unnecessarily large bag that is mostly empty, this might, in the eyes of the court, show that you had planned to shoplift from the outset, and you would receive a much stiffer punishment. In this case, the crime would likely be treated as a felony, regardless of the item's value.

In much the same way, the court handling this pornography case is probably trying to determine under which of the statutes the aforementioned materials fall, and the presence of software used with the intent to traffic in such material, regardless of the software's generally accepted purpose, can allow the prosecution to go for a crime with stiffer penalties.

In other words, if you use PGP, don't worry, because it's not going to be outlawed. But if you're the guy in that pornography case, be afraid... be very afraid. Here in Soviet Russia, pornography encrypts YOU!

As an aside, one should not look at pornography, because it can have an adverse effect on future relationships that you might have.

Re:Porn bad. PGP good.

[Anonymous Coward]

one should not look at pornography, because it can have an adverse effect on future relationships that you might have.

Only if she's a total bitch of a prude who thinks men were put on Earth to be whipped and emasculated. But then why would you want to meet a woman like that in the first place?

Re:Porn bad. PGP good.

[Anonymous Coward]

In much the same way, the court handling this pornography case is probably trying to determine under which of the statutes the aforementioned materials fall, and the presence of software used with the intent to traffic in such material, regardless of the software's generally accepted purpose, can allow the prosecution to go for a crime with stiffer penalties.

I would like to point something out to you, that is, a computer is an object that is a daily part of many peoples lives, including this creep. Now in the course of his daily events he decides that he wants to encrypt private communications, or any file that is his business and the courts shouldn't prosecute him for that. They should only prosecute him for using his encryption software to encrypt that porn.

The problem with your analogy is that a large, and rather empty bag is not something that someone carries around on a daily basis. So I propose a question to you. If a woman, who has a gun in her handbag, goes into a store and takes an item, is it armed robbery? I think not, however, IANAL.

Re:Porn bad. PGP good.

[Anonymous Coward]

As an aside, one should not look at pornography, because it can have an adverse effect on future relationships that you might have.

Oh, come on! *Anything* could have an adverse effect on future relationships:

• Eating pork, if you end up dating a jew or a muslim.
• Voting democrat, if you end up dating a republican (or vice versa)
• Having an account on Slashdot, if you end up dating a non-geek.
• Submitting patches to Linux, if you end up dating a senior Microsoft executive.

I could go on. Maybe the parent meant specifically kiddie-porn. If so, I think there are far better reasons for not looking at it than a future relationship with a hypothetical prude.

Re:Porn bad. PGP good.

[G-funk]

As an aside, one should not look at pornography, because it can have an adverse effect on future relationships that you might have.

Wow, that last line really took the wind out of what was until then a well thought out, reasonable, intelligent reply.

Re:Porn bad. PGP good.

[Anonymous Coward]

Only if she's a total bitch of a prude who thinks men were put on Earth to be whipped and emasculated. But then why would you want to meet a woman like that in the first place?

Some guys are like that.

But they're freaks.

Re:Porn bad. PGP good.

[EvilCabbage]

one should not look at pornography, because it can have an adverse effect on future relationships that you might have.

I thought we just shouldn't look at it for fear of making baby Jesus cry?

Re:Porn bad. PGP good.

[Mitch Monmouth]

Usually I pay extra for that.

Next time I'll just bring porn.

Re:Porn bad. PGP good.

[RedBear]

You, like many others today, miss the important distinction, and the mods didn't catch it. What possible purpose could you have for carrying a large empty bag into a store, other than shoplifting? Its presence is a strong indicator that you were planning on shoplifting something. The mere presence of encryption software has no relation. It is not a strong indicator of anything, unless they can establish as fact that you purchased or used the software specifically for committing a crime. It is merely a general tool, like the computer itself, or the envelopes you use to mail letters. The fact that he uses envelopes to mail letters, or the fact that he owns a computer in the first place, was not used as supporting evidence of criminal intent.

There are so many other legal uses of encryption software that a ruling like this should always be considered very dangerous. It is not his use of the software to encrypt photos that is being used, because they have no evidence of that. It is the mere presence of the software, implying that its only possible use on his computer would be for criminal intent. That is the bad part.

Re:Porn bad. PGP good.

[Anonymous Coward]

Glad to see that at least one person has a fucking clue.

Re:Porn bad. PGP good.

[Lars Clausen]

I and many others in .dk regularly take large bags into shops. Simply because new bags cost significant money, we reuse old ones. So there are other reasons for entering shops with large bags.

That aside, I still think it sets a dangerous precedent. Having a gun in your house surely does not mean you premeditated that murder in self-defense when you got burgled?

-Lars

Re:Porn bad. PGP good.

[ajs]

More to the point, the presence of PGP (or clone thereof) indicates that you probably have a run-of-the-mill Linux distribution installed. I haven't installed such an OS in the last 4 years that didn't come with one by default.

If it was a Windows box (most likely), then there's a case for saying, "he planned to hide something," but even then I'm not sure that can be considered evidence of criminal intent. For example, I might have a safe in my house. Is the safe evidence that I plan to have expensive jewelry, or is it evidence that I plan to have legal documents that I care about?

Same goes for PGP. I might want to use it to confirm signatures in email or store kiddie porn safe from authorities or encrypt my credit card info to mail to a mail-order house that doesn't have a Web site (done that twice in my life so far).

Nother point for the defense: Almost all computers come with software that does roughly the same thing, but isn't stand-alone. The libraries that Web browsers use to do e-commerce do just about exactly the same thing as PGP, and can easily be used by anyone with some basic programming skills to hide anything from kiddie porn to the Christian Bible from your dissaproving athiest family.

Re:Porn bad. PGP good.

[ajs]

Thinking a bit more about this, after the above post, I should point out a scenario by which this ruling DOES make sense:

If the prosecution had encrypted files in hand that they had some way of demonstrating the contents of (e.g. they got his private key and decrypted them or he surrendered their contents), and then they pointed to the PGP installation and said, "look here, he installed PGP 2 years ago, which means that he was thinking about the ramifications of the discovery of his actions, even then." -- then I can see the judge's ruling making sense. It's not PROOF of any intent, but it's evidence of such intent (and evidence comes in many degrees of reliability, which courts have to contend with all the time, so that much I trust).

Re:Porn bad. PGP good.

[Anonymous Coward]

I often walk into the neighborhood grocery store with an empty backpack. Is it because I intend to shoplift from the store? No; I use it to easily carry my groceries home after I've bought them.

Re:Porn bad. PGP good.

[Anonymous Coward]

What possible purpose could you have for carrying a large empty bag into a store, other than shoplifting?

hmm... ever attend a university? are all of those kids carrying backpacks planning on robbing the student commons blind?

i was in downtown Boston, a couple of weeks ago, and i would say that >1/10th of the people walking around, downtown, had either backpacks or brief-cases. were they all planning on knocking over the local dunken` donuts?

that said...

Here, in Soviet America, encryption pr0ns YOU!

Re:Porn bad. PGP good.

[Anonymous Coward]

As an aside, one should not look at pornography, because it can have an adverse effect on future relationships that you might have.

Actually next time I have a boyfriend (I'm female btw) I'm sure he'll appreciate all I've learned from writing slash. :)

Re:Porn bad. PGP good.

[Anonymous Coward]

Just having it on the computer is not like taking a large bag into a store and then shoplifting. It is more like owning a large bag. If there is evidence that you entered the store with the large bag that is different. Just like evidence that the encryption software was used to hide child pornography.

Owning encryption software, just like owning a large bag, shouldn't apply to your case unless there was evidence that you used that software/bag to hide stuff.

Re:Porn bad. PGP good.

[Anonymous Coward]

What possible purpose could you have for carrying a large empty bag into a store, other than shoplifting? Its presence is a strong indicator that you were planning on shoplifting something.

You know, I see environuts all the time bringing bags into stores because they want to reuse their bags. And if you're starting to shop, your bag is likely to be empty.

Once was doing my laundry at a laundromat, and took my huge duffle bag. Not wanting to leave my bag there, I took my empty bag with me to do some shopping during the wash cycle.

There are plenty of legit reasons to carry an empty bag. In Soviet times, people would carry "perhaps bags" with them, just in case they happen to see a store selling something they wanted to buy.

Similarly, given the many legit uses of PGP, and given the lack of any evidence of use of PGP in this crime, it is irrelevant to this case.

Re:Good. Encryption is a tool too

[Anonymous Coward]

No, he is not serious. He is however one of the most successfull trolls on slashdot.

I had better uninstall PuTTY

[jpardey]

I could be privatly communicating with terrorists on my college's UNIX server. I wouldn't need to be proven guilty. Proving guilt is SO 1900s...

In other news...

[StratoChief66]

An upstanding citizen has come forward with a computer he 'found' on the street and sues the 'previous owner' because the fact that his data was encrypted is obviously evidence of illegal intent.

The previous owner was lynched later in the day and we applaude this model citizen for bringing this travesty to our attention.

Locks and Keys

[rscrawford]

My front door has a lock which can be opened only with my key. Therefore, I am hiding something reprehensible inside my house.

Logic, people, logic!

Hmm

[pHatidic]

The article says the conviction was based in part on his searching for child pornography through search engines. However, if he used PGP to encrypt his HD then there is no way that law enforcement could have known this. Does that mean that Google or whichever search engine he was using logged his search history and handed it over to police??

Re:Hmm

[FuryG3]

Does that mean that Google or whichever search engine he was using logged his search history and handed it over to police??

Most likely it means he went to the trouble to PGP encrypt his data, but not wipe his IE history.

Whoops.

Keys and Passwords

[urbaneassault]

Keys and passwords can be obtained during discovery, and failure to provide them is the same in the eyes of the law as not providing keys to your premises; you can be found in contempt for such.
Why on earth did the court rule that the mere existence on this criminal's systems constituted criminal action?* Why didn't they ask for keys as part of the trial and find out what he had encrypted? All this does is punish us in the tech world by alluding to the use of cryptography as a criminal action.

*And yes, this guy certainly deserves what he had coming, but don't punish me for his actions...

Re:Keys and Passwords

[jadavis]

Can you give me a reference to show that you can be held in contempt in criminal court for not turning over encryption keys?

It would seem to me that you would be protected by the 5th Amendment. After all, you have the right to remain silent, right? You can just sit there and never say a word and wait for them to acquit you, right?

Re:Keys and Passwords

[WilliamX]

Discovery as you seem to define it does not apply in criminal cases. The defendents 5th amendment rights against self incrimination would trump that.

Re:Good. Encryption is a tool too

[AvitarX]

So who is the co-conspiritor?

Are you implying the programmers are a party to this crime? If this is the attitude of people who frequent /. the suprise is the judge was so lenient.

I don't know how I feel about this, encryption is not a crime, but if there is a warrent for your computer not supplying the keys to examine its contents could be viewed as obsctruction of justice. I understand the desire to have things kept private, but the courts can do that if the evidence is irrelivent. This seems to me like Morgan-Stanley getting slammed for deleting their emails, only this guy is worse, because he can give people access to show his innocence (assuming he is since he wasn't proven guilty).

I think certainly that someoen has a bunch of stuff they refuse to let you see after handing it over it is relevent. It would likewise be relevent if he had an uncrackable safe the propper size to hold a body and was on trial for murder, but neither is a case for conspiracy (unless safe makers are to be co-conspierators too).

Uh

[WindowLicker916]

What about the right to privacy? Regardless of what he was doing, encryption secures privacy, and if part of his sentencing was achieved in part because he was using encryption....what other ways could this ruling effect future court cases? I can easily see this becoming a supreme court issue on how encryption relates to the constitution. What is Martha Stewart used encryption on here computer because of her everyday dealings....and then this whole insider trading thing comes about and her and whoever had been talking via email....does encryption on her system automatically make her a person out to do bad things? (regardless of how you feel about her :P)

Re:Uh

[jadavis]

First off, there's no Constitutional right to privacy. Privacy is far to vague anyway; the Constitution preserves specific aspects of privacy (like what's in the 4th Amendment), and nothing more. There are laws which protect privacy in limited ways, however.

Second, as others have said, it's just a tool. It's legal to do lots of things; it's a free country. However, many of those actions can be held as evidence against you.

If you take your absolutist approach to criminal justice, and combine that with your absolutist approach to the nebulous concept of privacy, you could really never convict anyone at all. A trial would go something like:

Prosecution: "We'd like to present the smoking gun -- the murder weapon -- found at the victim's house, with the defendent's fingerprints on it."

Judge: "It's perfectly legal to hold a gun at a private residence. Perhaps he didn't know it was the murder weapon. I won't admit that evidence."

Prosecution: "We have eyewitness testimony."

Judge: "What was the witness doing spying on the private residence?"

Prosecution: "We have video evidence."

Judge: "Invasion of privacy."

Prosecution: "We give up."

Classic "You must be hiding something" syndrome

[cbreaker]

I agree with you. It's bullshit.

Some of us like this little thing called PRIVACY. It's something that you get less and less of these days and it's only going to get worse. RFID national ID cards, bias against encryption, tracking databases, no travel without ID..

The excuse is always "If you're not hiding anything you don't have anything to worry about." I don't know what these people are afraid of. Why can't I go about my life without being tracked? Why is it a bad thing that I want to encrypt my communications?

A 12 year old can figure out that if one wanted to commit a crime, all these things won't help any. So obviously that can't be the reason.

Bah. People suck.

Re:Classic "You must be hiding something" syndrome

[Moridineas]

What argument are you attempting to make. Are you saying that if you're a child pornographer that you should be allowed to continue your actions just so long as you encrypt the result so it's private?

Because that's what it sounds like you're saying, and I don't think that makes any sense.

Please. Stop. The. Paranoia! You're not being tracked. You can encrypt whatever you want. You're NOT allowed to break the law and get away with it just because whatever you did was encrypted.

Bah. People who don't think do, indeed, suck.

Re:Classic "You must be hiding something" syndrome

[zoloto]

"Friend added"

I'm not so worried about the national ID card at the moment, maybe I see things differently, but I highly doubt it will actually come into play SOON. As in less than 10 years. Governments have a tendancy to move extremely slow. Much of what I understand in their intent on such an ID, would be standardization of certian things within the ID system so it would be technically simpler in terms of accessing data.

The system has been in place for decades to share information, but never in electronic form... yet. This would allow easier access, but they'd still have to go through the red tape to access such information. Maybe I'm too utopian about the idea of such. Let me know if you think I'm wrong.

Now back on topic.

I love my privacy. I seperate my online transactions with what I want to keep anonymous and what I don't mind being put in the public. Journals, Emails, whatever software I happen to be writing, business plans etc. No one has a right to see them. Encryption is merely a means to an end for me in privacy. I lock the bios, user authentication with linux or Windows (with the NSA's help), and GPG with WinPT

Re:Classic "You must be hiding something" syndrome

[cbreaker]

"What argument are you attempting to make. Are you saying that if you're a child pornographer that you should be allowed to continue your actions just so long as you encrypt the result so it's private?"

Of course not, but you did manage to prove my point.

Thanks.

Re:Classic "You must be hiding something" syndrome

[cbreaker]

I am usually optimistic about things, but lately when it comes to the descisions of the US government, it's very hard.

I'd like to believe that the reason the RealID will exist is because it just streamlines the whole thing. I mean, sure, if it saves money in the end and it makes trips to the local DMV less frequent, I'm all for it.

And maybe that IS the intent. For now. But when we roll-over and accept these new systems without questioning them, especially ones that have the potential to be a huge violation of privacy, it's a big problem.

At least not everyone in power is a mindless minion of big business. After all, the broadcast flag thing didn't happen.

Re:Classic "You must be hiding something" syndrome

[Moridineas]

What's your point? That encryption provides an excellent opportunity for criminals to cloak their actions? Guess what, it's been going on for years. I fear for the society in which anything is legal so long as you hide all the evidence...is that REALLY what you're advocating? I'd really appreciate you explaining your point, since you did take the time to reply again.

Re:Classic "You must be hiding something" syndrome

[LittleBigLui]

What argument are you attempting to make. Are you saying that if you're a child pornographer that you should be allowed to continue your actions just so long as you encrypt the result so it's private?

He's saying that encryption software has plenty of legal uses. That's all. He didn't say anything about criminals.

Some claim that if you're no criminial then you've got nothing to hide.

He says that he's no criminal and still has plenty to hide.

Re:Classic "You must be hiding something" syndrome

[TCM]

These days, isn't there already a law (as in Godwin's law) that states:

"Anyone who brings up the 'You must be hiding something if you encrypt' argument in a discussion automatically loses."?

Because there should be.

Re:Classic "You must be hiding something" syndrome

[rtb61]

I used to receive computer security notitications from the department of homeland security, they recommended the use of pgp and even provided a link to download it. Now I know why, it wasn't to secure my communications it was so that in the future if they chose to, they could establish criminal intent.

Encrpyt a file, forget the password and you are now guilty of any crime they choose to convict you of, from child pronography to terrorism. Hell if you computer decides to muck up a file save and makes a jumble of the file they can claim it is encrypted because they can't read it and to jail you go. Hey you can even have some fun, hack somebody else's computer and encrpyt the drive and then report them to authorities, the victim deserves to get punished twice.

When laws are written beware, the worst possible interpretations will always end up being used against you.

Re:Classic "You must be hiding something" syndrome

[mboverload]

Because of the judicial branch.

The Executive and Legislative are completely corrupt.

Re:Classic "You must be hiding something" syndrome

[Moridineas]

Yes, you're actually right, that IS why the department of homeland security recommend that you use encryption, and such a lucid and sane argument will probably be used against YOU one day.

Good thing you're on to them...

Re:Classic "You must be hiding something" syndrome

[Anonymous Coward]

And so when you end up in court, and the prosecution says the fact that you have pgp means you're guilty, are you still going to sing the same song?

Once this precedent is set, do you think its only going to be used against child pornographers? When you're done thinking of the children, how about thinking about the rest of us?

Re:Classic "You must be hiding something" syndrome

[mikeswi]

Are you sure you replied to the right comment? I've read and reread your comment, its parent and all it's children/grandchildren a good 10 times now and I honestly still cannot figure out why you made your comment. All I can figure is that either you badly misunderstood the comment you replied to or you simply replied to the wrong one.

He wasn't so much as hinting that a crime should go unpunished because encryption was used. At all. I don't see that anywhere in his comment. He was pointing out how lazy and apathetic "I have nothing to hide" is. And he's right about that.

Re:Classic "You must be hiding something" syndrome

[Anonymous Coward]

What argument are you attempting to make. Are you saying that if you're a child pornographer that you should be allowed to continue your actions just so long as you encrypt the result so it's private?

Yes, I'm sure that's exactly the argument he was attempting to make. How very clever of you.

NSA could break PGP?

[Anonymous Coward]

"Schaub testified that PGP "can basically encrypt any file" and "other than the National Security Agency," nobody could break it."

Anybody cares to expand on NSA's capabilities? Hardware, Software?

Re:NSA could break PGP?

[HermanAB]

You can safely assume that the NSA can break anything. They do not 'play fair' when they try to break things - they 'play dirty' and look for weaknesses in the implementation. They use enormous lookup tables and dictionaries. They use special hardware. If they know something is on a PC, then they could read all data off the hard disk and try every word or phrase ever typed on it as a key. Of course, you need to be pretty friggen important before they will waste their time on you...

Re:NSA could break PGP?

[cryptoz]

The NSA cannot break PGP. Nobody can, not ever. They can figure out the information you have hidden, though, because there's a very, very high chance that there's a copy of the information floating around unencrypted (RAM, swapped to the HDD, in a temp folder somewhere, etc) or a copy of your password floating around. That's how it would be done.

Re:NSA could break PGP?

[beej]

The NSA cannot break PGP. Nobody can, not ever.

Somewhere I hear Vadar saying, "I find your lack of faith disturbing..." ;-)

PGP uses a passphrase, right? What are the chances this guy's passphrase--now remember he's not only dumb enough to make and locally store child porn, but he doesn't even clear out his browser history--what are the chances his passphrase contains more than, say, 40 bits of entropy?

You don't have to break RSA or El Gamal or IDEA or Blowfish or whateverTF he was using...just get his keyring and bruteforce the passphrase. Or, if he's just using the symmetric cipher, do the same thing.

4096-bit RSA over Blowfish is pretty damn strong. Too bad the passphrase is so weak! It's like having that huge shield door from NORAD on your house, except with a full-size doggie door built into the front.

Re:NSA could break PGP?

[beej]

One more thing: I'll bet you a beer that the strongest encryption PGP offers today will be crackable in under an hour (of real time) within 35 years.

Re:NSA could break PGP?

[synchronize]

The NSA does not need to be able to break PGP. Passwords are used by people, and that's an inherent weakness. Any PGP password will be of finite length and finite complexity. So do you think it's beyond the NSA's ability to store massive lookup tables of every letter/number/symbol combination available on a standard 101-key keyboard, up to some finite length? Not hardly.

And is it difficult to implement this brute-force key search on the massively parallel architectures surely used by the NSA? Nope.

Think about the average complexity of any password a normal individual would use repeatedly, and you'll see how easy this really is. The NSA laughs their collective asses off at any commentary that begins, "The NSA cannot break [insert cipher name here]. Nobody can, not ever."

We don't even need to talk about differential cryptanalysis and other such exploits that would help to make the NSA's job even easier. Why bother? The weakness of the people who use the passwords is enough to "break" just about anything.

/sync

Re:NSA could break PGP?

[lachlan76]

Lookup keys and a salt. The salt would make a significant difference.

Re:NSA could break PGP?

[Alsee]

he's not only dumb enough to make and locally store child porn

Huh? From what I read there was no child porn on his computer and no encrypted files.

-

Re:NSA could break PGP?

[beej]

Ooops, you're right. I retract that statement. I had assumed since he was accused of taking the pix they must have been found on the computer. Damn, what an ugly case.

Re:NSA could break PGP?

[marcosdumay]

Wrong. It is true that you can't safely assume that the NSA can't break PGP, but this is only possible if the algorithms happen to have some bug and NSA knows it. But this is a very very very unlikely situation*.

If the algorithms used by PGP have no bug known by NSA, no amount of 'playing dirty' will help them. No amount of special hardware will help breaking it**, but gathering the password from social engenireeing will work if you don't know how to use it properly. Also, keeping a non-encripted copy will obviusly help them.

* There is the 'feeling' that RSA will be broken soon, but using it is probably still safer than anything else.
** Unless you can power it with something other than the Sun or use some weard technology, like quantum computing or time travelling.

When discussing this, please remember:

[Anonymous Coward]

In America, no person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law.

Unless they are charged with child molestation. In that case, they are clearly guilty and we may dispense with the technicalities.

PGP is not on trial

[Bullfish]

It isn't any different than if you have a legal gun and then conceal it when you go out. The gun stopped being legal once you did that. Here, the point is that he knew what was doing wrong and he punctuated it by encrypting it making it, arguably, a de facto admission of guilt.

Re:PGP is not on trial

[Anonymous Coward]

Hrm... well, I see what you are saying, but given that you can get a concealed permit, it's a subpar example.

Re:PGP is not on trial

[RedBear]

It isn't any different than if you have a legal gun and then conceal it when you go out. The gun stopped being legal once you did that. Here, the point is that he knew what was doing wrong and he punctuated it by encrypting it making it, arguably, a de facto admission of guilt.

Except that:

A) They have no evidence that he was using it to conceal anything related to the case.
B) It is perfectly legal to carry a concealed weapon in many states, although some require a license. So your analogy is faulty.

So it is quite different, and there is no way it can be considered an admission of guilt because it can't be linked to the crime or the intent to commit a crime. it should never have been part of the case.

Re:PGP is not on trial

[Bullfish]

In most jurisdictions, you do need a license to have a concealed weapon and in some you don't. The point was that in most jurisdictions, something legal becomes illegal when you use it in a crime. Did he use it to hide the kiddie porn, fact is we don't exactly know what he encrypted, unless you were at the trial.

Re:PGP is not on trial

[DavidTC]

Except, of course, some of us read the fucking article and noticed it said that the police introduced no child porn or encrypted files as evidence.

Re:PGP is not on trial

[Bullfish]

I RTFA and it was short, short on words and detail. More went on than in those three-four paragraphs.

Anyway, I don't think anybody has to go to bed worrying that the mere presence of PGP will get them charged with anything. Nor will it make much difference in sentencing.

Re:Windows XP qualifies

[Anonymous Coward]

"Since Windows XP has a built in encryption feature (EFS) wouldn't it follow by this logic that use of Windows XP qualifies as criminal intent?"

Not exactly, more like criminal stupidity.

Time to bust the Post Office!

[DirtyAss]

Under this logic, the use of envelopes to secure personal mail is clearly a sign of criminal intent. BAN ENVELOPES! MAKE EVERYONE USE POSTCARDS!

Re:Good. Encryption is a tool too

[rhyno46]

Why wouldn't they be able to tell what the software was used for? Couldn't they decrypt content with his PK?

Overall, I agree with your statements... as long as the guy didn't use the encryption software to achieve illegal means. But, for instance, once he encrypts and distributes the content then the encryption software becomes part of the case.

SSL...

[HermanAB]

I guess SSL could also be used to pay for stolen goods on Ebay...

Uh oh.

[FlyByPC]

I hope to hell they don't notice that EVERY computer with a modern Internet browser (and those with IE as well) have encryption capabilities. We'll all hang!

what else is there to say?

[DJOtaku]

What can I add to this that hasn't already been said half a dozen times. I use GPG (Gnu version of PGP) to digitally sign my email messages on my Linux machine. This is because certificates and other authentication methods cost money. GPG allows others to certify that I sent the message that claims to be from me. This is helpful for spam that parades as coming from me as well as other things. Additionally, as my family is starting up a business and we will all be in different states, the safest way for us to exchange information cheaply. Yeah, we have free long-distance on our cell phones, but for that we may as well be yelling out our windows. Email is likewise able to be tapped without some encryption. Thunderbird, enigmail, and GPG allow me to get a decent amount of protection for free. It isn't NSA-grade encryption, but it's good enough to stop most people. So yeah, I'm not a criminal because I use encryption. I just like to have some privacy. Otherwise why not just post my SSN to slashdot?

Re:Good. Encryption is a tool too

[Dancin_Santa]

So who is the co-conspiritor?

I struggled with this question, and in some ways regret specifying Conspiracy. However the answer I came up with was whomever he was sending these encrypted files to.

And obstruction of justice is, as you say, another appropriate charge.

On the other hand, if he never sent the files and kept them for his own private use, then the conspiracy charge doesn't make sense.

License

[Anonymous Coward]

Yes, if you don't use it STRICTLY FOR EVALUATION PURPOSES, the BSA will be after you!

minnesota people

[Anonymous Coward]

Boomhauer: "Yeah man, I'll tell ya that dang old internet, man you just be on there point, click,click,click, it's real easy man"

Replace 'internet' with 'encryption program'

Two Words

[ZephyrXero]

That's bullshit!

I guess a 1984-esque government wouldn't want their "law abiding citizens" to be able to use encryption, so it only makes sense...

Re:Two Words

[xlv]

That's bullshit!

That is three words...

Re:Two Words

[Anonymous Coward]

Yes but is "That's" just one word or is it really two? Don't just gloss over the details because they don't agree with your theories. Contractions deserve the same respect that more formal incomplete sentences receive. Or should we accept monosyllabic utterings as proper grammar now?

In analogy

[mgbastard]

Note in the article, encrypted files were not EVEN located on the computer used in evidence.

This is tantamount to pointing to a car in which drugs were sniffed (but not found), and telling the jury, it has locks, so they must be trying to hide something. ( and further introducing the car or its locks, and the police testimony thereof as evidence )

Yes, I read that the girl involved testified against him, so forget about whether he's a slimeball or not, he probably is, the jury assumedly believed her story.

Bollocks!

A lot more than just XP...

[cgenman]

First of all, only terrorists use jabber, so you better get rid of that. That e-mail client with encryption? Gone. SSH? SSee you in Jail, perv. Zip it? Better trash it.

On the other hand, he was convicted because a minor said he attempted to solicit her, and he had kiddie searches in his browser history. While the idea that having an encryption program can be seen as supporting evidence, I can understand why it would be relevant in this case. Encryption isn't a smoking gun, but it isn't as ubiquitous as a kitchen knife. I can't really argue with the ruling.

Re:A lot more than just XP...

[Anonymous Coward]

First of all, only terrorists use jabber, so you better get rid of that. That e-mail client with encryption? Gone. SSH? SSee you in Jail, perv. Zip it? Better trash it.

Not to mention every web browser since about 1996.

Re:A lot more than just XP...

[hairyfeet]

I think the answer to this one is rather easy and hinges on one question-Did they find pictures of the girl in question that used that encryption software? If they did,Then it counts,If not,Then it shouldn't.To go with the gun analogy-If someone is killed with a gun and i don't have an alibi mearly owning a gun without anything to connect it with the crime-ballistics,etc,Doesn't show or prove anything.But if they can show that my gun was fired recently,had the same type of ammo with,And matched the ballistics then yes that matters. And a good lawyer could blow that browser crap away.I got into computers because i got hosed by a hijacker that stuck links and pop-ups to kiddie porn,beastiality,scat,snuff,You name it into my Inernet Exploiter browser.There are lots of things that can stick crap in a browser besides you. They had the girl's eyewitness account plus the pics. If they didn't find encrypted pics then they tacked on the encryption part because "encryption is evil".If they did then they are perfectly correct to point the encryption out.

The charge of forgery was dropped...

[craXORjack]

...after it was discovered that the pen Mr. Levie had been carrying was actually a laser pointer. He was subsequently charged with intending to shine it in the eyes of airline pilots during landing and then sent to Cuba for a speedy but secret trial. His court appointed defense attourney later said, 'I've never met Mr. Levie but he was obviously guilty or he would not have been charged. May he rest in peace.'

Re:Good. Encryption is a tool too

[Moridineas]

One word--conspiracy.

Why shouldn't the tools he used to commit his crimes be admissible??

What you should be doing

[bigberk]

Is making sure that we all routinely use PGP/GPG in say home/office computing and email communications. Over time this will drive home the fact that privacy is a right, it is something that the computing public has come to expect. Using crypto should not in itself mean anything with respect to criminal intent. I use crypto to keep my documents and communications private. Whether or not I am doing anything illegal is a separate issue altogether.

Re:Ah! How America leads the way. %)

[Dr. GeneMachine]

Thanks, Slashdot, for wasting my time.

That's not entirely a problem caused by the captchas, now is it?

yes.... its minnesooota

[iowa119900089]

These people elected Jesse Ventura as their governor. Arkansas now has a competitor for most back assed state.

Re:Windows XP qualifies

[Anonymous Coward]

Winsows XP is a crime

From the decision itself:

[amliebsch]

Finally, Schaub testified that, in a file entitled "research," he found the text of Minn. Stat. 617.246, which included "the definition of minor sexual performance, sexual conduct, things of that nature." He also testified that he found an encryption program, PGP, on appellant's computer; PGP "can basically encrypt any file;" and, "other than the National Security Agency," he was not aware of anyone who could break such an encryption. But Schaub also admitted that the PGP program may be included on every Macintosh computer that comes out today, and appellant may have had the text of Minn. Stat. 617.246 in his computer because of prior allegations against him.

This appears to be the only discussion of the encryption issue:

ANALYSIS I. Relevance Appellant first argues that he is entitled to a new trial because the district court erred in admitting irrelevant evidence of his internet usage and the existence of an encryption program on his computer. Rulings involving the relevancy of evidence are generally left to the sound discretion of the district court. State v. Swain, 269 N.W.2d 707, 714 (Minn. 1978). And rulings on relevancy will only be reversed when that discretion has been clearly abused. Johnson v. Washington County, 518 N.W.2d 594, 601 (Minn. 1994). "The party claiming error has the burden of showing both the error and the prejudice." State v. Horning, 535 N.W.2d 296, 298 (Minn. 1995). Appellant argues that his "internet use had nothing to do with the issues in this case;" "there was no evidence that there was anything encrypted on the computer;" and that he "was prejudiced because the court specifically used this evidence in its findings of fact and in reaching its verdict." We are not persuaded by appellant's arguments. The record shows that appellant took a large number of pictures of S.M. with a digital camera, and that he would upload those pictures onto his computer soon after taking them. We find that evidence of appellant's internet use and the existence of an encryption program on his computer was at least somewhat relevant to the state's case against him. See Minn. R. Evid. 401.

The entire case is available at http://www.lawlibrary.state.mn.us/archive/ctappub/ 0505/opa040381-0503.htm

Re:From the decision itself:

[Anonymous Coward]

[sigh] Thank you for posting the link. Now, for all the morons who are freaking out and posting uninformed messages (what, on slashdot?!), here is my interpretation:

As apart of an appeal, the defense will try and nitpick what it can to try and overturn the conviction during trial. One example here, and yes I read the entire decision, was that the defense argues that the fact that an encryption program was installed on the individual's computer should be completely irrelevant to the trial, and introduces prejudice. As such, they argue the original trial judge err'd in allowing this information into the trial.
When you review the case itself (and the appeals decision should have maybe spelled out a little more clearly), it can be demonstrated that the knowledge of whether or not the encryption software was installed on the computer or not would not have ultimately affected the outcome of the discovery of the other evidence, and as such, the outcome of the trial would have been the same. Furthermore, the finding of encryption software is noteworthy, in the sense that the defendant had the tools to potentially hide further evidence.
"So what, how do you know he used it to hide kiddie porn?!" you say? Well, if I have a search warrant for an apartment you share with someone on child charges, the warrant might specify I can search your room. So, I search away. On my way out, I notice a huge locked safe in a common area, such as the living room. My search warrant will not necessarily cover this, though it certainly is worth noting that the safe does in fact exist. I do not necessarily know what is in the safe. Could it be thousands more kiddie porn pictures? I don't know, but I don't bury my head in the sand and pretend the safe does not exist.

Re:From the decision itself:

[Anonymous Coward]

You know, I would find it interesting from a comparative legal perspective to look through this ruling to see what irrelevencies are permitted in court these days. Yet if I were ever accused of anything, having that in my browser cache might be considered incriminating.

So thanks, but no thanks.

sigh.

[SeventyBang]

Apparently all of the other pervs have been pretty dumb until now...dumber than possessing child porn to begin with. to wit: Look at all of the child porn owners who have it on their HDs, plaintext. So now they've finally figured out they can try to protect themselves.

Now, if they heed the advice of another /. story (below a ways) - the Microsoft security suggestion of writing passwords down so more sophisticated passwords would be used, they could claim they wrote it down and lost the paper. I don't think they could be conviced on the basis of lost information.

On the other hand, the meth lab problem has gotten bad enough here in Central Indiana stores which sell the "right" cough medicines are being instructed to keep them under lock & key, and take the names & addresses of those who buy them. There was a story last week on the news of a guy who bought a dozen boxes and the police were called during his visit. They were waiting for him to come back to his bicycle and was promptly arrested. They then obtained a search warrant and had a lot of fun romping through his living quarters, looking for the remainder of the lab.

Re:sigh.

[Anonymous Coward]

meth isn't a small problem anymore. it's become the drug of choice among teenagers because it's cheap and the high lasts along time. more bang for your buck but the side effects are too serious. the psychosis that follows from meth use is almosts identical to paranoid schizophrenia. we don't need a generation of kids twisted out of shape and deformed into paranoid schizophrenics. crack did enough damage but at least it seemed to be centered among the urban poor (not nice but better them than my kids). meth OTOH has been picked up as a club drug across classes and cultures. meth is a bad thing and needs to be crushed no matter that programmers and a math genius like Paul Erdos know/knew how to use it in miniscule amounts to keep an edge.

Re:sigh.

[Anonymous Coward]

Oh, well that's fair enough then.

Bring on the police state!

Re:sigh.

[Anonymous Coward]

I am a pharmacy technician and a student. I work in a pharmacy under a Pharmacist (Pharm.D), and I tend to handle the stock. Someday I hope to be a pharmacist myself.

Sudafed is behind the counter because it gets stolen. It is a Schedule 4 material, which means it is sold over the counter. For cash, with no ID recording, though some stores/states may require you to be 18 to purchase it.

You only have to provide recorded name/address information for Schedule 3 and higher (lower numbers) materials. These are things you need a prescription for. You're also protected by a horde of Doctor/Patient priveledge and privacy laws. It isn't trivial for the DEA to get medical information on regular patients. Schedule 4 purchases aren't recorded even if you are a patient and purchase it with your scripts.

We do call the DEA if you do something blatently obnoxious like buying 12 boxes of Sudafed. That's 864 doses, or maximum dosage for 5 months non stop, assuming you wake up in the middle of the night to keep your dosage straight.

AC because this is totally offtopic.

Conviction was based on testimony and history...

[Anonymous Coward]

"Rather, Levie's conviction was based on the in-person testimony of the girl who said she was paid to pose nude, coupled with the history of searches for "Lolitas" in Levie's Web browser."

Does anybody actually RTFA before commenting, or the little editorial burp is good enough for the majority to form a knee-jerk reaction?

BS on CNET

[statemachine]

This is what the judge said (from the article):
"We find that evidence of appellant's Internet use and the existence of an encryption program on his computer was at least somewhat relevant to the state's case against him," Judge R.A. Randall wrote in an opinion dated May 3.

He did not say the encryption program was evidence of guilt.

To say otherwise is tabloid "journalism."

Re:BS on CNET

[deblau]

I disagree. The word "evidence" is in the sentence you quoted, and the state was trying to prove he was guilty. If it's not evidence of guilt, than what is it evidence of? How exactly are you parsing that quote?

Re:BS on CNET

[Anonymous Coward]

the existence of an encryption program on his computer was at least somewhat relevant to the state's case against him

He did not say the encryption program was evidence of guilt.

It's relevant to the case, and I can't see how it can prove his innocence, so what else could the judge have meant?

Re:BS on CNET

[Anonymous Coward]

Actually, yes. It does.

The State is trying to prove that he is guilty of something. That's what they mean by case. To say that the existance of an encryption program on his computer is relevant to the State's case against him is to say it is fair evidence for the State to use to prove his guilt.

I'm not sure how else you're interpreting this.

Re:BS on CNET

[Beryllium Sphere(tm)]

The trial judge allowed the jury to hear about the installation of PGP. The trial judge was accepting it as evidence of guilt.

The appeals judges let this stand, saying in effect that a trial judge has to screw up bigtime before they'll undo that judge's decision, and that in their opinion the trial judge did have a leg to stand on.

Re:BS on CNET

[NanoGator]

"I disagree. The word "evidence" is in the sentence you quoted, and the state was trying to prove he was guilty. If it's not evidence of guilt, than what is it evidence of? How exactly are you parsing that quote?"

He's probably thinking "It may be evidence of intent, but not necessarily guilt." Though they are related to each other, they're not exactly the same.

I don't know if I'm right about what he meant, but what I just stated is what I think, so I'll go into more detail. (note: I don't really know the details of the case so I'm ONLY speaking hypothetically here.) Suppose they found child porn on his computer. There are some questions to ask. Did he download it deliberately? Did he know they were minors? (I bring that up because it can be difficult to ascertain the age of somebody based solely on physical appearance.) Did he knowingly do something wrong?

If it was clear he was trying to hide those files (i.e. by encrypting them...) then some of those questions have obvious answers. In that event, it's not to establish his guilt, but rather to establish his motive and how he should be punished.

It may sound like I'm splitting hairs here, and maybe that's true, but if the system is working as it should then he'll be judged by properly acquired evidence, not his behavior.

Re:BS on CNET

[deblau]

Makes sense. Hard to know exactly what the judge was thinking, because the quote came out of context. Thanks for pointing that out.

Re:Good. Encryption is a tool too

[zoloto]

That's the thing. He didn't use cryptography to take photos of a nakid 9 year old. HE didn't use cryptography to lure them and solicit them. That was HIS own predatory behavior.

There was no obstruction of justice charge that we know of. And there certianly isn't a law against teh general use of cryptography, no matter the intent. Those are ALREADY COVERED UNDER EXZISTING LAW. :D Have a nice day.

NEXT!

great....

[IchBinEinPenguin]

GPG comes with _every_ LINUX distro I know of.

I guess Balmer et al are right, we're all criminals

Re:great....

[La Camiseta]

Not to mention that I almost exclusively get my Linux ISOs from BitTorrent. Does that mean that even though I use it for legal purposes I have intent to break the law and the MPAA/RIAA could sue me?

Re:great....

[CaptnMArk]

Windows has encryption built in too.

Re:great....

[IchBinEinPenguin]

yeah, but with Microsoft's track record of encryption I don't think that counts :-) [/flamebait]

AFAIK Microsoft's key management focuses more on data recoverability than data security (a reasonable trade-off depending on what you're trying to achieve).
If I use NTFS encryption on Windows and I forget my password, an admin can reset it and I can still get to my data.
If I forget my GPG passphrase then I'm toast, nothing I can do (other than brute-force) to recover the data.

And in other news...

[NewtonsLaw]

George Fritz was arrested today on charges of conspiring to commit crimes.

Police were first alerted to Fritz's activities when he dialed 911 to report a burglary in progress at his home in Elmwood drive.

On arriving at the scene, police observed that the doors to Fritz's house were locked and that the intruder had been forced to break a window to gain entry.

After aprehending and speaking with the intruder, police decided not to arrest him, relying on his promise not to re-offend.

Fritz *was* arrested however, on suspicion of being involved in a crime or crimes unknown. Prosecutors say they have a pretty strong case against him -- after all, if he had nothing to hide, why did he lock his doors and draw his curtains -- thus forcing the would-be burglar to break a window?

Film at eleven.

Brute Force!!! - RE:NSA could break PGP?

[Anonymous Coward]

fair/dirty does not apply to an open encryption algorithm. Trying "every word or phrase ever typed" is brute force which takes a hell lot of huge computational power.

Not good. Depends on the USE

[Anonymous Coward]

If he had a gun on him, but in no part of the robbery was this gun produced, or used during the robbery, why would it be considered armed robbery?

Similarly, just because I HAVE the encryption tool does not mean I'm using it to hide Child Porn

openSSL is on every macintosh and linux computer:

[goombah99]

Here is the man page from my macintosh OSX for open SSL

OPENSSL

NAME openssl - OpenSSL command line tool

DESCRIPTION OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) network protocols and related cryptography standards required by them.

The openssl program is a command line tool for using the various cryptography functions of OpenSSL's crypto library from the shell. It can be used for

Creation of RSA, DH and DSA key parameters
Creation of X.509 certificates, CSRs and CRLs
Calculation of Message Digests
--->Encryption and Decryption with Ciphers
SSL/TLS Client and Server Tests
Handling of S/MIME signed or encrypted mail

Lameness filter encountered. Post aborted!
Reason: Please use fewer 'junk' characters.

Excellent point

[jd]

But needs sharpening just a little. Encryption is a tool, yes, even when it is PGP or GnuPG. Now, I think we've all read enough murder mysteries to know that the classic three elements of any case are means, motive and opportunity. Does the tool of encryption prove any of these?

The answer to that is no. It may be used in conjunction with some other evidence to prove authorship of something - non-repudiatable files can be linked to a specific person, for example, or they wouldn't be non-repudiatable!

However, in isolation, it is exactly nothing. It is a transform algorithm, nothing more. Your eyes apply a transform algorithm when converting the electro-chemical impulses generated by photons into an image the brain can use. Virtually everyone in a scientific field has applied some transform algorithm to their data - be it a FFT, a Z transform, or whatever.

If you have digitally signed e-mails, where both the signature and the private key originate from a specific machine, and there is sufficient evidence to show that no other user - in person or electronically - had access to the files necessary to produce that encryption or that signature, then you can associate those e-mails with that person.

Does that mean PGP/GPG was "proof" of something? Well, only in the sense that it was one link in a fairly lengthy chain. An important link, but still only one link. No chain, no "proof", no matter what software was present.

Of course, none of this is relevent if, as I suspect, the person merely encrypted the files with PGP and didn't think of any of the authenticity or security issues involved in encryption, or deliberately side-stepped them.

It is also irrelevent if there is no proof that encrypted files were ever sent. If there is no chain, then the "link" is irrelevent, no matter how solid it is. It is just a link, nothing more.

The trouble with the legal system is that, although it often correctly identifies that something IS relevent in some way, it is often very bad at identifying HOW it is relevent, and what it is actually relevent to. This is because it is impossible to have judges and jurors trained in every possible field well enough to be able to make such an analysis.

"Friends of the Court" and "Expert Witnesses" are often used to bridge that gap - in theory. In practice, I seriously doubt that an adequate understanding can be conveyed in a few hours when it can require even the most adept students years or decades to gain any kind of mastery.

In the end, it is forgivable for a court to get confused as to what is a link and what is a chain, and how you get from one to the other, but forgivable does not mean acceptable. It is not acceptable that courts are depending on faulty or even deliberately skewed information, especially in a case like this where the person is in genuine danger of being killed in prison, will be marked for life - even if they are eventually found innocent, and all over something that is being presented as something it isn't.

If someone is guilty - fine. Find them guilty. But at least do yourself, the person involved, and the justice system at large a favour by finding them guilty for the RIGHT reasons. The appeals court, especially, will love you for it.

Metamod alert

[Anonymous Coward]

The parent posting was made less than 5 minutes after the story was posted and repeated nothing. How is that "Redundant"? Hopefully the metamod crew will mark the redundant as unfair.

Well, analogies can get you into trouble

[hey!]

Just like the presence of a gun during a robbery lifts the crime to armed robbery, the presence of encryption ought to imply not only that the culprit intended to commit the crime but also intended to cover it up as well.

Well, if I use a gun in a robbery, that makes it armed robbery. But if I own a gun that is not used in the robber (say it's locked in a safe at home) does any robbery I undertake automatically become armed robbery? I mean, don't you think there should be evidence that I actually used the gun in the robbery?

That said, this isn't what the court decision is about. It isn't saying he is guilty because he has encryption software. It's saying the jury can consider that as evidence.

Mathematically, it is true that the significance of a fact depends on context. Thus something which in isolation doesn't mean much can become significant when joined to other facts. However, some things are so commonplace that you can't fit them into anyt kind of logical structure that will help you make a conclusion.

You might as well say that bank robbers wear shoes and the accused owns several pair.

Fortunately with the other evidence against him, I doubt this spurious instruction had any effect.

Re:Well, analogies can get you into trouble

[biobogonics]

Well, if I use a gun in a robbery, that makes it armed robbery. But if I own a gun that is not used in the robber (say it's locked in a safe at home) does any robbery I undertake automatically become armed robbery? I mean, don't you think there should be evidence that I actually used the gun in the robbery?

Actually something like this took place in a high profile local case here where my GF's sister sat on the jury. A criminal was convicted of burglary and home invasion. There was a gun in a bag at the scene (belonging to the home owner) that was not used in the commission of the crime, but the criminal knew it was there. Since he had a long prior record, the gun offense added considerably to his sentence.

Hello, Internet expert

[Anonymous Coward]

Need some help in another thread.

If a robbery occurs and the robber is carrying a gun but at no time reveals that he has it, is it armed robbery or plain old robbery?

I've got a message for those morons.

[sedyn]

I'm thinking about sending the judge and jury an encrypted message. Maybe for bran muffins, to help relieve all the shit that those idiots are releasing.

Way to go "Team America World Police"

[Bluesuperman]

Well ... he had a computer ... he must be using peer to peer software to transfer stolen 1. Movies 2. Music 3. Software 4. WMD's 5. Other

Re:Ah! How America leads the way. %)

[Anonymous Coward]

Interesting to see how the goderators moderate a complaint about the idiotic captchas.

All I know is this hatred of the disabled needs to end. I just wish I was around more often around people that could see so I could post more to Slashdot. It's bad enough being blind and using the web without having yet another site push their hatred of the disabled agenda.

huh?

[Cryptnotic]

I really wish slashdot would stop encouraging amateur lawyering. The law is a vast, complicated subject, with many non-obvious doctrines.

You might as well say, "I wish slashdot would stop encouraging amateur computer systems engineering. Computers are vast, complicated machines with many non-obvious functions."

Slashdot readers are hackers. Of course they're going to want to discuss how things work.

Re:huh?

[amliebsch]

You might as well say, "I wish slashdot would stop encouraging amateur computer systems engineering. Computers are vast, complicated machines with many non-obvious functions."

An interesting analogy, considering that many people on Slashdot do in fact make such disparaging remarks about anybody who may, for example, dare to program in Visual Basic.

But this is really more akin to a forum for lawyers flaming computer programmers for - I don't know, let's say, actively contributing to copyright infringement by writing p2p programs. Headline: "HACKER CREATES YET ANOTHER PIRATING TOOL." Followed by hundreds of lawyers blaming programmers for the high cost of CD's. Opinions based on ignorance.

Re:huh?

[Cryptnotic]

Well, with regard to your p2p program analogy, that is definately part of the story. Something like Bittorrent is a very good tool for copyright infringement. Similarly, PGP is a very good tool for hiding child porn from law enforcement. Of course, both of those examples are only part of the story. Just like a screwdriver could make a fairly decent stabbing weapon, or a rifle acould make a decent tool for putting holes in plywood from 100 yards away. The problem I see is that in discouraging discussion (ala amateur lawyering), the grandparent poster is discouraging understanding. And that doesn't do anyone any good.

Re:huh?

[amliebsch]

The problem I see is that in discouraging discussion (ala amateur lawyering), the grandparent poster is discouraging understanding.

Here's the trouble: I am not convinced that the majority of the posters, who cannot even be bothered to RTFA, let alone look up laws, actually care more about understanding the nuances of trial law as opposed to demagoguing the issue based on erroneous facts, and spreading those erroneous facts in the process. (And, in the process, berating and demeaning another class of professionals.) They certainly have that right, of course; I simply maintain that, especially when it comes to the law, it is neither healthy nor wise.

Re:huh?

[Cryptnotic]

What? People talking out of their asses on the internet? People just making up stuff and trying to sound authoritative? Pfft! That would never happen on a prestigious website like Slashdot.

Seriously though, I agree with you that it is neither healthy nor wise to base one's legal decisions based on anything written on Slashdot. For example, if you were thinking of starting a business selling high-speed bittorrent access, I wouldn't suggest going ahead with it just because "some guy on slashdot" said that it was probably legal.

Owning a Blanket isn't Illegal

[Ieshan]

So, to take your example, supposing we too Joe Criminal and Joe Average. Both own a blanket. Joe Criminal uses his to cover up his gun when he throws it in the river. Joe Average uses his to cover up the unpatched area of his wall behind his sofa.

Both people are using the same widely distributed tool "a blanket", for the same use, "to cover things up". But Joe Average isn't committing a *crime*.

Owning a blanket or using it for it's purpose isn't criminal. It can be an accessory, but the mere presence of encryption should *not* be indicative of criminal activity. It shouldn't imply anything, other than "Hey, this person had things he didn't want people to see." Those things aren't neccessarily criminal things. Treating them that way is an absolutely false conclusion.

Re:Owning a Blanket isn't Illegal

[amliebsch]

Assuming your hypothetical:

Agreeing that the blanket is not in and of itself criminal - do you believe that in attempting to prove the crime (a portion of which involves concealing the weapon with a blanket), the prosecution should be barred from introducing any evidence that the defendant owned or used a blanket?

Re:Owning a Blanket isn't Illegal

[Ieshan]

No, of course not. But the parent strongly implied that owning encryption software should somehow lead us to believe that the defendant is more guilty.

This simply isn't reasonable.

Relax and think.

[neo]

The key here is the term "could be admitted as evidence of criminal intent." It's not being used as evidence that he did anything wrong. His crime is still that he took pictures of children in sexual ways.

What this ruling is saying is that he knew what he was doing was wrong (criminally) because he gathered the means to hiding it. This is just being used to show intent.

Re:Good. Encryption is a tool too

[Moridineas]

Incorrect! He DID use the encryption software as part of his crimes.

Ignorance of the subject at hand

[Anonymous Coward]

Most of the comments here seem to be tilting at windmills, as nobody is saying that the very existence of PGP software led to his conviction; the girl testified! Yes, there would be great cause for concern if somebody was convicted for having encryption software on their computer. Thankfully, that is not the case.

It's my impression that the PGP software was there to establish some level of awareness of what he was doing. Perhaps the best comparison would be if the pedophile had a collection of thick envelopes that couldn't be seen through; on its own, it means nothing, and could not be brought as a primary piece of evidence. With additional relevant information, though, it becomes more significant. The same is true here.

Case Closed

[Doc Ruby]

Other evidence, their locked front door clearly shows that this criminal must have something to hide. Or, clearly shows they need to hire a real lawyer.

Re:Good. Encryption is a tool too

[beej]

Just like the presence of a gun during a robbery lifts the crime to armed robbery, the presence of encryption ought to imply not only that the culprit intended to commit the crime but also intended to cover it up as well.

I see what you're saying...but there are several flaws in this reasoning, both theoretical and practical.

1. There was no evidence PGP was being used to encrypt anything, or that he was even planning to do that.

2. The inclusion of PGP in the evidence is intended purely to sway the judge and jurors and presents no real information about the case. This is Cheating. It's like when a newspaper needs a story to be more sensationalistic, they say things like, "Aside from two pounds of marijuana, two guns were recovered from the residence." And then they don't tell you it was just a 22 rifle and a pellet gun.

3. Everyone has strong crypto on their machine. So by your reasoning, every time a crime involves a computer (which is going to be practically every planned crime these days), it should automatically carry some sort of conspiracy charge. This is pointless, just like saying the presense of envelopes in one's house obviously shows that the owner planned to hide his actions when mailing his co-conspirators.

4. Telling people that crypto is bad is also Extremely Bad, as attested to by so many other posts today. Crypto is good. Just like we allow a child pornographer to mail his wares undetected in an envelope, we allow him to email them encrypted. The alternative is simply worse, and we choose the lesser of the two evils. Smart people know this; jurors are more easily swayed, as I mentioned in point #2.

(And for the record, when it comes to child pornographers, there can be no punishment too severe.)

Warning: Offer only valid in Victoria, Australia

[Dancin_Santa]

According to this page, the only condition that separates "robbery" from "armed robbery" is Armed robbery means the offender is carrying a real or imitation firearm or explosive or offensive weapon

The law may be different where you live.

See.. the stupid thing about that is..

[Mr. KFM]

Always make your own encryption program. And encrypt it.

He was convicted on some very thin evidence

[Anonymous Coward]

He was convicted based on: a) the claims of a nine-year-old girl b) browser search history and c) a standard encryption program was found on his computer. Each one of these by itself is tenuous and all together, they are tenuous. Don't we have a standard of justice called "beyond a reasonable doubt"? People lie. Nine-year-old girls lie. Children especially like to please their parents (and adults in general) and if they think that saying a certain thing will please their parents they are likely to do it. Pleasing parents is usually a higher priority for children than telling the truth. I'm not saying this guy didn't do it but from the brief description in the article, their case seems to come up far short of "beyond a reasonable doubt".

Parent not "Insightful" but rather erroneous.

[Anonymous Coward]

At least from a mathematical perspective.

one of two things

[Anonymous Squonk]

Either encryption itself is now a crime, or the assumption of innocence until proven guilty has been reversed.

Re:openSSL is on every macintosh and linux compute

[jadavis]

But if he actively installed crypto software, or software to help in the crypto process, and then used that software to selectively encrypt files related to a crime, that looks an awful lot like he's covering his tracks. And if he's hiding files related to that unspeakable crime, he can't claim ignorance of his crime.

Good God

[kernelpanicked]

If PGP can convict you, I sure hope they don't find my hard drive full of blowfish encrypted file systems. I'd be screwed.

'Relevancy' casts a very wide net.

[crankyspice]

I can't speak to Minnesota law, but most states look more or less like the Federal Rules of Evidence. FRE 401 reads:

Rule 401. Definition of "Relevant Evidence"
"Relevant evidence" means evidence having any tendency to make the existence of any fact that is of consequence to the determination of the action more probable or less probable than it would be without the evidence. (Emphasis added.)

The article suggests that the opinion isn't condemning encryption per se or even unnaturally linking lawful tools with illicit activity, only that "evidence of appellant's Internet use and the existence of an encryption program on his computer was at least somewhat relevant to the state's case against him."

"Any" is a pretty low threshold to meet; evidence that the guy had an FTP client could/would (presumably) be relevant to a child pornography distribution charge...

This isn't the end of the world as we know it. It's up to the opposing counsel to explain away the existence of the PGP, and/or to illustrate to the jury how having a tool doesn't mean the tool has been used for evil.

Re:Good. Encryption is a tool too

[RedBear]

And with other evidence, why shouldn't it be? In fact, the presence of it ought to lead prosecutors to tack on the charge of conspiracy.

Just like the presence of a gun during a robbery lifts the crime to armed robbery, the presence of encryption ought to imply not only that the culprit intended to commit the crime but also intended to cover it up as well.

Problem. With. Your. Analogy. Is. Encryption. Is. NOT. A. Gun.

The presences of encryption implies nothing. You have commmitted a logical fallacy. Windows 2000 and XP have encrypted filesystem support, does that imply that all Windows users are intending to commit a crime and hide it because they bought a computer running Windows? No. You use SSL encryption every time you buy something online. Does that mean you were intending to commit a crime with the intent of hiding it when you installed a web browser that supports secure HTTP? I don't think so.

You were right in your subject line. After that you failed. Encryption is just a tool. It is not a firearm. That is a very flawed analogy. With that kind of analogy we can all become criminals overnight. Yippee.

Hand me the lubricant...

[Anonymous Coward]

Schaub testified that PGP "can basically encrypt any file" and "other than the National Security Agency," nobody could break it.

The fact that the NSA breaks crypto is widely known. On the other hand, I happen to know that the yes-or-no answer to whether the NSA can break a specific cryptosystem is always classified Top Secret. They do stuff like that all the time. General info is For Official Use Only, operational details are TS and usually compartmentalized. Schaub is guilty of divulging classified information. The info could be correct, or it could be wrong, but in either case, Schaub is in a lot of trouble. And if he backtracks, and claims he doesn't know what he's talking about, he's guilty of perjury. Whoopsie.

Second, I'd like to point out that saying you can't have crypto on your computer is like saying you can't have a lock on your house: stunningly idiotic. With the kind of viruses going around today, you're more likely to have your credit card info stolen from your hard drive rather than off your dresser. But we can't use locks to protect that info? I guess everyone running Windows 2000 is going to jail.

To sum up: the defendant is a fucking pedo, the judges are fucked in the head, and Schaub is just plain fucked.

P.S. In closing, I'd like to say hi to all my friends in the Intelligence Community. You know who you are. I miss you all dearly. Keep up the good work.

Re:Hand me the lubricant...

[Anonymous Coward]

P.S. In closing, I'd like to say hi to all my friends in the Intelligence Community.

don't despair. some day, they'll invite you.

Re:Hand me the lubricant...

[tricorn]

He didn't say NSA could break it, he claimed that no one "other than the NSA" could break it. Whether the NSA could break it or not was left unspecified. If I say that NSA can break DES, how am I guilty of divulging classified information? I deduce the information on the basis that NSA isn't incompetent and that DES has been broken by others for quite some time now.

Re:openSSL is on every macintosh and linux compute

[mrchaotica]

If the files are hidden and/or encrypted, how do you know they're related to the crime? By the mere fact that he's installed crypto software, how do you know that he used that software in relation to the crime?

Maybe he installed PGP to hide criminal activity, or maybe he's using it to hide the details of the surprise party he's planning for a loved one. Or maybe he just invented a device to end world hunger, and he's protecting it until he has a chance to apply for a patent. Or heck, maybe he's a foreign spy, and is using encryption to transmit national secrets to his foreign boss. Who knows?

The point is, there's absolutely no way to know why he installed the encryption, even if he commmitted some crime. And because we've (theoretically) got a principle here in the US of "innocent until proven guilty," anything that has even a slight legitimate use can't be used as evidence of guilt.

Re:Good. Encryption is a tool too

[hazem]

Yup, and he used his microwave to cook the burrito that provided the engergy he needed to take the child-porn photos.

Clearly, his use of a high-energy radiation device was a part of his crime and he should be convicted as a terrorist.

so, are we counting in ie and firefox?

[awing0]

Internet Explorer and Mozilla/Firefox support HTTPS transactions. Outlook and Thunderbird support POP3S and IMAPS. These are programs you find on anyone's PC and use common protocols over an encrypted layer known as the Secure Sockets Layer (SSL). So, this means anyone with a PC can have "criminal intent'? In fact, my /etc/shadow file contains encrypted hashes, I better start worrying.

Re:Good. Encryption is a tool too

[Dancin_Santa]

Neither is encryption a paper shredder or a bonfire, but evidence of destroying evidence and the presence of the means to destroy that evidence can be admitted as evidence.

The guy wasn't under investigation because he was using encryption. I don't know where you came up with the idea that encryption == intent to commit a crime. I didn't say that.

However, evidence that he used encryption to commit a crime does show an attempt to "destroy" evidence and is wholly relevant to the case at hand.

The analogy with the gun is that criminal charges can be augmented by the evidence of certain tools found in the investigation.

Does this mean...

[PenguiN42]

What about an installed web server that supports SSL? Would that be enough to demonstrate "criminal intent"?

"You wouldn't use encryption if you didn't have something to hide!!"
"Yeah, it's called my credit card number"

Re:Does this mean...

[Artifakt]

So if you answered that way in court, don't you think a jury is going to be smart enough to believe you? Do you really, honestly think the average person on a jury is that stupid, or worse, that all 12 of them are?
What part of "It comes standard with Windows XP. I didn't have to do anything special to put it there." would give the average jury trouble? Just because this case involves those mysterious "compooter thingees" doesn't mean the issues are too complex for a jury to decide fairly.
This case had at least one victim's testimony, and evidence of what sites the defendant visited on the web, to prove actual guilt. The jury decided this evidence proved guilt beyond a reasonable doubt. Maybe there was some evidence the article didn't mention. Maybe not. In that case, the jury must have either found that witness very trustworthy for her age, or the browser evidence included a lot of details about search terms, URLs and such, or something along those lines happened.
In this process, the jury was also told at least one reason why some other evidence wasn't provided. The state's side of the story was that there were no copies of the pictures actually on the local hard drive because there was software capable of encrypting the files, or for that matter, wiping the surface.
The defense had a right to present counter arguements, i.e. the pictures weren't there because they never existed, the software was used for perfectly legitimate reasons, or the software was installed during set up and never used.
The jury gets to decide which explanation seems to better fit the facts. Take away the state's right to offer speculation about why some evidence is not also present, and any criminal conviction becomes impossible, because there is never an infinite amount of evidence.

The state has three eye witnesses. Defense asks the investigating officer, "Doesn't it seem odd, that at that time of the evening, there weren't more eye witnesses present?" Prosecution replies (probably by raising the possibilty during cross examination) "Perhaps there were more who didn't come forward?" Ooops, that's mere speculation.
The state found a gun previously registerd to the plaintiff, in a quarry. Defense: "It was stolen, my client merely failed to report the theft.". Prosecution: "The accused dropped the gun there. Now he's making up a story." Ooops, that's mere speculation.
The use of encryption software was a speculative explanation to account for one known fact, and was offered to the jury as such. The defense was free to offer alternative explanations. If they didn't, either there was an inadequate legal defense, or just possibly those alternatives would have somehow gotten the plantiff into more trouble than he already was in.
The plantiff wasn't appealing on the grounds of inadequate legal defense. Appeal argued that this whole matter was irrelevant to the case. Court ruled that it fit a relevance test. Suprise! The prosecution's being able to explain to the jury why they have enough evidence to seek a conviction but not all theoretically possible evidence is relevant!

don't see this as much of a problem

[jotux]

Yeah, it seems like they are assuming that if you have something to hide then your guilty....but there are situations where the presence of an encryption program does imply some guilt. For instance....if the guy installed pgp at a time that corresponds to the time he was involved in the child pornography, and didn't show any previous paranoia(or whatnot) related to any other content on his computer...that says something about his intent to hide his actions. Also, if you find that 1000 images were encrypted and his financial documents were left unencrypted....that says some more. I'm not saying that encryption=guilt, just that there are some situations where is does say something about people in certain situations.

Here's the decision itself

[nycbicyclist]

Here's a copy of the case:

http://www.minnlawyer.com/opinions/050509/a04381.h tm

The PGP issue gets little discussion (probably because it was so obvious, to anyone with legal training, what was the right decision). This is the fullest discussion:

"Finally, Schaub testified that, in a file entitled "research," he found the text of Minn. Stat. 617.246, which included "the definition of minor sexual performance, sexual conduct, things of that nature." He also testified that he found an encryption program, PGP, on appellant's computer; PGP "can basically encrypt any file;" and, "other than the National Security Agency," he was not aware of anyone who could break such an encryption. But Schaub also admitted that the PGP program may be included on every Macintosh computer that comes out today, and appellant may have had the text of Minn. Stat. 617.246 in his computer because of prior allegations against him."

In other words, the jury was told both that he had PGP encryption on his system, but that lots of other people do too. PGP was just a small piece of the mass of evidence against this guy and I see no reason to suppose that the jury (or the judge, if this was a bench trial) was unduly swayed by that fact.

As many others have pointed out, this decision in no way makes possession of pgp software into slam-dunk evidence of criminality. There are lots of legitimate reasons to rent a boat, for instance, but if I rent a boat just before an enemy's body is found at the bottom of a lake, then that otherwise innocent act might be good evidence.

[fixed post] Does this mean...

[PenguiN42]

What about an installed web browser that supports SSL? Would that be enough to demonstrate "criminal intent"?

"You wouldn't use encryption if you didn't have something to hide!!"
"Yeah, it's called my credit card number"

Re:Good. Encryption is a tool too

[Anonymous Coward]

Are YOU serious?

While correlation is not causality, encryption is used for, amongst other things, hiding illicit activities.

Other things bother me about this case. It seems based entirely on the testimony of a minor who claims she was PAID to pose nude. And as anyone who has children knows, children are entirely capable of lying their asses off under appropriate circumstances.

However, add together: a search history for similar material, plus the necessary tools to make it happen. Method + motive + opportunity.

In this case, this is a legitimate piece of evidence. PIECE mind you, but legitimate.

What does the future hold?

[Domini]

Can one get arrested for speaking in anagrams?

Or perhaps committing puns? (debateable, this one is)

It's a good thing I read this.

[St. Arbirix]

...coupled with the history of searches for "Lolitas" in Levie's Web browser.

Note to self: No pursuing of Nabokov books until *after* my psychotic ex-girlfriend has stopped looking for ways to get me in trouble.

It sounds a little over the top, but she just recently tried to stab me with a screwdriver.

Preaching to the choir

[Anonymous Coward]

> ENCRYPTION != EVIL

My father-in-law thinks encryption is evil. But, then again, he probably thinks your statement above is improperly punctuated nonsense.

Did anybody read the article?

[JoeBuck]

They didn't convict this sleazebag because he had PGP. They convicted him because the nine-year-old girl that he photographed nude testified against him!

Now, said sleazebag is trying to get a new trial because the prosecutor was allowed to bring up his use of PGP. I certainly agree that mere presence of PGP does not prove criminal intent; after all, I have a similar program (GPG) on this machine. But even if that evidence should not have been allowed, it is at most a trivial error that did not appear to affect the case.

RTFA! Is that so hard?

[Chris Tucker]

Look the judge instructed the jury that mere possession of encryption software could be used ti infer criminal intent on the part of THIS ONE PERSON!

Damn! It's like the RIAA making a patently absurd claim that just because one COULD use an iPod for storing illegally copied MP3s, therefore ALL iPod owners are using them to store illegally downloaded MP3s...

Oh, wait...

Re:Good. Encryption is a tool too

[maxpublic]

However, evidence that he used encryption to commit a crime does show an attempt to "destroy" evidence and is wholly relevant to the case at hand.

Except that according to the article there's absolutely no evidence of any such thing. So why was the fact that he had encryption software on his computer introduced at all? As a biased attempt to sway the jury, of course.

Although I don't see why they even bothered. The guy was fucked from day one due to the other evidence collected against him.

Max

As an open source developer

[Anonymous Coward]

As an open source developer, I have no criminal intent. However, I do have encryption on my computer. In particular, I have PGP (OK, GPG) on my computer to cryptographically sign my releases to protect them from people who break in to servers and replace programs with trojans.

I also use algoritms based on strong cryptographic protocols in order to generate secure random numbers. I need these numbers to be unguessable to prevent spoofing attacks. I have gone to great pains to minimize the chance of this looking like I'm using crypto software by replacing the AES code with an AES variant for which running the cipher in the "decrypt" direction is not readily available. That said, there are a number of modes (CTR, OFB, or a combination thereof) where this variant can be used for file security purposes. If my program is going to have strong psudo-random numbers, I need military strength crypto (indeed, AES has been approved to protect Top Secret information) to make those numbers.

I also have the OpenSSL libraries on my computer, and the OpenSSH suite, both of which have strong crypto. I use OpenSSL mainly to cryptographically hash my program with various hashes (with MD5 semi-broken and SHA-1 almost semi-broken, I hash my program with various exotic hashes like Tiger and Whirlpool); I use OpenSSH to log in to machines without having to worry about packet sniffers.

There is also the fact the any decent cryptographic portocol also makes a good source of random number gererators for things like random map generators; using a block cipher instead of a conventional RNG allows one to minimize butterfly effects when randomly making maps, for example.

I have Firefox on my hard disk. Heck, I also have MSIE on my pirated Windows partition for cross-browser testing of my web site. Both of these programs have SSL libraries featuring strong cryptographic functions, so that my credit card number can not be seen by eavesdroppers.

The point is: There is a lot of uses for Crypto besides hiding information from Big Brother.

Does the presence of any of these programs on my hard disk make me a criminal? I don't think so. In fact, not a single file on my hard disk is encrypted. Now, it is one issue if I have an encrypted file and refuse to decrypt the file after being given a court subphoena. It is another issue altogether to have a program utilizing cryptographic primitives.

Brain use == evil

[Vitus Wagner]

Use your brain.

Oh, no! Using a brain is a crime by itself in modern advertisment-based society.

Read Fahrenheit 451 or many other stories by American SF writers. They warn you 50 years ago that this would end with that - having encyption software is a crime, having gun is a crime, thinking independently is a crime too.

Relax

[jjohnson]

This is no different than the fact that a guy charged with burglary had a crowbar on him. When you're suspected of a crime, the presence of the tools to commit that crime or cover it up are relevent (though not dispositive) in a criminal trial. For a guy charged with making child porn, having a digital camera is relevent; doesn't mean that your digital camera alone is going to get you thrown in jail.

This is a hail mary by the defense attorney that does nothing but put software on the same footing as other tools.

Re:Relax

[tricorn]

Yeah, but this is more akin to saying that the burglar had a tire iron in the trunk of his car... or possibly, that having a full tank of gas meant he was planning to flee the state, thus showing his guilt (innocent people don't plan to flee the state).

Re:Relax

[jjohnson]

Yeah, but this is more akin to saying that the burglar had a tire iron in the trunk of his car...

You think this is extreme, but in point of fact, many jurisdictions have laws against the mere possession of house-breaking tools. IANAL, but while a crowbar won't get you thrown in jail, if a cop pulls you over cruising residential areas at midnight, looks in the trunk and finds a crowbar, rope, gunnysack, and black balaclava, you could in fact be charged and possibly convicted of intent to burglarize, almost entirely on the strength of suspicious circumstances.

Look at it another way: A guy is charged with the crime of creating and distributing child porn over secure channels on the Internet (say, a newsgroup where encrypted binaries are uploaded). If he didn't have PGP on his computer, that would be circumstantial evidence against guilt, wouldn't it? Why doesn't the reverse hold, if he does in fact have the necessary software to commit the crime?

Re:Relax

[tricorn]

The problem with what you say is that there was apparently no evidence of any encryption of the files in question, or any other relevant files. My tire iron analogy is that just about everyone has a tire iron in their trunk - using the presence of that tire iron to say anything other than that I'd like to be able to change the tire on my car if it goes flat is dumb. Having a ski mask in your car in the middle of winter should also be non-relevant (ooh, ooh, he was wearing ski gloves, he must have wanted to not leave fingerprints!).

It sounds to me as if the standard for relevance are so loose that the following could be admitted: "The defendant had a copy of gcc on his computer. gcc is used to "compile" source code of computer programs so that a computer can understand it. There is a lot of "open source" source code on the Internet, including programs for encrypting and hiding information. Since we didn't find any actual source code on his computer, he must have deleted it. That could indicate that the source code he deleted was a program used to encrypt or hide information. We didn't find any hidden information, so we believe it must be hiding. If we did find it, it might be encrypted (the fact the he hid it would indicate that he'd probably encrypt it as well). Thus, the presence of gcc on a machine without any source code is indicative of guilt."

Now, in this actual case, based on the actual statements, it does sound like it came out that PGP is perfectly legal, has many legitimate uses, and that there were no encrypted files, so the prejudicial nature of the statements was probably minimal. It still sounds irrelevant to me, given the facts that I've read about so far.

Re:Relax

[jjohnson]

All I'm really pointing out is that every crime has predicate circumstances, and PGP can be part of that just like any other normally neutral item. If you stabbed someone to death, there's a knife somewhere you used. The presence of GCC on your computer might be relevent if the prosecution has charged you with writing a virus (that's not in VB). Don't let the fact that PGP was admitted as a relevent fact freak you out. A tire iron and a balaclava aren't guilty items, but they are if they're found with a flashlight, rope, sledgehammer and gunnysack, in a car cruising a high burglary zone. Pulled over for a traffic stop on the highway, those same items aren't relevent, though.

that's what happens

[alizard]

when the computer-illiterate are permitted to make decisions involving technology.

How many Linux distros have gpg installed by default? Should we automatically be suspected as criminals?

How many PCs don't some form of encryption? Crypto includes browsers that support SSL... necessary for e-commerce. I'm sure that at least some of the judges have PCs and browsers. Should search warrants be obtained on this basis and their computers be checked for kiddie porn?

With respect to crypto, I personally use it to keep proprietary technology and business discussions private and to digitally sign documents. I also plan to continue to do so even if it makes Minnesota judges think I must be a criminal of some sort.

The court decision is... contemptible, but to be expected, it's from the same kind of ignorant people who voted the DMCA into law.

The most charitable thing I can say is that a great many people's brains shut down immediately if the subject of child pornography comes up, and speculating as to why would. . . be very impolite.

Re:that's what happens

[Anonymous Coward]

"The court decision is... contemptible, but to be expected, it's from the same kind of ignorant people who voted the DMCA into law."

And here I thought that in the US, the legislative branch voted strange laws into effect, and the judicial branch just determined whether alleged criminals were in violation of those laws.

Or are you saying that judges and senators/congressmen are of the same sort? That's just going over the line. As much as I hate certain judges, I'd never imply that all were as culpably ingnorant or as terribly malicious as your legislature. At least judges have to get a college education before holding their position.

Re:Good. Encryption is a tool too

[RedBear]

The problem is, they don't have that "evidence" in the middle that you refer to. It's just a bonfire, or a paper shredder, or an envelope, or a lighter. But there is no corpse. No destroyed or hidden evidence. They said so. They have no evidence of encrypted images. There is just a common tool, like a paper shredder, which many people now use at home to destroy perfectly legal financial documents for their own safety, so criminals won't pull their financial information out of the trash. Unless there is a link, the tool has nothing to do with the case at hand, and should not be seen as supporting evidence of anything.

Both Mac OS X and Windows 2K/XP support encrypted filesystems these days. Does that mean whenever you catch someone doing something wrong with a computer you can use that built-in support for encryption as "supporting evidence" of criminal intent at their trial? You better sure as hell hope not.

Breaking news.. another uninformed decision

[paylett]

In other news, it was later ruled that "possession of envelopes" could be admitted as evidence of criminal intent to conceal communications.

A box of envelopes was also found

[noidentity]

The case was also bolstered by a box of envelopes, found on the premisis, which are used to conceil information and leave evidence in case of interception.

Encryption use != Criminal Intent

[Bones3D_mac]

Isn't this the same kind of reasoning that has led to things like witch hunts and the spanish inquisition? This is a dangerous way of thinking that criminalizes anyone with a desire to preserve their privacy... something our current government would love to turn into law at the drop of a hat.

Oh, this is just *swell*...

[cp.tar]

I have a penis*.

Therefore, in a rape case, this can be construed as criminal intent.
This is good news for all Slashdot users; now you are gong to have sex at least in the eyes of the law...

Furthermore, I normally keep my penis hidden in my pants, which obviously means I know that's wrong and am trying to hide it.
As a consequence, criminal intent could not be established for flashing pervs; they do not seem to be hiding anything, at least... so that's OK.

And to think I actually complain about Croatian judicial system, which is merely inefficient...

*This is not a latest discovery, nor bragging; I really do need that** to prove my point.
** Please stop that.

Re:Oh, this is just *swell*...

[osgeek]

I have a penis

Objection: Hearsay.

Re:Oh, this is just *swell*...

[Anonymous Coward]

I have a penis . . . in a rape case, this can be construed as criminal intent.

If you think you're joking, you haven't spent much time on a college campus recently.

Re:Oh, this is just *swell*...

[biobogonics]

I have a penis*. Therefore, in a rape case, this can be construed as criminal intent.

Yes, you've been attending the lectures of Professor MacKinnon at the University of Michigan Law school again.

Re:Conviction was based on testimony and history..

[RedBear]

Whether or not the defendant was guilty or was convicted is not the point. This discussion is about the fact that the mere presence of some common encryption software without the presence of any encrypted files was used as "supporting evidence" of some sort of criminal intent. Which is really, really bad. It doesn't even really matter what the case was about. What they did by admitting the presence of PGP software as supporting evidence of intent is tantamount to criminalizing encryption software itself.

You may safely assume...

[Kjella]

...that the police officer has no clue about what the NSA can or can not do. They are not about to announce their capabilities, particularly if there's something they can't do. For this topic, you may also safely assume that NSA has dedicated crypto cracking chips, orders of magnitude better than general purpose supercomputers. You can also safely assume noone from the NSA will post real information about themselves on slashdot.

That being said, current strong encryption algorithms are many orders of magnitude stronger than that again. Many of those have been developed outside the US, and so the NSA has had no possibility to leave a "known flaw" they could use to their advantage.

Breaking 256bit+ encryption by conventional deterministic means through trial and error (read: chips or CPUs as we know them) simply can't be done because the laws of physics don't allow it. Earth doesn't have enough atoms to store 2^256 keys, and the Sun wouldn't have the energy, that kind of limitations.

That leaves roughly two possibilities:
1. The NSA has discoved some math which allows them to decrypt material in less than brute-force time. While it can not be dismissed for any one algorithm, there are many strong algorithms available based on different mathematical problems and it is not credible to believe they are all broken. Which (if any) are broken is why they don't tell.

2. The NSA has working quantum computers which briefly said, can test all quantum states at once. Simulations have shown that such a computer would effectively break some asymmetric cryptography (public/private key pairs), but not all. And it would do little to improve decryption of symmetric encrypted material (passwords).

And in either case, it is highly unlikely that they would reveal information that would essentially prove their capabilities in order to provide evidence. They would be guarded as high-level military secrets, used implicitly to "magically" plot out terror networks and such, gathering the explicit evidence through more conventional means...

Kjella

Re:You may safely assume...

[skarphace]

> Many of those have been developed outside the US,
> and so the NSA has had no possibility to leave a
> "known flaw" they could use to their advantage.

Actually, just because it's developed outside the US, doesn't mean the NSA can't get their grubby little hands on it. See here

Fullest text...

[Infinityis]

Here's about as full text as it gets:

http://www.minnlawyer.com/opinions/050509/a04381.h tm

pushing up services

[Anonymous Coward]

been saying this over and over and over

mail clients need to have encryption built in

mail servers should have spam filtering built in

the way it is now, encryption stands alone, and filtering is done at the client level. each one should be pushed up a level.

Everybody said: I have nothing to hide

[silence535]

This clearly could only happen because everybody said: I have nothing to hide, so why use encryption?

Every time I hear that argument I almost explode in a rage and claim that at times the usage of encryption alone will be held evidence that you're a criminal.

These times start NOW.

And by the way, this is YOUR fault you lazy bum.

-jsl

Thats just crazy talk

[el_womble]

The great thing about computers is that they make finding and manipulating digital data a snap. The bad thing about computers is that they make find and manipulating digital data a snap. It's a double edged sword that is, at least partially, dulled by encryption and other security measures.

You use a computer to generate sensitive data because its easier and more powerful than traditional methods, but that doesn't mean that you automatically want to forego the security that is implicit in a paper and pen solution.

Does this mean that keeping your photo album in a 'locked' house is evidence of criminal intent?

variations

[l3v1]

- we found you password-protected your bios and your boot is password protected, you obivously have something to hide
- we found your leeloo, oh, sorry lilo is password protected too, so you obviously have something to hide
- we found your OS keeps asking for a password, you obviously have something to hide
- we found your e-mail program asks for a password to access your account passwords, your have something to hide, on the double
- we found you digitally sign and gpg-encrypt your e-mails, you obviously have something to hide
- we found you use several archiver applications which have the option to password-protect your archives, you obviously have something to hide
- we found your IM accounts all need passwords, you obviously have something to hide
- we found your home, car, safe all have locks and we don't have the keys, what are you hiding ?

... I got tired ...

Re:variations

[Artifakt]

If you found my Leeloo, give her back, we need to go find the four elemental keys or a huge meteor is gonna give Earth a real smackdown.

Re:Good. Encryption is a tool too

[Wavicle]

There was no obstruction of justice charge that we know of.

There was also no indication that anybody had committed the crime of obstructing justice. What are you saying?

Yes, you're absolutely ridiculous

[Moraelin]

The whole "if you have nothing hide, you shouldn't have PGP" idea is simply stupid.

It's like saying that if you don't have anything to hide, you shouldn't have a lock on your door or curtains at your windows. Hey, you could have hidden some corpses behind that door and those curtains. Yep, it shows you had criminal intent.

The whole post-9/11 idiocy that privacy==criminal intent (or even makes you an active terrorist) is getting on my nerves already.

Everyone needs _some_ privacy. Noone is a 100% exhibitionist, who'd eat, sleep, shit and surf for porn at a street corner with everyone watching. Even the most affectionate cat, if you have one, needs some time alone now and then.

Everyone has _some_ stuff they'd rather not have posted publically on a billboard in front of their house. E.g., their credit card number and SSN. E.g., the emails to their girlfriend. E.g., the pseudonym under which they posted that their boss is a retard. E.g., their medical record. E.g., their banking data. E.g., their names and passwords for sites they use. E.g., their diary.

Those are all very valid things to have encrypted. They're perfectly common everyday stuff, but nevertheless stuff which someone would have a damn good reason to encrypt. In fact, which they'd do damn well to encrypt. (Heck, I'd rate anyone 10 IQ points higher if they had their usernames and passwords in a strongly encrypted file, instead of on yellow post-it notes stuck to the monitor.)

It doesn't have to be something as criminal as hiding bodies in an underground cavern. And extrapolating that everyone who doesn't leave their front door open 24 hours a day, and doesn't post every single detail of their life (SSN, credit card number, emails, usernames and passwords included) in front of their house, is automatically a criminal... is bloody stupid. It's outright idiotic.

Re:Good. Encryption is a tool too

[SlimFastForYou]

(And for the record, when it comes to child pornographers, there can be no punishment too severe.)

Though this may be somewhat O/T, I believe this needs to be addressed. I believe criminal justice attitudes such as these to be one of the main causes for the dysfunction of our society. Don't get me wrong, child pornography is sick and should be strongly deterred. But we need to ask ourselves what role should our CJ system play.

I think too many people are too vengeful (in general, not necessarily not you personally). I could think up a punishment for child pornography that is too severe (for example, dismembering the criminal, his parents, and his children while still alive). Seriously though, we need to figure out if our CJ system should exist to deter and correct criminal behavior or if it should exist to fulfil humanity's lust to inflict suffering upon others.

Scary times

[trandism]

but the signs were there for a long time.

I mean, I remember, when selecting packages for a Debian installation, the very interesting non-US category

The axiom that someone is innocent until proven guilty has been reversed for some years now. At first, it was only the media that did that to some poor fellow that was pronounced guilty on TV at arrest time. But gradually this has become true in more formal forms (read Guantanamo)

And the EU is steady following :(

Red car

[Udo Schmitz]

Surprise! Your analogy is flawed. In your case a red car was involved in commiting a crime. Fact. In TFA there is no mention of anyone using PGP to encrypt pitures of the 9yo girl.

For now yes,

[t_allardyce]

Not it comes with every computer and is turned on by default for email etc. Eventually encryption will be like that and you won't be able to suspect someone purely on the grounds that their data is unreadable.

So where does this leave Linux ???

[JackJudge]

...And most other unices ?

Every distro I've used in the last few years comes with a kernel and associated modules for creating an encrypted filesystem, encrypting (securely) individual files or directory trees.

This is part of the stock install, so am I showing criminal intent by running Linux at home ??

C'mon people

[Beolach]

No one has said having PGP installed on his computer was a crime. It was merely ruled that it was relevent evidence in the case of the crime he was accused of commiting (child pornography).

This is not like saying "Your door has locks, so you must be a criminal." This is more like saying "You have been accused of murder, and a gun was found in your house." Having a gun in your house is not a crime - nor is having PGP installed on a computer a crime. But the court decided that having PGP installed on his computer was relevent evidence, just like finding a gun in a suspected murderers house would be evidence.

Re:C'mon people

[trandism]

And the problem is exactly that!

Suddenly having PGP (or GPG) is relevant evidence.

No one said that having PGP(GPG) is a crime. But saying that is considered relevant evidence is by itself scary enough for me.

And IMHO finding a gun in a murder-suspect's house should NOT be considered evidence. OK, if the gun was the actual one used for the murder, then it's different. But the sole presence of a gun?

So a guy get stabbed last night and we have to get rid of our kitchen knives suddenly...

Re:C'mon people

[rodmm]

I understand your point of view, but I believe that is more like: "You have been accused of murder. Your door has locks, so you have something to hide."

There is nothing wrong about having a door with locks on it. Neither to have PGP installed.

Is very different if behind the door you can find a lot of child porn pics... The problem is not related to the PGP, but with the content that is encrypted.

Don't be naive

[Anonymous Coward]

There is no other reasonable interpretation in the context of this case.

Lots of things use encryption!

[hckrdave]

That is totally nuts. Are they admitting his CDMA or PCS OR GSM mobile phone? WEP on his router? Watch a DVD. The list could go on forever... that must be one ignorant judge. Feel free to list all the stuff i was too lazy to type.

After I had my laptop stolen, I lock it down more

[steve_l]

My laptop got stolen from my own house last year; in hibernate state.

Revoking SSH keys took as much time as killing card info, There is so many places sensititive data could end up (like your bank login/card info), such as
-hibernate file
-pagefile
-browser password store
-browser page cache
-directory where I save PDF shopping receipts
-mailbox

Now I lock a lot of the system down. Not just my home dir
-temp
-browser cache
-various program directories.
This is win32, where the EFS stuff doesnt encrypt filenames, just the contents. Its known that EFS is breakable (just reset the login password or something), but to make it harder

1. laptop needs a bios password.
2. that password is also used to enable the HDD
3. My winnt EFS private key is stored in the laptop TPM module.

#3 is interesting. I know TPM is associated with 'evil-DRM-Trusted-computing-stuff', but I use it as an unbreakable store of my sensitive keys. If what the inventors say is true (I work with some of them), you'd have to be a stronly motivate government to stand a chance of getting stuff off the TPM, so implicitly, off this hard disk.

Does this make me a criminal? I dont think so. The police told me off for not bios-locking my last box. Their view is the less usable stolen laptops are, the less valuable they are, so theft reduces all round. It is every laptop owner's duty to lock down their boxes so nobody can get at them!

If encryption tools are proof of criminal intent

[Anonymous Coward]

can we sue the DoD, CIA, etc.?

ROT13

[jlebrech]

The accusers found ROT13 on one of michael jacksons computer, so this will now be used as evidence against him.

Re:ROT13

[cp.tar]

The accusers found ROT13 on one of michael jacksons computer, so this will now be used as evidence against him.

It does seem rather obvious... maybe just a leetle too obvious...

It's called rot13, if you haven't noticed.
How old were the kids again?

It all makes sense now...

Note to self: move in with my next-door neighbours. They live on #19.

Re:ROT13

[topham]

You do realize they submitted pornographic magazines as evidence, and atleast as reported the last time I saw an article on it, they had no evidence anyone other than michael ever looked at them.

Don't know, but I don't think owning a couple of magazines I can buy at Max or 7-11 should be inherently admissable in court to imply someone is a pedophile.

Thats like saying owning a car shows you're inclined to rob banks.

Where is the line and where is the crime?

[Anonymous Coward]

Social perversions and thought crime.

I have photos of naked children. Myself and siblings from 50 years ago. These days, if I 'got caught' sending copies to my siblings over the internet, who do you think would be on the spot to prove he's not engaged in a criminal activity?

What if I had PGP on my computer? I do.
What if I had a copy of a film titled, 'Lolita'? I do. Go ahead and look. It's a film from 1962 by Vladimir Nabokov. They have it at the local video store and Amazon sells it. I got my copy at Best Buy for $2.99.
What if I was looking for some information on Vladimir Nabokov and reviews of the film? Why damn, I have a record of 'lolita; in my google search.

Back in the 60's this would pose no problems. Today, people are so quick to assume what I might be THINKING along the lines of their narrow little prurient minds, and you can bet that most jurors don't have much common sense, that a clever prosecutor could put the burden all on me. This is NOT constitutional law. The prosecutor has to prove I'm guilty of a crime, not of possessing all the components which might make me guilty of a crime.

What sort of crime is pornography anyway? IMO it's NOT a crime. If there is any criminal activity, in the referenced case, it's that the guy solicited a minor for activity, as far as we know, without the permission of her guardians. Shops put candy within easy reach of children all the time. Children have money. No one prosecutes the shop owner for soliciting a sale without the parents permission. In the present USA climate one wonders if the parents, giving permission for photos, might not be on their way to jail too.

Who the hell is in charge of ones kids anyway?

As for photographs. If taken in public there should be no problems. If distributed without permission, there are laws covering this, whether photos are 'prurient' or not. As for a minor being involved, without her guardians permission, that's a problem. With their permission should be fine. What the heck are guardians anyway.

It's only pornography in the mind of the viewer.
Attributing the same thoughts to someone else and charging them with a crime is in FACT charging them with a thought crime. This opens the door for other crimes which someone else may think you think...

hate CRIME
racist CRIME
theft CRIME
murder CRIME

What if.....

[Asprin]

What if he was using a Windows-encrypted disk volume to store data?

Re:What if.....

[Maljin Jolt]

Windows volume encryption does not prevent law enforcers to read your disk at all. Unlike PGP, which makes it rather difficult and/or costly.

Re:What if.....

[Anonymous Coward]

if used with an account password it does.. unless you're logged in on the account that encrypted the files, you wont be able to read them

Re:What if.....

[anthony_dipierro]

What if he was using a Windows-encrypted disk volume to store data?

They would have tacked on a negligence charge.

Re:What if.....

[Anonymous Coward]

if used with an account password it does.. unless you're logged in on the account that encrypted the files, you wont be able to read them

How can this propaganda be modded informative? I have already proved the opposite.

Does that make Windows illegal?

[mad_goldfish]

See, I've got this program that came with windows, and every time I log onto my banking site, or gmail, it encrypts my communications, so its presence on my machine must maean I have something to hide.

Damn internet explorer.

Frequency should be irrelevant

[Moraelin]

There are lots of things that aren't really pervasive, but that doesn't necessarily make them criminal.

E.g., my parents have rented a box at a bank to keep their documents there. Their reasoning being that in case of a fire or burglary, might as well not lose those.

It's not a pervasive thing, and it _could_ theoretically be used to hide something illegal, but that's not what they use it for. And a prosecution line of reasoning along the lines of "if it's not pervasive, it shows criminal intent" would make them both criminals. (Mind you, I'm not always on good terms with them, but "criminals" is a bit too harsh a word to call them;)

E.g., high-end sports cars are not that pervasive, and _could_ be used to try to outrun the police cars. But I sure hope it doesn't make everyone who bought a sports car automatically guilty of criminal intent and planning to flee the police to the border in that car.

E.g., I know at least two people who regularly purge their browser's history and cache. One is just clinically paranoid, (Yes, literally, believes in a world-wide conspiracy, that is secretly responsible for everything from wars to Jar Jar in Episode 1. No, literally.) The other just doesn't want his wife to find out about his porn surfing habits.

It's not that pervasive a thing to do, and it _could_ be used to hide surfing for something illegal, but none of them actually surf for anything illegal. (The paranoid one is just too paranoid, for example. He _knows_ that the conspiracy is watching him.)

So to cut to the end of a long rant, an idea like "if it's different from the norm, it can get you (extra) time in jail" seems like a very very dangerous precedent to me. Pressure to be 100% conformist and obedient can be bad enough as it is. Attaching an extra potential jail sentence to anything if it's unusual, seems to me like a very bad idea.

I've met the same fate

[phreak03]

My schools ITS department went after me for using blowfish encryption, and W.A.S.T.E on the network...
was fun using the glass house analogy with the schools administration.. fortunetly nothing ever became of it, hmmm now that i remember it, it was my posting on slashdot also that they tried using as "evidence" against me... sigh.... i hope this post dosn't end up getting printed out and stuck in a file of mine somewhere

Next: Conspiracy of those with Locks

[zotz]

OK, so what's next?

Am I in some sort of conspiracy with all the people on my block becasue we all have locks on our doors and windows. (Actually, I think the conspiracy goes a bit further than just my block, but I am not going into full details here on slashdot.)

So, the existance of encryption software is evidence of criminal intent? Do we finally have a big weapon to use against the MPAA and their ilk? I mean, if they did not have criminl intent, (if they have nothing to hide) then why would they need encryption?

Hmmmm.

OK, so no more ssh, ssl, pgp, gpg, rot13, oh well, back to telnet. No WEP or their ilk allowed either... back to all open access points.

Interesting times...

all the best,

drew
--
http://www.archive.org/search.php?query=creator%3A %22drew%20Roberts%22

So do something about it.

[argent]

Every time I hear that argument I almost explode in a rage and claim that at times the usage of encryption alone will be held evidence that you're a criminal.

Exploding in a rage doesn't actually accomplish anything, and that's probably a good thing given the things some people explode into a rage about.

The real problem is that you're never going to get a significant number of people to agree to use encryption on those grounds. The only way you're going to do that is to make it easy.

PGP and GPG are both insanely difficult to set up, even for geeks, and I can't see any reason why. They don't actually do anything very complex, outside of the encryption code itself. Comparing them with other encryption software doesn't make them look any better. Even traditional SSH is better, and things like the Apple keychain or browser SSL support are pretty much automatic.

Nobody would say that using an encrypted HTTP connection or a VPN was evidence of a crime, but that's not because people are somehow more dedicated to encryption being available, it's because it's as easy to use encryption as not to use it.

You want more people to use encrypted mail? Make it easy to do. Fix the mess that's "pgp -injoke", where the only concession to user friendliness is making the needlessly compex options spell something. You don't want to? Then this is YOUR fault, you lazy bum.

Re:So do something about it.

[splint3r]

I don't believe that difficulty in using encryption is the problem. Kgpg makes key management (the only part of gpg which I would say is complicated) relatively easy - and Apple have made encryption of your entire home area ridiculously easy. But still, no one uses these things but the people who know their value.

Encryption can be as easy as you like, but the ignorant will not use it, and who can blame them? Why would your average suit use something they've never needed before, if she can get the same job done without using it? I believe that even with education, only a small percentage of suits would start using encryption.

However, I think you touched on something. Apple Keychain and SSL are both examples of things everyone uses (alright in the former, it's everyone with a Mac). Reason being because they don't even know they're using it, they're just forced to without being told. So it would seem that the solution would be to start using crypto in mail clients by default and without the users knowledge (unless she wants to poke around a bit).

Of course this would be difficult given the way public key encryption works, but I believe it's doable.

Re:So do something about it.

[silence535]

You want more people to use encrypted mail? Make it easy to do.

I wholeheartly agree with you.

Given that I am a poor developer I can not do much on the code side. I always wondered why OpenSource mail programs don't come with a gpg plugin pre-installed and why they don't have a small wizard for importing or generating a keypair.

I have tried to do my share by first making friends and family aware that they are sending their very private love|hate|terror mails thru the world in plain text. In a second step I tried to argue against the dreaded 'I have nothing to hide' argument I mentioned earlier.
I always failed. In the discussions I opted to let people decide for their own good or bad.

People astonishingly enough trust the government too. This might even be ok for today, but remember that the NPD, the German NeoNazi Party, had almost 20% in the last elections in Saxonia. Do you trust them when they have their next go in a couple of years?
German ISPs are ordered by law to save your internet connection data for eight (!) years.

There is one story of the 2nd world war that should teach us something but that is too little known: The Norwegian Government had a central register of Jews in Norway before the second world war. This government had no intention to harm any Jew, but when the Nazis dropped in they used this register to find end exterminate Jews.

The very few people I exchange encrypted mails with are paranoid geeks.

*sigh*

-jsl

Re:So do something about it.

[Anonymous Coward]

PGP and GPG are both insanely difficult to set up
Try upgrading from PGP 2.6.2 to version 7 or 8 and give it a try. PGP is so easy to use it's not even funny. It seamlessly integrates into email software as well. I have to deal with hazardous materials at work so we use PGP to keep certain things locked up. If you think it's hard to setup and use then you must still be using the command line version from decades ago.
Of course this is all on windows. Never used it on *nix.

Re:So do something about it.

[argent]

I don't believe that difficulty in using encryption is the problem.

In this case it is. People aren't going to routinely encrypt stuff unless it's easy, and people aren't going to have some class of encryption software on their computer unless people routinely use it, and that class of encryption software isn't going to be seen as evidence of wrongdoing unless people don't normally have it on their computer.

See, it doesn't matter that everyone ALSO has encryption software in their web browser, because it's not encryption software that was the issue, it was a particular kind that people almost never use because it's so hard to use. He didn't even have any encrypted email on his machine, he just had the software... that would be like using the fact that OS X has encrypted home directory capability to claim that someone with a Mac has something to hide.

But you have the software, and it's easy to use, so having it isn't evidence of wrongdoing, and using it isn't even evidence of wrongdoing. Because you're not going out of your way to acquire and use it.
The GPG plugin for Apple Mail that I use still required me to download and install multiple separate programs: the GPG plugin, the GPG software itself, and a GPG configuration program, and a keychain manager hook.

KGPG looks similar to the GPG configuration program and keychain manager. You still need to install GPG and a plugin for your mail software.

That's just too much work for most people. It was almost too much work for me... I put off upgrading from PGP to GPG for months because I didn't want to go through all the hassles again... and I still had to use the command line stuff to get my PGP keys properly transferred.

If it was in there by default, even if I only rarely used it, having the software on my disk wouldn't be evidence of anything. And if it was just a single download that worked with Mail (or Outlook) and automatically had me set up a key pair the first time I tried to send encrypted mail, then it would still be normal and usual.
Even if I didn't use it, it would be THERE.

Then it would make sense for companies on the net to require encrypted and signed mail to do business with them, and THEN people would use it.

But you can't get there from here unless something's done about the current ghastly state of the software itself.

Re:So do something about it.

[argent]

Try upgrading from PGP 2.6.2 to version 7 or 8 and give it a try.

OK, "PGP and GPG are both insanely difficult to set up, or are ridiculously expensive for the kind of casual use the OP is talking about".

I had to go all the way to "add to cart" on PGP's site to find the price for PGP Desktop. It's a hundred bucks. If it was a $10.00 shareware product, even that would limit it to people who are already looking for a security solution. This has to be something that Paypal or eBay or Netwizards or Chase Bank can show you how to download for free or assume that you already have, like they can assume you have an SSL-enabled browser.

THAT's what it'll take for encrypted email to be common enough that it won't be seen as "evidence".

In other news...

[whackaxe]

...a man was arrested for buying a belt. Police specialists say it was possible he could have strangled a theoretic 3rd party. if this guy's being tried for having kiddie porn then they must have something better than "he had a encryption program" to prove it? if they don't, then American justice scares me (more)

PGP/GPG

[SavvyPlayer]

I use GPG for one reason: to encrypt my password file, history file, cookies, auto-fill files and any email communications containing that password as a last measure of defense against would-be crackers and identity theives.

This is the only truly effective defense a consumer has against these types of criminals, and as such a consumer should not be regarded suspect for merely taking common-sense measures to protect himself. However, should a court require that I turn over keys to these files, I'd consult my attorney. If my attorney felt the information would not be abused (e.g., a cookie from an accidental click on a dodgy website being admitted by the prosecution team as evidence), I'd have no problem there.

I find such associations bad anyway

[Moraelin]

E.g., I do carry a bag or two with me almost at all times, because I sometimes just want to drop by at the grocery store and buy stuff on the way home from work. And I see no point in buying a new plastic bag each time.

So basically if someone decided to accuse me of shoplifting, that bag -- even if not used at the time -- would suddenly be criminal intent. Seems bloody stupid to me.

E.g., back in college I did have half of my hard drive encrypted -- and that was before the OS itself came with encryption -- just because I didn't want the rest of my family reading my private stuff. Among other things, for a month or so at the time I tried to write a diary, and I didn't want it to be the whole family's business. ("Nosy" is too mild a word to describe my parents.)

What if at the same time, and totally unrelated, I had followed a link to some illegal site? God knows some sites had tons of redirects and links to warez sites, porn sites, etc.

Would suddenly that encryption software count as criminal intent to encrypt and traffic that illegal stuff? Even though it was never actually used to encrypt any of that?

Seems to me that linking everyday items to somehow imply premeditation and guilt, is severely flawed. Unless it is proved that the bag, or the encryption software, or whatever, was actually _used_ in committing the crime, it seems to me that mere possession doesn't really mean anything.

People, the court got it right.

[and by]

There are a lot of people bemoaning the court's decision, saying that it's criminalizing encryption, etc.. More over, the OP makes reference to sentencing hearings. Fortunately (except for the egos of the uninformed people posting here), legal relevance has little, if anything, to do with criminalization of a given act.

Relevance can be defined as the quality of a piece of evidence (including testimony) that makes a contested issue in the case either more or less likely to have occurred (is it "probative" of a contested issue?). In other words, to be relevant, evidence need only pass a very minimal standard: does it make any element of the plaintiff's / prosecution's care more or less likely to be fulfilled.

The most common incorrect assumption about relevance is that for a piece of evidence to be relevant, it must make an element more likely to be true than false. That is where, I think, the OP got it all wrong. It only has to make an element more or less likely than it would be without the offered evidence.

My evidence teacher put it in terms of the betting-man test: If you were about to wager on whether something had already happened, but you had no idea and were going to flip a coin to decide, then a fact would be relevant if it would sway you, no matter how little, such that you, as a true statistical-believer of a gambling man, would rather wager based on that fact and not by means of flipping a coin.

Now, there are statutory and evolved exceptions to this; there's a lot of relevant evidence out there that's been, either by legislation or by tradition, called irrelevant, e.g. evidence that's relevant but not rationally so (it plays pretty much only to emotions), evidence of prior convictions, or character evidence to prove conduct.

So that's why the court got it right. The fact that this guy had PGP on his computer and that there were certain directories of encrypted files makes it more likely, in connection with other relevant facts already in evidence, that he was dealing with child pornography (note, once again, that this is not saying that the fact of PGP makes it more likely that he committed the crime, only that the fact makes you lean more towards "guilty" than you would lean without the fact).

Although the presence of PGP, in the absence of other evidence of crime, would not be relevant evidence of crime (at least to me as a juror), once there's something about a crime, I'd be willing to say that encryption makes it more likely (perhaps not by much), that the crime has been committed.

Re:People, the court got it right.

[wk633]

I can accept the argument "although we didn't find any child porn on his computer, we did find lots of encrypted files that we could not decrypt"

But if a suspect refuses to talk until they have a lawyer present is that relevant? "although he didn't confess, he didn't say anything until his lawyer was there".

I can see the existence of encryption as being a way of explaining the absence of some piece of evidence, but the judicial system in general will be VERY careful about the existence of encryption being presented as evidence. Without knowing the Judges actuall instructions, I don't know that the thinking slashdotter can have an intelligent INFORMED decision on this one.

Not hardly.

[rjh]

The trial judge did not accept it as evidence of guilt. In the American system of jurisprudence, judges never make any determination as to whether evidence is implicating or exonerating. They only decide whether evidence is relevant. All other decisions--like how much credibility to put in the evidence, whether the evidence implicates or exonerates, all other decisions--lie in the hands of the jury. The framers of the Constitution didn't trust the government to judge evidence; all fact-finding was delegated to the jury.

In this case, the judge decided the presence of PGP may have had evidentiary value and thus it deserved being presented to a jury. Twelve people from the community then looked over the entirety of evidence, of which the presence of PGP was a really minor part, and decided that the balance of the evidence indicated his guilt beyond a reasonable doubt. And an appellate court has said that the trial judge wasn't unreasonable in finding that the question of PGP was best left to the jury.

Wow. Amazing. How dare courts do that in America? It's positively unamerican.

Just Minnesota and sex crime

[smchris]

As much as I like the place, it can swing toward political correctness as a philosophical evil. Minnesota pioneered the idea of keeping sex offenders in custody indefinitely as criminally insane sociopaths AFTER they fulfilled their sentence. A teeny tad problematic constitutionally. After a couple decades of this, just this month they finally passed a law calling for life without parole for some sex offenses -- which at least addresses the legal issue.

Minnesota has also toyed with all the pornography definitions from "know it when I see it" to "anything whatsoever that incites the perverse". So the encryption issue is obviously just another Minnesota sex thing where encryption had the misfortune of being present at the scene of the crime.

On the other hand, a judge tossed out a case last year explaining to all involved that it wasn't the defendent's responsibility to prove that the girls in the photos were over 18. It was the prosecution's responsibility to prove that they _weren't_.
.

for the love of god!

[fenrin]

Not only is this horrifying to think about what this means for everyone else, but I can easily see the next ruling.
"Locked Doors can be construed as criminal intent."
What are you trying to hide from the police? What do you not want any police officer that comes walking past to see? DOORS = EVIL!!!

US adopting China's views on civil rights?

[Anonymous Coward]

Next stop: everyone using encryption is considered a terrorist and sent to prison or concentration camps e.g. Guantanamo Bay. Where are our civil rights and our freedom in the "land of the free"?

Forget XP Home

[Trejkaz]

Outlook Express comes with XP Home... and supports S/MIME encryption. In other words, it supports a type of encryption which is used for EXACTLY the same purpose as PGP. Therefore, every XP owner is a criminal. Hooray for logic!

I'm glad its child porn.

[crovira]

You can't legislate FOR child porn in this society.

We have too many secrets, too many thing hidden away, too many things that shouldn't ever see the light of day, too many parts of our psyche that tries to scurry away like a cockroach from the light of exposure.

I'm glad that this ruling came out because it makes this kind of barricading as suspect as it should be. The tools themselves are as suspect as they should be.

Encryption technique is not at issue here (its essential for secure transmission of data,) but the need for openess of the source IS!

Think about it!

Open Source becomes essential to insuring that your system is not a porn repository. How could Microsoft be against that? Do they have something to hide? :)

Re:Good. Encryption is a tool too

[Anonymous Coward]

Get with it man! Child porn is the new hysteria hot-topic! There is no punishment too severe. They are worse than serial-murderers, totalitarian dictators, and baby-killers. And they're everywhere, just watch the news. Don't let your kid go outside, there's likely a child pornographer/child-molester hiding behind every tree. We need more punishment! Dismemberment is a good idea, but perhaps they could be whipped and given a bath in acid before they are dismembered.

Encrypted emails from kiddie porn sites?

[Anonymous Coward]

What if the perp/perv had a thousands of encrypted emails from known kiddie porn sites? Where each and every email was 50 megabytes or bigger?

In that case, where a kiddie porn site is sending someone literally gigabytes of encrypted data, wouldn't having PGP be relevant? How about if PGP were installed the day before the multi-megabyte encrypted emails from the kiddie porn site started coming?

Without knowing the full details of the case, it's impossible to comment on whether or not the existence of PGP was important or not.

And although IANAL, it's just a fact that PGP was on the perv's computer. And it's up to the jury to weight the significance of that fact in the context of all the facts of the case.

I'm sorry - you are already viewed as a Perv ...

[gadlaw]

I'm sorry but anything you say can already be ignored because of your admitted use of encryption software. Thanks to the usually liberal Minnesota court we now know that by definition you Pervs use encryption software for your evil Perv uses. This guilt by association with a known evil product that is used by known evil people is a useful time saver in determining the guilt and innocence of all people such as yourself. Suuuure you have a reasonable expectation of privacy but then if you weren't a Perv why would you encrypt anything? This in conjunction with the use of extensive background investigation to find anything you might have done as a child twenty or thirty years ago or any mistakes,errors, and or laspes in judgment over the years leads us to be able to efficiently discredit and disregard anything you might have to say. Thank goodness for Judges in the Peoples Republic of Minnesota who are working diligently to protect us from you guys. (please note the heavy sarcasm in case anyone from Rio Linda is reading this)

DOORS = EVIL!!!

[cp.tar]

Not to mention that every house will have to get rid of all - ahem - windows, as they too can be viewed as criminal.
On more than one level.

You see? There is a silver lining.

This is pretty stupid, of course.

[Pig Hogger]

Stupid, by the Court, that it.

Now, it has exposed a broad flank to be shot down in flames in the inevitable appeal that will ensue.

After-all, despite all the new "patriot" acts, the basic doctrine that they have to prove you're guilty and not you that you're innocent stills stands...

Re:After I had my laptop stolen, I lock it down mo

[quantum bit]

-pagefile

FreeBSD 5.x has an option that can be set that, on boot, sets up the swap partition with a random encryption key that is kept only in memory and discarded on powerdown.

It's great for laptops since swap is the primary place on disk where passwords in memory can get accidentally written to. The only downside is that leaving it suspended is a security risk so it's best to power it down when it will be unattended.

Be very careful with EFS if those are files that you care about. If the machine isn't on a domain, there are several events that can cause you to lose your key permanently. One of them is having the user account password reset from the admin account. Changes to the user profile can do it too. Make sure to have backups and be very careful around your registry hive.

On a domain on the other hand, a domain admin can set up key escrow, so EFS doesn't really provide any security there unless you are the only domain admin or you trust everyone who is with all the data you encrypt.

If encryption is outlawed...

[atomm1024]

only outlaws will use encryption.

Re:After I had my laptop stolen, I lock it down mo

[lukewarmfusion]

The police told me off for not bios-locking my last box.

Interesting... a couple of things come to mind:

1. I've never met a police officer with such a technical mind. I know they exist, but I expect that reporting a crime like a stolen laptop would get me a "so what do you want us to do about it?" and "give us the serial # and we'll keep and eye out for it."

2. I thought BIOS-locking referred to OS-BIOS connections... BIOS Locking: More Intrusive Than WPA. Perhaps you/they meant "BIOS password?"

3. BIOS passwords can be broken, bypassed, or removed quite easily. This is what makes me think that's not what they meant.

Anyways, just some things that went through my head.

Re:Good. Encryption is a tool too

[Anonymous Coward]

Don't let your kid go outside, there's likely a child pornographer/child-molester hiding behind every tree.

Have you checked out the sex offender database for your zip code? Pretty scary how many people in the database live not so far away.

Cryptomaniac...

[http101]

What fresh hell is this that I wake up and learn that because I have an encryption program on my computer, I'm instantly qualified for 10-20 years (in the pokey)? I find it ironic that Windows NT, with its encrypting file system, hasn't landed my ass in jail yet. I thought it was legal to own it, afterall, I had to buy it.

BTW, I own a gun, knives, wood chipper, and a shovel.

US PASSED LAWS.

[Anonymous Coward]

If I am not mistaken the US passed a law about three years ago that could add 5 years to your prison term if you commited a crime and used encyption as part of the crime!!!

Won't somebody PLEASE think of the children?????

[bitslinger_42]

The GP wasn't saying that child pornographers and other reprobates should be able to get away scott free by encrypting the evidence. The point appears to have been that moves such as this are serving to errode the protections set forth in the Forth and Fifth Amendments.

Stating that encryption is relevant to the state's case is analogous to the state saying that the defendant's refusal to admit that they're guilty is relevant to their case. There are all sorts of legal uses for encryption, most of them perfectly understandable for the accused (and he still is only accused, not convicted, and should therefore be presumed innocent!) If this weren't so, then you might as well accuse the thousands of people in my company who have PGP on their desktops of being child pornographers and/or terrorists.

Yes, child pornography is bad, but that doesn't mean that the moment someone is accused of the crime we should throw out the constitutional protections guaranteed ALL citizens. Given the current political climate, people who use reasoning such as the parent turn my stomach more so than CONVICTED child pornographers. Bah!

Re:After I had my laptop stolen, I lock it down mo

[swv3752]

Remove or drain the cmos battery and the bios password is reset. An NVRAM clear will often do it as well.

Draining the cmos battery will take about two weeks though.

I don't think this message helps though

[hey!]

ENCRYPTION != EVIL

OK, agreed.

But I wouldn't necessary put it that way if I needed to make a point. Even if you get somebody to agree with you, it doesn't necessarily help them draw more accurate inferences. Indeed their inferences might still differe hardly from if they thought it was evil. The point here is that they were instructed to consider encryption as evidence. Well, OK, but how to they weight that evidence? Bayes therem says: P(A|B) = P(B|A)*P(A)/P(B).

People have a kind of rough intuitive understanding of this. Suppose "A" is "Is a Terrorist" and "B" is "Uses Encryption". Let's say 1 % of the population is terrorist and 1% uses encryption, because I'm lazy and like my factors to cancel. But since we're talking rough intuition, it's not much of a stretch: what I'm saying is that both terrorism and encryuption use both perceived to be unusual, even if we can't assign precise numbers to them. So, in this case, we get P(A|B) = P(B|A). Let's say that only 10% of terrorist are stupid enough not to use encryption. If we find out somebody is using encryption, if these assumptions are roughly correct, we can be 90% certain that they're terrorists.

On the other hand, suppose everybody uses encryption. Skipping the boring algebra, this works out mean P(A|B) = P(A). This means that some person who happens to use encryption software is exactly as likely to be a bad guy as any person picked at random walking down the street. It'a one in a hundred chance, not quite enough to send anybody to the gallows, I'd say.

Which is a big mathematical "duh". People understand intuitively that unusual facts tell you more about somebody than commonplace ones. The fact that somebody staggers around making loud and rude comment and acting unruly is more helpful if you're trying to decide whether he's drunk than the fact he has ten fingers and toes, as it turns out most drunks do.

The heart of the problem then is that encryption is perceived as exotic. Dynamite, we can all agree, is not evil. But people don't keep it around unless they are using it on their job. If it is found in the urban apartment of a postal worker, it tells you something significant about that person.

This highly misleading message is reinforced by testimony like the police expert. Oh, I would love to have been the one to cross examine this guy. He pointed out that they only people who might be able to break this code are the National Security Agency. The logically inclined among us will naturally find this to be stunningly irrelevant. I might keep my valuables in a safe deposit box that could only be breached by a small nuclear device, it doesn't mean that I'm keeping stolen nuclear plans there. A marketing expert would of course understand exactly what the expert was telling the jury: "This is not something you'd ever use -- it's exotic, cloak and dagger stuff for nefarious purposes."

The better counter message is this:

"Encryption is commonplace stuff. You encrypt data probably every day without even being aware of it, because it's so natural and automatic you never stop to think about it. You encrypt data when you order a book online, or check your bank balances. If you don't encrypt your credit card or bank data, then chances are it's being done for you by the person who is serving you. While your personal information might not be safe when it gets to the bank, it is extremely safe en route. So far as we know, nobody can steam open the envelope and look inside, not even the US Government's top secret spy agencies. They have to wait for the bank to open the envelope first.

The world would be a very different place without encryption. Would you like it if you had to get your bank statements and paid your bills on post cards? Especially if anybody could use your credit card just by claiming to be you? Fortunately, every well designed system for storing and transmitting your data electronically has provisions for protect

Listen to this

[part_of_you]

5 years ago, the cops broke down my door looking for drugs. When they discovered I had a computer, they immediately started looking for child porn. They found none after looking for 1-1/2 hours. The only thing they found was a URL in my temp internet files that had the word "lolita" in it. Since they found that word on my computer, they took it, and I still haven't got it back yet! They took the monitor, speakers, keyboard, tower, mouse, and mouse-pad. They even took the 6-plug-in surge-protector I had. They took all that and left a bad of software that was sitting right next to the computer. These guys aren't kidding about child porn, and shouldn't. But don't you think this is a little much?

I am not as shocked by them now saying that a program that encrypts files, are related to child porn. Hell, they told a grand jury (an Alabama grand jury. that means mostly farmers that have no evil computers) that "He has his hard-drive partitioned into 4 logical drives. This is common practice amung child porn people."

When it comes to child porn, they are really cracking down. And that's not a bad thing. It just seems like an invasion of privacy. I mean, what if you are into drafting, like me. If you have an encryption program on your computer, it could be used for anything.

It's the same with "safe-delete" programs. Will they go as far to say that "If you have a safe-delete program on your machine, you get arrested for possession of illegal things"? I guess this is the price we pay to have freedom as Americans.

Re:Listen to this

[Anonymous Coward]

The price we pay to have freedom? Huh? What the fuck kind of doublespeak is that? How the fuck is it freedom to be told "you use encryption, thus you're automatically guilty"?

Re:Listen to this

[part_of_you]

Please write me back with your real physical address. A PO Box will do too. Do this so I can mail you a real life SARCASM DETECTOR!

Chill dude, it's only slashdot. We're all good strangers here.

Just goes to show

[jvlb]

See, this is what Bill Gates has been trying to tell us for years: A secure computer is a criminal offense.

OK I checked

[gr8_phk]

I did RTFA now, and it says they didn't find any encrypted files on his computer. So they are in fact holding the existence of PGP on his computer against him. That's like saying "You have a safe, but we opened it and found nothing inside. But it suggests that you have something to hide."

Re:After I had my laptop stolen, I lock it down mo

[lukewarmfusion]

You can find lists of manufacturer BIOS passwords that will bypass the user-specified password, too.

Working as a help desk tech during college, I discovered a lot of tricks for things you weren't supposed to do. Like resetting an NT administrator password (Tech: "You have to format, sorry." Me: "Boot to this and follow the prompts.")

With the proliferation of bootable specialty Linux distro CDs, there are so many tools to help a Windows person get out of a jam. :)

Re:Ah! How America leads the way. %)

[Danuvius]

Thanks, Slashdot, for wasting my time. That's not entirely a problem caused by the captchas, now is it?

Touché! Nonetheless, having to resubmit of the stupid captchas is bloody ridiculous, even if understandably modded into offtopic oblivion.

*NIX distros have criminal intent

[Anonymous Coward]

Sooo in my understanding PGP is compliant with the OpenPGP spec which means that many crypto programs (including GPG) can (de)crypt data. Every linux distro I have installed in at least the last 5-7 years has had the option of installing the GNU Privacy Guard.

Does this mean that the hundreds of installs I have participated in could now be used by a court in conjunction with any offense I am accused of to prove criminal intent and insure a conviction?

Re:Good. Encryption is a tool too

[pudge]

You're almost right, but you're not. There is no indication the encrtyption software was used, or intended for use, in conjunction with the criminal act, which is not the case where a perpetrator has a gun with him during the commission of a robbery.

A better analogy would be that a man *owns* a gun, not that he had one on him during his crime. Since he owns a gun, therefore perhaps he might be willing to shoot someone. This happens often in our criminal trials, and it is weak evidence, just like this encrpytion software is weak evidence. But it is, nevertheless, evidence.

I am old school: relevancy, if there is any question, should be a question for the jury. Let the defense attorney show that encryption software is often used for good, and in itself is not indication of wrongdoing, and let the jury take that into consideration.

No one expects the Spanish Inquisition

[HBI]

[n/t]

Re:No one expects the Spanish Inquisition

[BandwidthHog]

Welcome back!

Re:No one expects the Spanish Inquisition

[Anonymous Coward]

LOL couldn't even make it a whole month away from slashdot, you are truly a man of your word! LOL

Re:Good. Encryption is a tool too

[pudge]

But if a crime was committed in the dining room of your home, and a (legally owned) gun which was not used in the crime was in your bedroom, should that gun be used as evidence against you?

If there is some reason to suspect that the gun might have been used in the commission of the crime, and that you were the only one (or most likely one) with access to it, then yes.

Raise the nosie level

[pentalive]

Each of us shoud create a file with 10,000 lines of "I told you this was an inocent file" and encrypt it an just keep it laying around our hard disk.

Re:Raise the nosie level

[Ithika]

Hehe, I did something very similar to that at school. We were given a bit of server space and were promised that the admin types wouldn't go snooping in it. We'd had a spate of file 'disappearances' going on (including a friend of mine who lost a university application form), so I decided to take some action:

First, was to take all the files I used and zip them up with a password. I could download an evaluation winzip on whichever machine I needed to use the files, and otherwise they were inaccessible by other people.

Then I created a simple text file with an innocuous name ("letter", I think) in which I addressed the snooping bastard who was reading the file with some choice insults.

I got called into the headmaster's office for that. But it did get our complaints about file disappearances aired properly (they had previously been brushed off; "we'll investigate", etc.) and I got an apology from the headmaster in the end.

Ah, the heady nostalgia of it all :)

Encryption explains lack of evidence

[Mr Guy]

No, it's more like this.

You murder someone on the street with a knife. The state has proof you had the knife. The state has witnesses you ran home with the knife. Your defense rests on the fact that they couldn't find the knife in your home.

The state looks in your basement and discovers you have a perfectly legal iron smelting furnace (work with me here). The state is justified in bringing into evidence the possibility that the reason they couldn't find the knife is because you had the capability of undetectably destroying it.

Now flip furnace with PGP, and finding the knife with email records. Not having read the transcript of the case, it's possible some of his defense rested on "well you didn't see me transmit the images anywhere". If that's the case, the state is well and justified in pointing out there's a reason they wouldn't be able to find it.

Reading the article, it's not clear.

Re:Encryption explains lack of evidence

[99BottlesOfBeerInMyF]

As far as I could tell, no evidence was presented claiming that PGP was used to encrypt anything, or that there was any encrypted data that might be child porn. Here's a revision of your above analogy with that in mind:

You murder someone on the street with a knife. The state has proof you had the knife. The state has witnesses you ran home with the knife. Your defense rests on the fact that they couldn't find the knife in your home.

The state looks in your basement and discovers you have a perfectly safe machining toolset (work with me here). The state is justified in bringing into evidence the possibility that the reason they couldn't find the knife is because you had the capability building a lockbox and putting it in there. They did not, however, present any lock boxes into evidence that were found in your house, shipped from your house, or in any way connected to you.

Re:Encryption explains lack of evidence

[Mr Guy]

If you add that you also had a bucket filled with padlocks and an instruction manual called "Building lockboxes" I'd grant you that it was roughly equivalent, and I'd also say that'd probably be entered into evidence in a murder case.

If part of the argument (and again, without transcripts you're going on what seemed to me to be a fairly biased review of the case) rested on his ability to share the information without being detected or in our case the ability to dispose of evidence, then you'd better darn well believe that the prosecution has a right to bring in evidence that you did have that capability.

Re:Encryption explains lack of evidence

[99BottlesOfBeerInMyF]

his ability to share the information without being detected or in our case the ability to dispose of evidence, then you'd better darn well believe that the prosecution has a right to bring in evidence that you did have that capability.

They presented no evidence (as far as any of us know) that he used encryption to hide the transmission of child pornography and you don't need PGP to delete files and overwrite them, only to encrypt them on your own system. As far as I could tell there was no mention of any encrypted files or transmissions anywhere, merely encryption tools.

I could see bringing this up is a defendant had a number of encrypted files that the police could not decode (maybe is is child porn) or even if the defendant transferred a large amount of data somewhere via an encrypted pipe. But as the case was presented neither of those things was mentioned in the case, merely encryption tools used to try to paint the defendant as some sort of sophisticated criminal, just because he has them.

From what was presented PGP has about as much to do with the case as a wood lathe in the house of someone accused of assault and battery. "The defendant has a lathe, much like the kind one would use to make a baseball bat to beat people with." It sounds like the judge knew what he was doing in this case and just made the decision to avoid having to have a fresh trial. This precedent is wrong and dangerous. Having or not having PGP on a computer is irrelevant to the case and was just an attempt to portray someone as a criminal through association with "subversive" technology. This is especially sad because this person probably is guilty of a very real crime and there seems to be plenty of real evidence to prove it.

Encrypted files?

[phorm]

Yes, but from my understanding of the article the encryption wasn't used in conjunction with the alleged crime. If I'm charged with murder and I happen to have bought a bag of lime or something that can be used to dissolve a body or hide evidence... then a body is found but without any traces of lime... how is the lime in any way connected to the so-called crime?

You can't deal in possiblities. Certainly if the dude had encrypted kiddy stuff on his machine they could use that against him... but he didn't, just encryption software which could very well have been from a completely unrelated issue.

Here I go again

[ReadParse]

I can't seem to figure out where I stand on issues, which I guess makes me a moderate. My first impression was that this was a really unfortunate anti-encryption story and that we, as a community really need to work on public perception of encryption. Because encryption is just a tool and just because somebody has duct tape doesn't mean they used it to bind a victim and that was where I came around to a different perspective...

Oh yeah, we do consider tools as evidence, even if those tools can be used for other-than-criminal activies. Duct tape, rope, a shovel, a knife, a gun (which is also a legal tool), a cell phone, a pair of binoculars -- heck, anything relevant can be used as evidence.

Now, had they said that encryption software was grounds for conviction in lieu of any actual evidence, using the theory that the reason you can't find any evidence is because the defendant encrypted it all -- THAT would be a tragedy for encryption. But as it stands, it sounds reasonable to me

RP

But don't the feds have encryption too?

[Anonymous Coward]

AC, and too late for anyone to see this, but don't maybe the CIA or FBI or NSA use encryption for anything? Couldn't this ruling mean that they have criminal leanings or tendencies? I did RTFA, and that wasn't the only thing that convicted him, but couldn't someone start launching investigations against any government entity or organization that used encryption? And, as mentioned, what about those web sites like amazon.com that no doubt are helping the terrorists by using encryption?
The whole thing seems a bit hypocritical.

Re:After I had my laptop stolen, I lock it down mo

[sploxx]

#3 is interesting. I know TPM is associated with 'evil-DRM-Trusted-computing-stuff', but I use it as an unbreakable store of my sensitive keys. If what the inventors say is true (I work with some of them), you'd have to be a stronly motivate government to stand a chance of getting stuff off the TPM, so implicitly, off this hard disk.

If your work with the inventors, you should know one thing. It is not trusted computing that is seen as inherently unsafe or "bad". That is the (IMHO VERY harmful) anti-tcpa propaganda which dumbs things down too much - which leads to people like you asking "so what?"

Yes, I would be very happy to own a trusted computing device, if and only if I have access to ALL keys and there is nothing hidden to me as the user (of course, with authorization by a passwort/master-key).
But that's the point and the danger. Trusted computing with "not-your-own-keys", areas on your computer controlled by someone else, makes the most evil forms of DRM, goverment control etc. possible!

Re:After I had my laptop stolen, I lock it down mo

[hawk]

I don't suppose you'd want to tell us what that option is? :)

hawk

Freaky

[Pampusik]

This is freaky... I actually know one of the judges...

The full opinion is available online at http://www.lawlibrary.state.mn.us/archive/ctappub/ 0505/opa040381-0503.htm

The judges wrote: Appellant argues that his "internet use had nothing to do with the issues in this case;" "there was no evidence that there was anything encrypted on the computer;" and that he "was prejudiced because the court specifically used this evidence in its findings of fact and in reaching its verdict." We are not persuaded by appellant's arguments. The record shows that appellant took a large number of pictures of S.M. with a digital camera, and that he would upload those pictures onto his computer soon after taking them. We find that evidence of appellant's internet use and the existence of an encryption program on his computer was at least somewhat relevant to the state's case against him. See Minn. R. Evid. 401.

It appears the presence of crypto was not viewed as evidence for malfeasance, but instead used to describe a part of the procedure in which the appellant loaded pictures of the victim onto his computer.

Don't worry (if you're not a child pornographer)

[stew1]

(Disclaimer: I'm a programmer at Guidance Software, and work on EnCase.)

The fact that the presence of PGP on the suspect's computer was determined to be "somewhat relevant" by a Minnesota appeals court in this particular case is hardly the death knell for the 4th amendment.

Evidence from computer media is largely treated as circumstantial in the courtroom. As such, the tact in CP trials like this is to present lots of independent facts to the court with the hope that the aggregate weight of these facts is enough to remove reasonable doubt.

I have and use PGP and have no fear that it'll ever be used as evidence against me. Unless, of course, child pornography is recovered from the unallocated clusters on my disk, internet history show I was surfing CP sites through Google searches, link files pointing to, for an example I had from an investigator this very morning, "Gruppe 3 M:adchen Sperma.jpg", etc., etc.

Another subtlety to understand is typically only a small amount of the technical evidence from a case is presented to the court. Why? Because you don't want to spend hours and hours confusing the judge and jury about the meaning of MFT records and the like. I'd be sure in this case that there's a fair amount of evidence against the suspect (there usually is in CP cases, or they don't prosecute...) and the prosecution cherry-picked what to present in court based on how easy it would be to explain.

Jon

Re:Won't somebody PLEASE think of the children????

[DavidTC]

Hell, we know why he had PGP. It's because he was googling for 'lolitas'. Which in 99% of the time means fake child porn, which is still perfectly legal, and maybe 1% of the time real child porn, which is illegal, but, duh, not what he was accused of! (He can't be charged with possession of child porn if he doesn't actually have any.)

But the fake child porn option produces plenty of reasons to encrypt his porn. Um, duh. And it's completely legal.

Of course, he apparently failed to do so. Or maybe he couldn't find any. Because nothing was encrypted.

OT comment?

[erroneus]

I don't know how relevant this thought is, but I wanted to put it out there just the same:

Unless an actual child is being affected in some way, I really think child porn is at most levels harmless to the public. I'll qualify that in many ways if need be though I will grant that the initial act (if indeed it was an actual child depicted) is in fact harmful for the natural and healthy development of a child, the interest in child porn is, in my view, an exaggerated "thought crime" (provided that is the whole extent of the attrocity) and should be left alone by law enforcement... it is by itself a victimless crime in my opinion.

(I like porn... maybe not children, but when you start drawing lines, at some point I might find myself in jail because the objects of my own fantasy aren't wearing burkas right?)

My opinion can't be popular, but I think it's most compatible with those who care about general freedom that does not harm anyone else. I feel bad for anyone who is damaged enough to find children sexy, but if they do manage not to 'infect' anyone else with their condition, they should be allowed to live in peace and let the public relax from its with hunt.

(I'll qualify myself furhter by adding that I'm actually kinda drunk right now so if I don't make great amounts of sense, that might be part of it as well... but I generally stand behind my moral convictions [ironic word isn't it?] which support the right to be left alone if you're not harming anyone else in any way.)

Basically, to tie this in with the original topic: a person should have the right to protect his privacy from the public and YES from law enforcement. While I personally believe that "victimless crimes" should not be criminal, I recognize and in fact respect the fact that they are criminal at present. I should be allowed to encrypt anything I want and that encryption alone should not be confused with criminal intent any more than wearing clothes and a pocket knife in my pocket should be confused with having "a concealed weapon" on my person or a lock on my front door be confused with having controlled substances within.

These people are so short-sighted... more concerned with "getting the bad people" than protecting themselves... have they no idea what damage they are causing?

So... SSL can lead to the SSLammer ???

[Anonymous Coward]

So... SSL can lead to the SSLammer ???

Takes the fifth... OT

[Tired_Blood]

This is OT and IANAL, but...

informing the court that you "take the fifth" is unadvisable for any case involving alcohol.

What would they say if everyone used encryption?

[Sark666]

Say it was commonplace for everyone to use encryption. I'm talking your mom encrypts her emails to aunt celly.

How would this 'evidence' be treated then?

Actually...

[cr0sh]

The law is a vast, complicated subject, with many non-obvious doctrines.

One time a few years back I was given a ticket for speeding in California. I live in Arizona, and was returning from visiting a relative when I got the ticket. I was plainly in the wrong (I was speeding on the highway - however, it was one of those long lonely stretches in the desert between Yuma, AZ and BFE, California, with no other cars in sight - well, at least until I hit the speed trap under the overpass, of course) - but during the course of paying my fine (and doing an "online" drivers training course to keep the points off my record), I decided to look into the law I had violated...

To my disgust, as I was looking into the law - I found what "laws and statutes" really are:

SPAGHETTI CODE

There I was, looking at what appeared to be a set of functional code - but there was tons of "if-then"'s, the equivalents of "goto"'s, etc - if viewed as a piece of code, law would be the absolute worse piece of crufty legacy code there is! Couple this with the knowledge that there are tons of laws still on the book in all jurisdictions that have absolutely no bearing on current happennings (which could be analogous to old procedures in old code libraries/includes which are called only occasionally or never, in real code) - the fact that laymen can't understand it shouldn't be surprising.

What is surprising is a few things: that laymen can't use "ignorance" as a defense (though if as a layman you look at the law, it seems nearly impossible to make heads or tails out of it, even if you study it quite a bit, and of course case law -might- trump what you are reading, unless you know how to look that up, on and on and on...) - but further, that lawyers, judges, etc - ie, those who are charged with executing the law - actually make pretense at truely understanding it.

I submit that this is a lie, that these executors of the law are foisting upon us, the citizenry, a lie of monumental proportions - they act as arbitrators and interpretors of the laws, but I would be willing to bet that they are just or nearly as lost as we, the laymen, are.

Think about it: it is very nearly analogous to a large corporation with a a very old and crufty legacy COBOL-based computer software system, coupled with a 10Base2 twisted-pair network on an old IBM 360 mainframe running who-knows-what old incarnation of an OS - with a team of programmers, some old, most new - but even the old programmers were "newbies" when some of the last COBOL hacks were added, and the newer programmers are writing Java code to integrate with the legacy source - oh, and this system just happens to run a multi-national spread over 25 countries across the world.

Not one of those programmers could truthfully say they fully understand the system, and what effects adding a new piece of code or hack in will cause to the system as a whole. Not a single one of them could do it, and they couldn't even ask the original system developers, because most of them would be dead or senile, or otherwise unreachable (if anyone even knew who they were!).

The really sad part is that law, unlike code - can rarely be removed or otherwise refactored easily to see what that kind of a change would make. Most of the time, to fix a law, you have to cruft on more law, and hope that the "fix" doesn't break something else. Come to think of it - this is almost exactly like legacy code...

The only true way to fix it is to rip it all out and start over again with a fresh system - hopefully building on and learning from past mistakes and past poor procedures, so you don't repeat the problems. Unfortunately, what that means in law is revolution, typically armed, messy, and in more cases than not, the new system is a bigger broken mess than the old - rarely is it ever better.

Fittingly - just like replacing a legacy code system...

Sarbanes Oxley... Co-Conspirators?

[ginslinger]

Where I work, we are required to encrypt customer information, and financial data, to keep it from prying eyes. Does this make Sarbanes and Oxley co-conspirators in the child porn case? Just a thought...

Existence vs. Utilization

[v3xt0r]

U.S. Laws are too black & white IMO.

Having an encryption program on your computer is NOT illegal.

Utilizing that encryption program to encrypt 'illegal' data, or to use encrypted data for illegal purposes, IS illegal.

Unfortunatly, we leave our fate up to our peers (jurors), most of which would not understand the difference in this case, and would easily surcome to the evil intentions of the prosecution. =(

Or

[einhverfr]

Having a hunting rifle is evidence of criminal intent in a poaching case.

Or

Merely posessing a lawfully owned firearm is criminal intent in a murder case.

However, this only says that the prosecution can use this as evidence. I would hope that the defense was able to show to the jury why this was so silly.

However, in a case where this is appealed after the conviction, and where it is a comparitively minor piece of evidence, the court may have a vested interest in not allowing the defense to nitpick after the fact. I.e. that there is a much higher standard for challenging evidence after the verdict than before. This might be different if it was a central aspect of the case, I might think, but IANAL. I have not read the actual ruling, only the news.com summary. Given how often news magazines miss the point of the ruling, I am not taking this at face value.

Re:What would they say if everyone used encryption

[mpost4]

How would this 'evidence' be treated then?

Probably the same way that everyone with a gun is treated when there is a gun crime. The MN court said that encryption could be used as evidence, not that all encryption is 'evil.' I'd say you were overreacting, but that would be the understatement of the year.

Re:Good. Encryption is a tool too

[beej]

I could think up a punishment for child pornography that is too severe

You're absolutely right, of course. I just think that currently punishments are not on par with the damage done to the victim.

But yes, you caught me speaking a little over-the-top when I said that. :-)

law=argument=logic

[Anonymous Coward]

Perhaps those clamoring to educate the ignorant masses on encryption should take a couple seconds and just apply a little logic, which is supposed to be the strong suit of the visitors here, as well as the foundation for our legal system.

If I am busted for drugs and they happen to find a weapon in my home, this will most likely be ruled a mitigating factor somehow along the line. Particularly if we are talking about a distribution/trafficing offense.

You guys are WAY over-geeking it and not looking at it for what it is. If I am hired by, say an organization, to investigate someone who may or may not have illegal content on their HD and I boot 'er up and see an encryption app...

Slow down and take off the geek hat for a minute. Stop injecting your personal views and think with a little logic. The ruling is pretty obvious if we weren't talking about tech. So, why should it be different with tech?

The techies are to blame, not the judges

[typical]

Techies have had many, many opportunities to make encryption support easy to use and transparent in products, and it hasn't happened. If they had, lots of people would use encryption; because they haven't encryption can be used as a discriminating factor between the ordinary and the dubious.

Re:What would they say if everyone used encryption

[Sark666]

You miss my point, I don't think I'm overreacting. What I'm trying to say is if the courts pointed out that ahh look he has encryption, I'm saying in my situation it would be 'so what, doesn't everyone?'

Basically I think the courts made mention of encryption because in todays society it is something of note. I'm saying imagine everyone and I mean everyone used encryption. Then it would be like pointing out he has a telephone because it could be used to contact other pedophilers.

Do you see what I'm getting at now? I wouldn't think it would hold as much weight (or be something of note) if every person had encrypted file on every electronic device they had.

Because basically, right now they are inferring he has 'something to hide' by simply having encrypted files. That inference would be much more difficult if encryption was as commonplace as a telephone.

Re:After I had my laptop stolen, I lock it down mo

[pla]

directory where I save PDF shopping receipts

Directory where you... Save... PDF receipts?

Brilliant!

I would like to thank you. It never occurred to me to print my order confirmation pages to PDF. What a truly wonderful idea!

Well, it doesn't so much matter for myself, but if I can convince my SO to do that, I'll save a ream of paper per month. DAMN that girl can shop...

MOD PARENT DOWN!

[coopex]

FTA: "The court didn't say that police had unearthed any encrypted files or how it would view the use of standard software like OS X's FileVault. Rather, Levie's conviction was based on the in-person testimony of the girl who said she was paid to pose nude, coupled with the history of searches for "Lolitas" in Levie's Web browser.

Judge Thomas Bibus had convicted Levie of two counts of attempted use of a minor in a sexual performance and two counts of solicitation of a child to engage in sexual conduct. The appeals court reversed the two convictions for attempted use of a minor, upheld the two solicitation convictions, and sent the case back to Bibus for a new sentence."

So the only evidence against this man (that we know) is one exercpt from his browser history, and the uncredible testimony of a 9 year old. Remember the peoples lives damaged by satanic ritual abuse, when in fact "There is ample evidence that therapists and law enforcement personnel encourage and reward children for accepting the suggestions of bizarre abusive behavior". So unless there's some photos, anyone who wants this guy put away is an overemotional idiot that needs to learn the meaning of justice.

Re:MOD PARENT DOWN!

[coopex]

Sorry, meant to include a link Satanic Ritual Abuse Fraud.

Re:MOD PARENT DOWN!

[westlake]

the uncredible testimony of a 9 year old.

The eight year old Lake Worth Florida girl rescued earlier this week identified her attacker, who promptly confessed. Girl buried alive thanks God for rescue

In a criminal trial, the credibility of a witness is for the jury to decide. A judge will not disallow a child's testimony based on a claim that police elsewhere have rewarded children for claims of sexual abuse. You must make a persuasive showing that this child was psychologically manipulated.

Re:MOD PARENT DOWN!

[coopex]

The missing girl case is not an applicable analogy to this. In that case, there was the fact that she was buried alive. An analogy to this case would be if they found the supposed pictures. The link I forget to include and later posted talks about how in accusations such as this (like satanic ritual abuse) where there is no evidence but "he said she said", "There is ample evidence that therapists and law enforcement personnel encourage and reward children for accepting the suggestions of bizarre abusive behavior".

Does that clarify why the testimony is uncredible, given the limited information contained in the article?

Re:MOD PARENT DOWN!

[Anonymous Coward]

I was just watching the news the other day when they reported on a study done by the US military. Turns out that alert, healthy, competent adults were unable to positively identify their assailants most of the time. In fact, the method used to try and identify the assailant can completely overwrite the memory of the actual assailant. Participants in the trials were often mistaken on the gender and/or race of the perpetrator. Actual positive identification occurred less than 20% of the time.

Re:What would they say if everyone used encryption

[praxis]

Or look at locks. Would a judge also say that someone who locked their door has "criminal intent"?

MOD PARENT UP

[srw]

Someone please mod this up. This is the best explanation I've seen here yet.

Re:Won't somebody PLEASE think of the children????

[budgenator]

From TFA

"Levie's conviction was based on the in-person testimony of the girl who said she was paid to pose nude, coupled with the history of searches for "Lolitas" in Levie's Web browser."

The reality is that he is convicted, and apparently based solely on the word of one 9 year old, and search history on his browser for a uncommon name. Given the current political climate, if a underage person says your guilty of being a pedophile, unless you have the resources of Jacko, you might as well just kiss your ass goodbye,
no physical evidence required,
no resonably consistant story from the victim,
no corroborative testimony,
just a possible life imprisonment, and if you do manage to get released, your name on the sex-offenders list forever.

At least Cotton Mather isn't burn them at the stake anymore.

Re:What would they say if everyone used encryption

[mpost4]

What I'm trying to say is if the courts pointed out that ahh look he has encryption, I'm saying in my situation it would be 'so what, doesn't everyone?'

That's like telling me that when I commit a gun crime, and the prosecutor wants to put the gun with my fingerprints and gunpowder on it into evidence, I should object with the argument that "everyone" has a gun.

The courts aren't stupid. If the gun or encryption was used in the process of a crime, then it is going to be evidence. Regardless of how many other people might have a gun or encryption.

Now, if the court would say that since he had encryption on the computer, that is enough for a conviction, I would be concerned. But, if you read the article, you'll find that encryption was not the basis of the conviction.

Rather, Levie's conviction was based on the in-person testimony of the girl who said she was paid to pose nude, coupled with the history of searches for "Lolitas" in Levie's Web browser.

Because basically, right now they are inferring he has 'something to hide' by simply having encrypted files. That inference would be much more difficult if encryption was as commonplace as a telephone.

No, they are infering that he has something to hide because he paid a girl to pose nude. And had a history searches for "Lolitas." And that has squat to do with how many people use encryption.

Ha! I fully expected that.

[coopex]

Now your chief weapon is only fear... fear andruthless efficiency... ruthless efficiency and fear.... Our two weapons are fear and ruthless efficiency... and an almost fanatical devotion to the Pope.... Our three... no... Amongst our weapons... Amongst our weaponry... are such elements as fear, surprise... I'll come in again.

Wait, wait...

[solios]

Doesn't this make anyone running linux, OS X, or OS 9 (Finder-level 128-bit encryption) potential criminals? :P

Re:After I had my laptop stolen, I lock it down mo

[swv3752]

On older Sony notebooks the bios password reset was a Public/Private key with the notebooks's serial number as the public key.

I helped a friend with his old vaio that had been sitting idle for a while and he forgot the password. it was a pita to fax in a receipt then he had to pay $25 for some dude in India to transfer him to some guy in Florida to take his serial number and tell him a 7 digit code.

Door locks

[starX]

Couldn't having a lock on your door be admitted as evidence of wrong doing by logical extension?

Ah, the jerking knees....

[eweaver]

Ah, the jerking knees....

Re:After I had my laptop stolen, I lock it down mo

[quantum bit]

Sure, just put

gbde_swap_enable="YES"

into your /etc/rc.conf. Then in your /etc/fstab, stick a .bde at the end of the swap devices you want to encrypt. For example, if you have

/dev/ad0s1b none swap sw 0 0

change it to

/dev/ad0s1b.bde none swap sw 0 0

Nothing new

[bored]

Having a flashligh, crowbar and gloves in a car was enough to get a friend of mine taken to jail on some charge like felony posssion of buglary tools 10 years ago. Doesn't matter there was a toolbox full of other crap. The combination of the three was enough trigger some stupid law. He got out of it but thats not the point...

Re:After I had my laptop stolen, I lock it down mo

[hawk]

ahh. Thanks.

hawk

Before you jump off the handle

[ACNiel]

Owning a crowbar is not illegal.

Having a crowbar in your posession isn't illegal.

Having a crowbar in your posession half a block from a house that was just broken into with a crowbar becomes relevant to the states case, and is no longer simple coincidence.

It can't be supressed as evidence. That is all, nothing to see here.

What they will try to do is, not villify him for having the software, but show that he encrypted pictures with it because he KNEW they were illegal. It shows his INTENT. If he has nudies that aren't illegal and unencrypted, and nudies that are illegal, and are encrypted, then he can't say that he didn't realize they were illegal, his actions show he had at least a suspision.

Anyone that has a webbrowser has encryption software if it supports SSL or TLS. He is not being punished for having PGP. His use of PGP indicates he new something was wrong. It isn't a single piece of evidence to hang him with, but piece of a puzzle.

Smaller, simpler alternatives to PGP/GPG....

[iamcf13]

These alternatives have been proven to be secure, likely just as secure as the 'big boys' like PGP and GPG.

Enjoy!

Tiny Encryption Algorithm

Pure Crypto Project

CipherSaber (CAUTION: uses RSA's 'cracked' RC4 algorithm)

Re:What would they say if everyone used encryption

[Anonymous Coward]

I'm saying imagine everyone and I mean everyone used encryption. Then it would be like pointing out he has a telephone because it could be used to contact other pedophilers.

Do you see what I'm getting at now?

Weird Man: Before you die, let me show you the things that I've done, so you will understand the breadth of my transformation! [starts up a slideshow projector] This... is me at the grand canyon. [shows a shot of him there] Do you see? This is me at Mount Rushmore [the next picture is shown, with him looking lovingly at the faces there] Do you see?
Cartman: [nervously] Heheh.
Weird Man: Do you see??
Cartman: Yes yes, I see! [another Mount Rushmore picture is shown, with the man looking at the camera this time]
Weird Man: Here I am at the Alamo in San Antonio. [this time he looks psychotic, with his hands ready to grab something] This was just outside of the gift shop. Do you see??
Cartman: AAAAAAAH!

Re:After I had my laptop stolen, I lock it down mo

[steve_l]

I dont work with them; I work in the same corporate R&D lab. big difference. I dont believe in TCB, I dont believe in DRM. I dont think anyone here believes that real DRM is workable.

But you are right, TCB could be used for ubiquitous DRM, and that would be wrong. I guess now I am lucky in that the OS (winXP) doesnt know about the TCB; its some helper device driver that just stores my keys. Longhorn would be a different matter.

yeah, I meant bios passwd

[steve_l]

they meant bios passwords. Implict was the idea that people stealing the laptops are drug addicts wanting to get enough for the nights fix. Anything that reduces the value of the laptop helps.

The laptop integrates with secured HDD drives; these need a supplied password to start working properly; you set it up so the BIOS password powers both. If the password is stored on the disk, it should be pretty persistent, leaving only brute force attacks.

It gets worse...

[Anonymous Coward]

just anger a psychologist one day, and you may find yourself locked up for the rest of your natural life, "for your own good"...

It's so bad that criminals would rather go to jail than plead insanity; they can get out of jail...
--
AC

Re:Don't worry (if you're not a child pornographer

[Ph33r th3 g(O)at]

(Disclaimer: I'm a programmer at Guidance Software, and work on EnCase.)

. . .

I have and use PGP and have no fear that it'll ever be used as evidence against me.

Yep, I imagine you don't :).

Of course, the prosecution would just argue that you used your expertise and inside knowledge of forensic software to hide your child porn so well that none could be found on your drive. However, the logs that might be used to frame you could be pretty damning . . .

"He was using encryption, so he must have something to hide" as an argument for the prosecution is another nail in the (admittedly already pretty much shut) Fourth Amendment's coffin.

Read The Fine Appeals Court Decision (RTFACD)

[TheCubic]

(copied from my post to a list)
First, read the opinion before the paranoia/speculation:
http://caselaw.lp.findlaw.com/scripts/getcase.pl?c ourt=mn&vol=apppub/0505/opa040381-0503&invol=1

The news.com article takes it out of context - the finding is that the
existence of an encryption program is relevant. Not damning, not
exonerating, just relevant - and personally I'm of the belief that encryption
software is a relevant issue when digital kiddie porn is the subject. This
does nothing to tie encryption with conviction - as shown by the opinion that
encryption was not very substantive to the case against him.

This is not a precedent, for many, many reasons. /MN resident

//knows what the hell he's talking about

encrypt

[Anonymous Coward]

so let me get this straight...i have nmap, snort, ethereal, and several, several others...plus encrypt software, keyloggers, and all sorts of others....am i guilty of hacking, or just a comp science major?

Evidence shouldn't have been admitted

[Anonymous Coward]

Many people have made good points on both sides, and are right I believe to a certain extent. Here is my take.

Had the prosecution shown that encryption was selectively (this word is important!) used to encrypt the pornography, this would have shown intent to hide a criminal act. However, since no evidence was found that showed the encryption being used even at all apparently, the connection no longer becomes valid. To further extend, had encryption been in use on his computer, but used for everything, this also shouldn't be allowed. This would be similar to a bank robber hiding stolen money under a mattress. If the rest of his money was never stored under a mattress, you could show that hiding the stolen money under the mattress was an obvious attempt to hide the money. However, if he always kept his money under the mattress, stolen or not, then the presence of stolen money under a mattress would present no further evidence for use against the robber.

So, the presence alone means nothing. The presence, combined with specific use of the software in such a way that reveals a certain intent, can mean something. All about intent. Was the software just coincidentally there, or was the software used as a means to conceal illegal activities? In this case, it appears to have only been a coincidence.

Laywer use != evil

[abb3w]

I see it as an extension of basic evidence rules -- if there is other evidence suggesting you have bad files and you have intentionally made those file unreadable, the tools you used to do that are possibly relevant.

The problem with this line of arguement is that this is not the only use for such tools. I have the GPG version of PGP on my home and work systems. At home, I use it for encrypting backup copies of my financial records, tax forms, old love letters (yes, the girls were of legal age, they're just embarrasing), and various files associated with my participation in local politics. At work, since I know there is at least some legally protected data on the machine, I have departmental computers backup local desktops to internal hard drives, and then encrypt the backup files whem putting them on the server.

Kind of like pointing out the defendant owned a shredder, there was huge pile of shredded paper by it, and the "smoking gun" documents are no where to be found.

Agreed... but it does not appear that the "huge pile of shredded paper" is present. Normal use of GPG or PGP to erase files leaves portions of the drive with data sectors showing either VERY high entropy, OR purely "zeroed". No mention of such evidence is in the news reports or ruling.

Last, it doesn't exactly sound like PGP was a "factor in his punishment". Rather, it sounds like it was a factor in his conviction. If the court had ruled that the evidence was inadmissible, then a new trial might have been ordered. This would require a finding that the irrelevant evidence was prejudicial enough that it could have formed a basis for the conviction. If the error was not considered substantial, then no new trial would have been ordered.

However, if the error was not considered substantial, the appeals court ruling would have said so; and if they had so ruled, or had ruled for it being inadmissable, there would be much less to this story. Instead, the ruling states "the presence of an encryption program on his computer was relevant to the state's case".

It's bothersome that the idiot testifying didn't know diddly about computers. Macs do NOT come with PGP or GPG installed by default. The FileVault system on OS X.3+ is based on AES-128, an algorithm whose main (sole?) similarity is that it cannot be decrypted by anyone short of the NSA. For that matter, Windows 2K and XP with EFS, based DESX... which probably can't be broken by anyone not willing to buy over ten megabucks of hardware for such jobs.

I also find it worrisome that it was admitted to evidence that he looked up on the web the definition of the crime he was accused of, as that would seem to weaken the right to counsel. Fortunately, that was not part of the basis of his appeal.

eh?

[chucken]

Read the actual opinion here - where does it says that the existance of PGP on his computer constituted criminal intent? It doesn't. It says that the existance of PGP "was at least somewhat relevant" but that the other evidence , PGP aside, was enough to convict.

Encryption IS evil

[XyborX]

.. but only if you forget your password