Slashdot Mirror
Encryption Passphrase Protected by the 5th Amendment
Takichi writes "A federal judge in Vermont has ruled that prosecutors can't force the defendant to divulge his PGP passphrase. The ruling was given on the basis that the passphrase is protected under the 5th amendment to the United States Constitution (protection against self-incrimination)." The question comes down to, is your password the contents of your brain, or the keys to a safe.
So.... this tells me two things... first, that the government cannot force you to give up your PGP passphrase.... but possibly more important, the government (currently) cannot break PGP encryptopn.
Hmmm....
If the passphrase is considered keys to a safe, and you are therefore likely to be forced to divulge it, then you can avoid trouble by using an encryption system, like TrueCrypt, that supports plausible deniability. Inside the encrypted volume, blank space is always filled with random data, which can also be another nested encrypted volume. Without the correct passphrase, nobody can prove that the random bits are anything more than random bits.
I had a hard time deciding whether to reply to your comment or moderate it "interesting." I emphatically disagree with your post, but you make a good point. True, forcing defendants to give up their encryption keys would result in more convictions.
But as a society, we place a higher priority in personal liberty than on catching the maximum number of criminals. There are states that invert these two concepts: we call them "police states". I, for one, would rather live in a society where a few guilty people walk free because we can't crack their encryption than live in one where I can hide nothing from the government. It's a question of priorities.
Botnets cannot break decent encryption either.
What a lot of people fail to realise is that encryption can be made unbreakable even by brute force by simply choosing a large enough encryption key. What people also fail to realise is that 256 bit encryption doesn't take twice as long to crack as 128 bit encryption. It in fact takes 2^128 times as long to crack.
Let's for a second assume that 128 bit encryption is crackable by your own personal home computer in a period of 1 hour.
136 bit encryption would take 2^8 times as long (250 times as long)... so we use 250 computers, and crack it in 1 hour still.
144 bit encryption takes again 250 times as long, so instead we use 250 superpowerful server computers and crack it in 1 hour.
156 bit encryption takes another 250 times longer, so we use a top-secret government super computer the size of the Pentagon and still crack it in 1 hour.
164 bit encryption takes.. you guess it, 250 times longer to crack. All the governments in the world pool their top-secret super computers and crack your content in.. 1 hour.
172 bit encryption takes 250 times longer to crack. We use all the computers on the entire planet and manage to crack it in 1 hour.
180 bit encryption takes 250 times longer to crack. We use all those computers, but let them run 250 hours (10 days) instead.
188 bit encryption takes 250 times longer to crack. We let those computers run 6 years to crack your password.
192 bit encryption takes 250 times longer to crack... never mind, we're not THAT interested in your personal photo album.
The Law blocking a criminal investigation thing stems from years of torture to confess something. The Salem witch trials and the Spanish inquisition would be a classic example but there are others directly related to the struggles between colonist and England as well as examples outside US history. the person was tortured or otherwise compelled into admitting guilt- Whether they were guilty or not.
Basically, if you have the right to not incriminate yourself, then they can't force you to "confess". And if it happens, then any convictions should be turned over by a higher courts assuming that things go according to plan. This also carries the problem of blocking a criminal investigation but the necessity of not being forced to confess out ways the setback to criminal investigations. Many people support this idea if not simply because they don't want the cops showing up at their front door demanding you to tell them something you did that was illegal and later claiming it was part of an investigation.
As for me, I think it is a necessary evil that protects people in many ways above any benefit from a criminal investigation. If there is sufficient cause for the criminal investigation, then there will be other evidence outside that aspect that will eventually show up if it isn't already there.
One way they get around the 5th amendment is to grant immunity from prosecution for anything found or disclosed which seems to have the same effect of the 5th amendment. Something like that would be useful in convicting others involved by letting one person escape justice.
The point is the government has no business prying into the personal affairs of its citizens. The reason for the the 4th and 5th Amendments to the Constitution and the requiring of warrants to perform a search is to prevent government intrusion by over zealous government officials. Unfortunately, today more and more people believe that security is more important than liberty. Too many have forgotten, or perhaps never really been taught by our 'government schools', why our forefathers fought the American Revolution. Taxation without representation was a minor difficulty, compared to the injustices that were perpetrated by the English troops and King's Representatives that were stationed in the Colonies. Searches and seizures that were illegal by English law occurred daily. Imprisonment without trial, sometimes for years, was common. Basic rights that were afforded to all the Kings subjects in England by the Magna Carta and all subsequent English law were not afforded citizens of the American Colonies simply because they did not live in England.
Unfortunately this situation is becoming more and more common in the practice of law today. For example, imprisoning someone for "contempt" is unjust. Where is the accused's right to a trial? There is none. What about appeals? There are none, you are in jail until you grovel enough to satisfy judge. No evidence...no trial...just the judge's opinion. God forbid you ever have to stand in front of a judge who decides to grind his ax on your ass.
Back about 40-50 years ago, law enforcement and prosecutors could be held liable for misconduct. Then came the so called "shield" laws, which gave immunity to prosecutors and law enforcement in the event of misconduct. We are finally seeing the result of these 'fine' laws; Convictions being overturned because of fabricated evidence, withheld evidence, and tampering of witnesses by officers of the court. Peoples lives are being ruined because some court officers feel it is more important to get a conviction at all costs, instead of by the weight of the evidence. These 'shield' laws protect the wrong doer from any kind of repercussion. Nifong, of the Duke rape case infamy, is an exception to this, mostly because he was so vocal about the case, calling national attention to the case. However, while his career is in shambles, he has yet to pay any restitution to the boys he so vehemently accused, or face perjury charges for the false claims he made in court.
All in all, there are a lot of reasons to keep government out of the personal affairs of it people.
SELECT * FROM User WHERE Clue > 0
0 rows returned
It's more then just confessions. The police can't decide you are a thief and then ransack your house on the hopes of finding something stolen. When they search they have to know what they are looking for, and have reason to believe that they will find it.
Here they are saying that he has files that they know nothing about. Because those files are unknown, he is protected from having to provide them.
Thinking about it, I'm surprised that we haven't heard of cases getting thrown out because of computer evidence collected outside of the scope of any search warrant poisoning too much of the subsequent evidence. I could imagine a warrant to look on your computer for a warez program they think you have turning up an ssh known_hosts file entry for a warez server. Since they weren't looking for that evidence (maybe because they thought the computer had not been networked, or was not involved in warez transmission, just storage) then they can't use it, and if they then go hunting the logs of that remote server to find the connection that can't be used either because it was evidence they only knew to look for because of evidence they weren't allowed to have anyway. And because you can't un-know information once you have tainted evidence you have to show that any subsequently gathered evidence did not come from knowledge of that evidence or at least would have eventually been discovered by other means.
However I must offer the following disclaimer: I am not a lawyer (nor do I do anal like so many of you non-lawyers), but I have watched a lot of Law & Order. Disclaimer: Not being a lawyer, much