Slashdot Mirror
Defendant Ordered To Decrypt Laptop Claims She Had Forgotten Password
wiedzmin writes "A Colorado woman that was ordered by a federal judge to decrypt her laptop hard-drive for police last month, appears to have forgotten her password. If she does not remember the password by month's end, as ordered, she could be held in contempt and jailed until she complies. It appears that bad memory is now a federal offense."
The article clarifies that her lawyer stated she may have forgotten the password; they haven't offered that as a defense in court yet.
If it works in a congressional hearing investigating potential ethics violations of the Attorney General, why not in a court of law?
How can this woman be charged with contempt? Is there precedent in law to ignore the Fifth Amendment?
No person shall... be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.
I often can't remember my password after a week away from the office on holiday. (And we have quite lax policies regarding passwords, no time, lenght or content limits, so I have a fairly easy one I've been using for months....) I might be hard pressed to remember a password after a month, under dures.s
...you should put all the juicy stuff in plain sight on your harddisk. Then encrypt the stuff you don't care about. When the authorities finally get the password out of you, at least you'll have the satisfaction of confounding them.
I was about to mod your post, but then I realized there's no "Obligatory" option.
There's no -1 for "I don't get it."
Let me ask this (and display my ignorance): If I had a safe and a judge ordered it opened, and I claimed I'd lost the key, would I be held in contempt? Or would it just be forced open? Would this ever see the courtroom at all? Can lawful seizure require active participation of the accused?
If I claim to no longer be in possession of a piece of evidence, and don't know were it is, could I be held in contempt? Couldn't I plead the fifth? "You want to convict me? You go find it."
I'm trying to figure out the stare decisis on this topic (equal and consistent application of the law). It just seems so darn inconsistent.
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
In the UK it works like this: If the prosecution can show that you probably know the password then you can go to jail for up to two years for refusing to give it. The burden of proof appears to be lower than the usual "beyond reasonable doubt" that is normally required, and evidence can be highly circumstantial. For example if you decrypted the data the day before you get arrested they could say you must know it, even if you happened to wipe the key or change the password or just genuinely forgot since. Justice is slow in the UK so it could easily be 6+ months before you are even asked.
The stupidest part is that going to jail for two years and having the conviction expire (so you no longer have to declare it when applying for a job) after a few more years is infinitely preferable to, say, going down for 20 years on terrorism or being put on the Sex Offenders Register for life. It seems almost like a conciliation prize for the police when they have failed to gather any other evidence and would otherwise have to let the suspect go.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Well I'm glad that you released your brilliant plan on a public forum where said law enforcement agents surely wouldn't look.
You mean for the corporation people or the people people?
wish the myth of changing passwords regularly would die.
A search warrant does not require participation of the defendant. Neither would them cracking the encryption. It crossed the line into a constitutional violation when you begin to threaten people for not aiding their own prosecution: such as requiring someone to disclose the location of incriminating documents, or giving up passwords to encryption keys.
This is little different than demanding that someone accused of a murder disclose the location of the body, or be held in contempt of court: you cannot win either way. Therefore, it is unconstitutional, not a "legitimate legal process." Even were it considered such by the legal system - which it is not - it would still be unconstitutional and a violation of civil rights in need of correction.
You might consider it reasonable, but I think the fact it is possible to easily forget something like a password makes it unreasonable even if there were any sound arguments for violating the 5th.
Great Intellect...
If this stands it means that anyone can be detained indefinitely without trial. All they have to say is "We believe this file is encrypted using stenography, give us the password" and since saying you don't know equals contempt of court tada! Instant disappearing person. Hell with most geeks they wouldn't even have to go that far, how many of you have truecrypt on some disc somewhere? all they'd have to say is "The defendant has truecrypt in his possession and we believe he has a hidden volume, give us the password' and tada! Bye bye geek. don't say it couldn't happen because it wasn't too long ago most of us would have never believed the USA would have free speech zones and rendition taxis either.
Kinda sad that after we spent all those years supposedly fighting the USSR because of freedom the wall falls only for us to slowly but surely become like the USSR.
ACs don't waste your time replying, your posts are never seen by me.
I was the only person to know the password to my old computer's login - no longer have any idea what it was. I figure I will just reformat it or bypass the login if I have a need to use it.
However, if it was encrypted, I would currently have a legal timebomb sitting on my desk. This is not right and is clearly unconstitutional. Dressing up the matter does not change that.
Great Intellect...
The laptop was seized in 2010, the order to decrypt is from 2012. I have passwords long enough that I will have trouble remembering them after 2-3 months of not using them. (Happens very rarely.) Not using them for over a year could well make me unable to remember them at all. So I would consider this a real possibility. Not absolute certain, of course, but credible enough that asserting she does still know the password after not having used it for this long would be an unfair disadvantage to her, as she fundamentally cannot prove she does not remember it.
Now the way around this for future cases is key-escrow or requiring everybody to write down their passwords, with the attached huge negative effects. In any sane legislation you can just refuse to give a password. I am amazed that in the self-proclaimed "land of the free" this does not seem to be the case and hope this will just turn out to be a judge that does not understand the issue and will get fixed permanently by a higher court.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The password is R4ndumbG1bb3r1s# - but I stored the keyfile on megaupload.
The concept of innocent until proven guilty is widely misunderstood. It is the obligation of the jury to presume innocence. Nobody else. Not the prosecution. Not the police. Not the accuser. If it were their obligation, nobody would be charged with anything ever.
Goddammit, I'm undoing my mods to post this since you're just blatantly misinformed - and I know you're not the only one. With the exception of a few highly restrictive states like California, New York, New Jersey, Massachusetts, Illinois, and the non-state of D.C., you can own pretty much anything you want (though due to the Hughes amendment, machine guns must be made prior to 1986). It's a common misconception that silencers, real assault rifles (meaning that you can select between semi-auto and full auto and / or burst fire), machine guns, explosives, rocket launchers, etc are illegal in the US. They're not, you simply have to jump through some hoops to get them, but if you can legally buy a gun, you can legally obtain an NFA (read: restricted) item just fine. It just requires more paperwork, a $200 fee to the ATF for a tax stamp certifying that you legally own the item, and waiting a few months for the ATF to drag their feet on processing the paperwork. Silencers are pretty cheap even - it depends on the caliber, but $800 is a pretty common price. Machine gun prices / real assault rifle prices are artificially inflated by the government though due to the post-1986 ban so a gun that should cost about $2,000 will end up costing more like $15,000 due to the artificial scarcity. Hopefully we can get that fixed one of these days....
Oh, as for "No one sane is going to take on anything with a semi-automatic rifle", the majority of the time the military doesn't even flip their rifles (well, usually carbines to be exact) to burst fire / full auto because it's very hard to control and you burn through your ammo a lot faster without being more effective. As for US citizens being able to fight back against the military? The US military has roughly 3 million soldiers (this counts desk jockeys and members of the reserve as well as the coast guard and national guard) and we'll round up and say 1 million police officers / federal agents (again, counting desk jockeys). The LOW estimate for the number of gun owners in the US is 40 million people with about 90 guns in private hands per 100 people in the country (that includes children), so not only is there a large abundance of weapons and ammo in private hands, but private citizens who own guns outnumber the police and military by around 10 to 1. Sure, they have tanks and bombers, but unless they REALLY wanted to destroy their own infrastructure and a lot of non-combatants on their own side, they wouldn't use them (because even if they won, the country would be totally FUBAR'd for decades).
Note: I'm not promoting or hoping for any conflict between citizens and the military - merely stating some facts regarding the number of people on each side (assuming gun owners all sided together) and how well equipped they are.
"The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants." ~Thomas Jefferson
No, if they could prove that you knew the password, you could be held in contempt. When you are in court, you are required to present requested evidence. For example, if they know you have the body, you can be compelled to present it. Of course, if they knew you had it, that'd mean they knew where it was, so they wouldn't need to ask for it.
A better analogy would be legal documents which were lost. They knew you had them at one time, but how can they really prove you still have them? Obviously, you can't produce something if you are no longer in possession of it, and they can't hold you in contempt for that.
And when the filesystem history of your PC shows logs of you inserting that serial-numbered USB key into your PC last week, and using filesystem encryption tools to access it? And sure, you can combat that, but there's always another way to get caught out that you might not have considered. Hell, they can probably tell you the last time you touched the device itself, or inserted it, and into what computer you inserted it by various bog-standard forensic evidence (scratches on the USB connector, fingerprints, etc.).
You don't even know if they haven't been *watching* you insert that USB key by that point (and if they've raided you, there's a good chance they *have* been watching first). They won't tell you that until AFTER you've already denied ever knowing where it was. You've just stamped "guilty" on your own head by being a smartarse.
You can be a smartarse if you really want to, but nothing in the world is clever enough to stop "reasonable doubt" when you play games like that, especially if you're that confrontational. All that will do is make them WANT to put you away rather than plant doubt in their heads.
After a police raid, they'll just have all your possessions. Sure, it'll take a while to catalogue them all but they will. They actually have to. Not only that, they'll know the serial number of every one and maybe even the purchase origin. While you're sitting in an interview room being a smartarse, they're sending out court orders based on your PC and ISP evidence and forensically recording your Slashdot comments (and the above, in the wrong context, could be enough to convict you even in ten years time if that DOES happen!).
You missed the whole point of the article - the US, and the UK, have laws that if they even THINK you really have the key and haven't forgotten it, they'll throw you in a cell until you remember. Be as smart-arse as you like but people have already been convicted and jailed over it because of "reasonable doubt" that they weren't innocent. The law is there, it's written, it's enforceable (whether it's SENSIBLE is another matter and one that takes decades to argue in court) and if they suspect for a moment that you're being a smartarse, they'll use it.
This is how the law works. If you're stopped by a policeman in the UK, he'll pay you zero attention if you're polite, genuine, "I know, officer, I was speeding. It's a fair cop." about it. Start being pricky towards them for no reason and they'll have you for your tyre wear, the rear light, the slightly-covered number plate, look up your insurance, your license, run a check on your name, look through the car for anything you shouldn't have, etc.
It has to be said that it's not an unsuccessful method of law enforcement and anyone with brain enough to be respectful and polite and co-operative will "get away" with things that the idiots who's taking their badge number and threatening them won't. The same applies from the police up to the courts. Hire a good lawyer, be co-operative and polite, play by the rules and you'll get the best result. Be pricky about it and they'll do what they can to dig deeper and inconvenience you.
I can think of ways you could reasonably consider to have good reason to have lots of encrypted USB sticks about that you don't know the passwords too. But being the smartarse will end up with you in jail, whether you "did" anything or not. You can argue about it as much as you like but if the judge takes a dislike to your attitude or methods, they'll put you away at least until your successful appeal.
What do you do? You provide all the information you have and be as co-operative as possible. Why? The laws on that are worded so that co-operation is the better of the two options so that you're *forced* to co-operate or go to jail.
You can argue about self-incrimination, free-speech, etc. afterwards - when the judge KNOWS that you've been 100% co-operative. You can still have evidence stricken, ask for a mis-trial, appeal, etc. but you've been co-ope
Your premise is ridiculous, as the court can reasonably assume that you intended to use said encrypted file, and thus pointing to random password generators for the password doesn't cut it because *you* need the password set to use it. Your solution doesn't accomplish anything other than looking stupid here and probably getting your arse handed to you by a judge.
If you are willing to take the legal ramifications for your "honeypot", then go for it, but don't expect a judge to accept your claim as true and leave you alone.
I don't remember any of my passwords. They are muscle memory. If I don't use them, in a week or two they are gone.
Now consider that they took the laptop away from her, preventing her from using it...
Realities just a bunch of bits.
Their assumption may be worth shit, but "contempt of court" has no upper limit on how long you can be held for.
https://en.wikipedia.org/wiki/H._Beatty_Chadwick
Feel like spending the next 1.5 decades in prison, just to wave your dick at the court? Your call man.
Perhaps her password was "ICantRemember".
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
In any conflict of such an magnitude, where the US military is outnumbered, things like logistics, troop movements and proper command structure will play a MUCH more important role than what guns the each side has. You can't really argue that a rag-tag militia can compete with a trained army in these aspects.
Now, guerilla warfare is a completelly different matter, of course.
the one fact you did not raise.
In any armed uprising in the United States your bound to have many of those military and police on the side of those resisting the government. Having been in the military and know friends still in it, there is America and there is the Government. You serve the later versus foreign enemies, your serve the former at all times.
* Winners compare their achievements to their goals, losers compare theirs to that of others.
Nineteen hijackers and a couple of middle-aged rich kids with daddy issues managed to drag hundreds of thousands of highly-trained military personnel and a couple trillions dollars into a ten-year conflict that killed thousands of people, sent one country back to the stone age, destabilized another, and undermined the basic constitutional underpinnings of the most powerful country on Earth. And it still isn't even clear who "won." I don't think you can predict these sort of things based purely on the number of things or people on each side.
Actually, I wrote my thesis on life experience.
You mean like the insurgents in Iraq who have killed about 5,000 US troops despite being out-gunned, out-numbered and not having the same training as our soldiers? You forget that many of the civilians in that "rag-tag militia" are also US military veterans and have the same training and even more combat exposure than many active duty soldiers. Many of our veterans have a hell of a lot more practical combat skills and experience than our police; the average infantry veteran is easily at the same level as a SWAT officer. In an open fighting, the police would get their asses kicked two ways to Sunday and back by armed veterans who meant business.
We encrypted our employee laptops with truecrypt. The passwords where 10 character and phonetic. I wrote a small database program that allowed us to keep the recovery iso and the password stored for every laptop in case of a problem. We also required them to physically see us to get their password if it was lost.
After about 6 months of constant streams of people coming in to get their password, suddenly people stopped asking. A week later we started finding passwords taped to the bottom of every laptop we were servicing.
So in a nut shell 300 people can't remember passwords that are not their wives names, birth dates, or the name of a pet.
Isn't it just way simpler to divide the nation into 2 ideological factions and raise enmity between them to avoid a unified front against organized forces?
oh wait...
"Science can amuse and fascinate us all, but it is engineering that changes the world. " - Asimov.
They don't need to "win." The US military isn't going to simply destroy its own entire nation to "win." There only needs to be enough resistance to force the government to significantly change policies, and that would be relatively easy given the level of armament in private hands.
Also understand that the US military is made up of volunteer civilians. Sure, some in the US military will be willing to fire on US citizens, but I seriously doubt that number will be more than half. While I don't expect a lot of grunts shooting their officers, I would expect an awful lot to not return from guard duty.
There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.