Slashdot Mirror
US Appeals Court Upholds Suspect's Right To Refuse Decryption
An anonymous reader writes "The U.S. 11th Circuit Court of Appeals has found that forcing a suspect to decrypt his hard drive when the government did not already know what it contained would violate his 5th Amendment rights. According to Orin Kerr of the Volohk Conspiracy, 'the court's analysis (PDF) isn't inconsistent with Boucher and Fricosu, the two district court cases on 5th Amendment limits on decryption. In both of those prior cases, the district courts merely held on the facts of the case that the testimony was a foregone conclusion.'"
No self-respecting tyrant would try to attack your rights without an excellent strawman. In your example, the scumbag is the strawman.
So the government just have to say: we know that you harddrive contains X, and they force you to decrypt it.
Of course, when it is decrypted and it turns out that it didn't contain X, they will just say... sorry!
Let's say, hypothetically, John Doe gets brought up on child pornography possession charges. He has one computer in his home, and the cops are reasonably sure that said porn was accessed and stored at that physical location only. They order him to decrypt his hard drive, because they know it has evidence of his illegal porn habits. He replies, "No it doesn't. It has other stuff. Stuff you don't know about. You can't see it."
Now, they could say that they know for certain that he's a lying sack of crap and force him to decrypt it anyway. No child porn evidence, but he's be embezzling from his company, according to what they find. Now what?
Yes. If the government knows your have child porn on your computer, then they can get a warrant to force decryption.
If they know, that implies they can prove it, and if they can prove it they don't need to decrypt it!
Eclectic beats from Leeds, UK
handmadehands.co.uk
You have the right to remain silent. You have the right to remain encrypted. Anything you say, do, or decrypt can and will be held against you in a court of law. You have the right to speak to an attorney. If you cannot afford an attorney, one will be appointed for you. Do you understand these rights as they have been read to you?
"I don't think it's selfish, to eat defenseless shellfish." -NOFX
To use the GP's analogy, if your garage smells like rotting corpse, a judge will issue a warrant forcing you to unlock your garage door. That does not imply the police (or judge) knows you've been summoning Cthulhu.
Similarly, if your name/handle/URLID comes up in a money laundering probe*, that might be probable cause to force decryption even if it hasn't been proven that you've been using that particular drive. In any sane jurisdiction, any evidence uncovered during such a probe can not be used to file unrelated charges.
* or any other terrorist-like act that may or may not involve minors
Her rights don't depend on you being more or less annoyed at what she's alleged to have done.
That what governments have always done - relied on the ignorance of the populace to usurp the rights of the unpopular to establish a precedent that's eventually used against others.
An excellent point, but not relevant here. However, in the United States, searches can be with a warrant issued "upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." Allegations can be supported by Oath, e.g. several friends and family members say they saw child porn on your laptop. Allegations can be supported by affirmation, e.g. they set up a sting operation whereby they do, in fact, know that at one time a computer in your house had downloaded child porn. But being very certain that it was downloaded onto a machine in the house just isn't the same as knowing on what machine and by whom. It also isn't the same thing as knowing it is still there. Finally, the burden of proof you mention isn't required until any subsequent trial.
That depends on how specific you need to be.
We "know" you have money hidden in that off shore account. We know you have your pgp private key on your hard disk. We need you decrypt the hard disk so we can decrypt the message from the bank we intercepted using the pgp key.
They know the key is there, they don't know what the key is; so yes they need you to decrypt it. I think this is actually a pretty reasonable ruling. It treats an encrypted hard disk just like we treat a safe in the physical world.
The government can compel you to open it If they can name something specif they are looking for inside and show that its reasonably likely to be there. They can't do it just because. If they don't have any evidence to show your computer was used in the crime you are being charged with and there is likely very specific evidence they expect find on it they can't make you decrypt it just to go fishing.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
I'm aware of that. It's a really bad decision. If the officer's testimony that the documents existed was sufficient to prove that the documents existed, the jury should be satisfied without seeing the documents. If the testimony of the officers was insufficient to convince the jury that the documents existed, then there is no foregone conclusion at all.
The decision is facially nonsensical. The judge fails not just at applying the constitution, but basic logic.
Give me Classic Slashdot or give me death!
Is there an encryption system available where if you put in a specifically bad password it damages the data forever?
I have no interest in kiddie porn but I sure as shit don't agree with people forcing me to decrypt.
Except that an encrypted hard disk is not just like a safe in the physical world.
Give me Classic Slashdot or give me death!
How is different? Really explain that one to me!
*Its a storage unit for information; lots of people use safe's for that
*Its designed to keep others not its owner out, exactly what the encryption is doing
*It needs a key or combination to open it; you need a key to decrypt
They seem pretty damn similar to me. The Constitutions spells out my rights to "personal papers and effects". I am normally a pretty strict constructionist but I think its reasonable to character as a persons electronic documents as "papers" or if you don't want to do that than as "effects" and I really do think the same rules for how an when the government may take possession of them should be applied!
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
I don't agree, first because we can no longer reasonably assume the government is always truthful in its allegations and statements.
I know that legally the government enjoys the presumption of trust, but this is as close to self-incrimination as it can get.
It also doesn't answer the question of what happens if, during their examination of the decrypted drive, they 'discover' other information that could lead to other charges. At least in the example of the rotting smell from the garage, if it turns out to be your dog, do they have the right to dig up the foundation to try and find a human body also? Or would the goverment then have to ask for a new warrant? In the cse of data, would they be compelled to ask for a new warrant it they 'happen' to notice evidence of unrelated crimes.
Actually the real question for me is still a Fifth Amendment one. If they drag you into court and ask you about the rotting corpose in the garage, you can still sit there mute and refuse to answer, and there may be penalties for that, but you cannot so easily be compelled to incriminate yourself.
Decrypting your data is a different thing, and it is virtually impossible for the government to claim they can look ONLY for the data they seek, and ignore all else. It's another thing to say they are looking in the garage for a corpse, and be able to avoid looking in the trunk of car parked on the street, despite walking by it repeatedly as they swarm over the garage.
Sorry, but I think we need much more protections. My phone has enough information on it to give law enforcement access to things they should need more than one warrant for, and discovery they should not be able to make while searching for something else.
deleting the extra space after periods so i can stay relevant, yeah.
To use the GP's analogy, if your garage smells like rotting corpse, a judge will issue a warrant forcing you to unlock your garage door.
No, the judge will issue a warrant allowing the police to break in if you don't unlock the door - an important distinction. Despite the warrant, If you can't find the key to the garage door, no judge would throw you in jail for that.
The one major difference I can think of is that decryption requires a transformation of the data. By decrypting the data you've demonstrated the knowledge of how to perform that transformation. Opening a safe does not require transforming data, simply allowing physical access to it. If you had hard copy encrypted, obfuscated, or ciphered data within your safe, would the court be able to compel you to decrypt that?
It's EXACTLY the same thing if they know you have a dead body in your garage they can get a warrant to force you to unlock the garage.
No it isn't. To continue your analogy of a dead body, they can get a warrant that allows them to search your garage. If you don't open it for them, they then can break in and conduct their search. To apply this to the laptop scenario, the government indeed had a search warrant for the laptop and it was turned over by the defendant. She, in no way, can be compelled to unlock it or do anything else to it but in retrospect, the government would have the right to break into it. In trying to force the defendant to open it, the government has stated that they can't or won't break into it for fear of damaging possible evidence. That's their problem, not the defendant's problem.
[IANAL] I agree w/ the appeals court's decision here. Forcing the defendant to unlock and/or decrypt her laptop would be forcing her to provide evidence against herself thus violating her 5th amendment rights.
...quicker, easier, more seductive the darkside is...but more powerful, it is not.
I don't agree, first because we can no longer reasonably assume the government is always truthful in its allegations and statements.
The constitution was written because the founders assumed government could not be trusted with power. This is why government must *prove* a case against a free citizen beyond reasonable doubt. You assume the government is wrong until they prove otherwise. If you ever assume government is right, you're in trouble.
...quicker, easier, more seductive the darkside is...but more powerful, it is not.
It's different because you can also think of encryption like a secret language that only you can decipher. If you wrote down all of your incriminating information in this secret language, there is no way the government could compel you to translate it for them since doing so would incriminate you. Sure, we can make analogies all day, but when we come right down to it, an encrypted document is a lot more like a secret language than a safe.
-- Give me ambiguity or give me something else!
The reason is that any safe can be physically forced. This makes access inevitable. The combination only prevents property damage.
That is not the case with electronic encryption.
What if your safe contains a piece of paper with what appear to be random markings. Does the government have the right to assert that you "decode" the paper? What if it really *is* random markings?
A safe either contains something, or it does not, and that can be rather easily verified by looking at the contents. The same cannot be said for either the paper described above, or for a hard drive filled with noise and/or encrypted data.
https://www.eff.org/https-everywhere
There are two problems with this analogy: Doors can be picked and destroyed. Picking a lock or destroying a door would not destroy the evidence/property that the door was protecting.
A better -- but still not perfect -- analogy is a safe (as another user pointed out earlier). Assume a perfectly unbreakable safe, the government would need you to provide the combination to the safe in order to gain access to the documents. IANAL, but telling the government a combination is generally not something that they can use against you. The government would have to prove that the safe belonged to you and only you through some other method.
An encryption key is slightly different as the passphrase could be "I have a ponzi scheme and the contents of this safe prove it". I would assume that the government could not use this phrase against you. But they sure can use the contents of the decrypted files.
All cynicism aside, we as a People need to find a way to allow the government to prosecute real criminals but also protect John Q. Citizen. I think the compromise that the police know that the drive contains specific information (e.g. they saw a specific kiddy porn picture) and then forcing the suspect to provide the decryption key is a good one. However, requiring a decryption key as a condition of me flying, driving, or doing anything else would be an intrusion.
We don't live in Shouldland.
The only thing a honey pot would prove is that your computer accessed child porn. Proving you viewed it is different.
There was a case (specifics escape me) where some guy hacked a wi-fi network and made it look like his neighbor was viewing child porn and making threats to political officials. The police originally had the same mentality: your computer, and therefore you, view child porn. Only after his company conducted their own investigation did they prove that he didn't. Note that I said company, not the police.
With Trojans, worms, and other malware, I would think this is an area that needs legal work: proving that an actual person accessed something illegal and not just a computer attached to an IP address.
We don't live in Shouldland.
That's splitting a technical (or technological) hair. Encryption cannot be a perfect safety net with which to break the law with impunity, so I accept this court's compromise. Remember what the lower courts wanted: Your encrypted data is theirs and they will use it all to prosecute you for everything.
You and others are dancing around trying to poke holes in the 5th amendment. The spirit of the 5th amendment is to prevent the government from compelling you to help them prosecute you. The founders talked extensively about how it was immoral to require someone to help the government put them in jail. Providing encryption keys is helping the government prosecute you. In fact I'd argue the combination or key to a safe does exactly the same thing and the court rulings that allow the government to compel cooperation in opening safes also violates the spirit of the 5th.
This is only an issue because Judges go out of their way to violate the constitution when they think it should. As a result there is a case history in the US that providing the key or combination to a safe doesn't violate the 5th. Those rulings completely violate the spirit of the 5th even though they found weasel logic to get around a fixed interpretation of the words of the 5th. Just because this stupidity exists in case law isn't justification to piss on the 5th some more with a similar ruling on encryption.
Oaths are also religious acts, and there would be 1st amendment concerns with forcing people to take an oath if they were, for example, an atheist. Just a fun fact.
Its 2012 - it's common enough to not be a "fun fact" anymore, just reality. ...". I put my hand on my chest and said "I affirm", and this didn't raise any eyebrows. It's common enough, and hopefully soon, the religious oath will be separated from government and no longer be given preferential/default treatment.
The last time I was in a court a few years ago, I was signaled to put my hand on a bible, raise the other and answer "do you swear to
If it were up to me, any testimony given by someone who professes to believe in supernatural beings by taking a religious oath should be treated as suspect; they've already demonstrated their willingness to put hearsay first.
What is reasonable? If it's locked in my mind, you can't force it out of me. The decryption key is locked in my mind. My thoughts are my thoughts. If the hard disk doesn't work without "plugging it in" to my mind, you're shit out of luck.
You KNOW that I have top secret state secrets on my hard drive? You better prove it with real police work. I'm not incriminating myself.
You KNOW that I have industrial espionage documents? Again - you better prove it, 'cause I'm not GIVING you the evidence.
You KNOW that I have child porn on my machine? Well - you're fucked, because there isn't. You're on a fishing expedition, and I'm not biting.
You KNOW that I've visited chat sites that promote (terrorism, rebellion, insurrection, whatever)? Well, it's up to you to prove it, because it's your JOB to investigate. It's not my job to incriminate myself.
Bottom line is, if the only place you can get evidence against me, is from my own mind, then you are pissing into the wind.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Imagine that instead of a garage is a 10,000 lb, ultra high security safe. The kind where opening it by force is more than likely to destroy the contents. They will absolutely subpoena you for the combination to that safe and will absolutely hold you in contempt if you refuse to give it or if you claim that you can't remember it. Especially if they have evidence that you opened the safe on a regular basis (which is the kind of thing a good computer forensics team might be able to show).
The spirit of the 5th amendment is to prevent the government from compelling you to help them prosecute you.
This is where you and many Constitutional scholars disagree. The spirit of the 5th Amendment is to prevent you from having to give actual testimony against yourself. Prior to this, people were often forced to confess and to bear witness against themselves in court.
There are well-established legal situations in which you do, in fact, have to help the government prosecute you, in the broad sense. If they subpoena information, you are legally required to provide it, even if it's damning evidence.
The founders talked extensively about how it was immoral to require someone to help the government put them in jail.
Out of curiosity, where?