Slashdot Mirror
US Appeals Court Upholds Suspect's Right To Refuse Decryption
An anonymous reader writes "The U.S. 11th Circuit Court of Appeals has found that forcing a suspect to decrypt his hard drive when the government did not already know what it contained would violate his 5th Amendment rights. According to Orin Kerr of the Volohk Conspiracy, 'the court's analysis (PDF) isn't inconsistent with Boucher and Fricosu, the two district court cases on 5th Amendment limits on decryption. In both of those prior cases, the district courts merely held on the facts of the case that the testimony was a foregone conclusion.'"
No self-respecting tyrant would try to attack your rights without an excellent strawman. In your example, the scumbag is the strawman.
Yes. If the government knows your have child porn on your computer, then they can get a warrant to force decryption.
It's EXACTLY the same thing if they know you have a dead body in your garage they can get a warrant to force you to unlock the garage.
The EFF Covers things pretty well.
http://www.youtube.com/watch?v=gohLZVAJAiI
Watch that.
Seriously, cause my own memory really sucks, it would be nice if i could make myself remember things. How do i waterboard myself?
/. Headline: US Appeals Court Upholds Suspect's Right To Refuse Decryption Linked Headline: Ruling Stands: Defendant Must Decrypt Laptop
So the government just have to say: we know that you harddrive contains X, and they force you to decrypt it.
Of course, when it is decrypted and it turns out that it didn't contain X, they will just say... sorry!
Let's say, hypothetically, John Doe gets brought up on child pornography possession charges. He has one computer in his home, and the cops are reasonably sure that said porn was accessed and stored at that physical location only. They order him to decrypt his hard drive, because they know it has evidence of his illegal porn habits. He replies, "No it doesn't. It has other stuff. Stuff you don't know about. You can't see it."
Now, they could say that they know for certain that he's a lying sack of crap and force him to decrypt it anyway. No child porn evidence, but he's be embezzling from his company, according to what they find. Now what?
The first link is to a completely different case. Similar story, except that one ruled that the defendant must decrypt their laptop and was heard by the 2nd Circuit. The second link refers to the 11lth Circuit case.
So the government just have to say: we know that you harddrive contains X, and they force you to decrypt it.
Of course, when it is decrypted and it turns out that it didn't contain X, they will just say... sorry!
Hogwash. No way they're going to say sorry.
Yes. If the government knows your have child porn on your computer, then they can get a warrant to force decryption.
If they know, that implies they can prove it, and if they can prove it they don't need to decrypt it!
Eclectic beats from Leeds, UK
handmadehands.co.uk
You have the right to remain silent. You have the right to remain encrypted. Anything you say, do, or decrypt can and will be held against you in a court of law. You have the right to speak to an attorney. If you cannot afford an attorney, one will be appointed for you. Do you understand these rights as they have been read to you?
"I don't think it's selfish, to eat defenseless shellfish." -NOFX
They can't just "say it". The other case was quite exceptional, the suspect did voluntarily show the decrypted disc to the customs officer, the customs officer found kiddie porn but as the laptop was powered down it wouldn't open again without a password. So they had proof he could access it, testimony that they'd actually observed it and a chain of evidence that the contents had not changed since then. That's a whole different level of knowing than just "knowing" they're involved in something illegal.
Live today, because you never know what tomorrow brings
Sounds great, I'll support that as soon as they put a penalty for the law enforcement being wrong.
This is the problem, they CAN go on fishing expeditions without any recourse. They can smash down a door and kill the family dog on accident and the family does not get all damages covered, they get told "sucks to be you"
As soon as I get to sue the Cops that did the deed and the city department for all damages and legal costs I'll support that warrants are legitimate.
Do not look at laser with remaining good eye.
Her rights don't depend on you being more or less annoyed at what she's alleged to have done.
That what governments have always done - relied on the ignorance of the populace to usurp the rights of the unpopular to establish a precedent that's eventually used against others.
From the Opinion:
"But random characters are not files; because the TrueCrypt program displays random characters if there are files and if there is empty space, we simply do not know what, if anything, was hidden based on the facts before us. It is not enough for the Government to argue that the encrypted drives are capable of storing vast amounts of data, some of which may be incriminating. In short, the Government physically possesses the media devices, but it does not know what, if anything, is held on the encrypted drives."
What encryption product was used? It sounds like it is doing its job.
-- Two men say they're Jesus. One of them must be wrong. - Dire Straits
Unfortunately, you might be held for many years before they finally stop harassing you:
https://en.wikipedia.org/wiki/H._Beatty_Chadwick
14 years in prison because his wife claimed he was hiding money which the judge demanded that he produce for the court. In a child pornography case, you might spend more time in prison for refusing to decrypt your hard drive than you would have spent if you had been convicted.
Palm trees and 8
An excellent point, but not relevant here. However, in the United States, searches can be with a warrant issued "upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." Allegations can be supported by Oath, e.g. several friends and family members say they saw child porn on your laptop. Allegations can be supported by affirmation, e.g. they set up a sting operation whereby they do, in fact, know that at one time a computer in your house had downloaded child porn. But being very certain that it was downloaded onto a machine in the house just isn't the same as knowing on what machine and by whom. It also isn't the same thing as knowing it is still there. Finally, the burden of proof you mention isn't required until any subsequent trial.
What I find heartening is that this is the 11th Circuit Court (Alabama, Georgia, Florida) -- i.e., not a court known for "wacky" decisions. If it were the 9th Circuit I would be more worried that this fight isn't over.
I particularly liked how the court used the government's own analogy of a combination to a safe to make their ruling. The ruling explained that the Truecrypt software shows random characters even if nothing exists on the hard drive, so if the hard drive is like a safe -- as the government contends -- then it can be full of incriminating evidence, or completely empty. There is no way for the government to know without opening the safe. Therefore the government cannot use the argument that the evidence was a foregone conclusion. Additionally, the court (thankfully) acknowledged that just because the defendant owns a safe, is not an indication that any criminal activity is going on. The ruling both turned the government's analogy on its head, and revealed that the court has a fairly good understanding of the technology.
Proverbs 21:19
Except that an encrypted hard disk is not just like a safe in the physical world.
Give me Classic Slashdot or give me death!
Actually this is a double smackdown. They hold that
1) The act of decrypting would be testimonial in proving your control over the encrypted container.
2) Even if the decryption wasn't testimonial, compelling you to produce a part of the chain of evidence is also prohibited by the 5th amendment.
This is pretty much a full victory that your encrypted contents are immune from warrants, expect new keylogger laws shortly though... And it still needs to stand in the US Supreme Court before it applies to the whole US, but the ruling seems sound.
Live today, because you never know what tomorrow brings
No idea, but Truecrypt can have 2 passwords, one which unlocks a "fake" set of data, but still hides your real one. Due to the way data is stored while encrypted, there's no way to tell the difference between a second encrypted section and noise.
Wrong. "civil" or "criminal" refers to the type of contempt, not the type of court case during which the contempt occured. Civil contempt is coercive (forward looking), criminal contempt is punative (for something that already occured). Coercing someone to produce evidence is exactly the kind of thing civil contempt is used for.
Under civil contempt the victim is said to "hold the keys to his own cage", which is used as an excuse to deprive him of any sort of due process whatsoever. It's barbaric and should be abolished.
Give me Classic Slashdot or give me death!
How is different? Really explain that one to me!
*Its a storage unit for information; lots of people use safe's for that
*Its designed to keep others not its owner out, exactly what the encryption is doing
*It needs a key or combination to open it; you need a key to decrypt
They seem pretty damn similar to me. The Constitutions spells out my rights to "personal papers and effects". I am normally a pretty strict constructionist but I think its reasonable to character as a persons electronic documents as "papers" or if you don't want to do that than as "effects" and I really do think the same rules for how an when the government may take possession of them should be applied!
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Is there an encryption system available where if you put in a specifically bad password it damages the data forever?
It doesn't matter, for two reasons.
First, you can't do it, because standard procedure in cases like this is to duplicate the drive contents and do all analysis on the duplicate. If your system destroyed the data when a "duress" password is entered, it would only be destroying a copy.
Second, if you could do it you still probably wouldn't want to, because then you'd be prosecuted for destruction of evidence. I suppose if the penalty for destroying evidence is much lower than the penalty for the crime the contents of the drive would prove, that might be a good idea. But it still seems like you'd be better off just not saying anything.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
I don't agree, first because we can no longer reasonably assume the government is always truthful in its allegations and statements.
I know that legally the government enjoys the presumption of trust, but this is as close to self-incrimination as it can get.
It also doesn't answer the question of what happens if, during their examination of the decrypted drive, they 'discover' other information that could lead to other charges. At least in the example of the rotting smell from the garage, if it turns out to be your dog, do they have the right to dig up the foundation to try and find a human body also? Or would the goverment then have to ask for a new warrant? In the cse of data, would they be compelled to ask for a new warrant it they 'happen' to notice evidence of unrelated crimes.
Actually the real question for me is still a Fifth Amendment one. If they drag you into court and ask you about the rotting corpose in the garage, you can still sit there mute and refuse to answer, and there may be penalties for that, but you cannot so easily be compelled to incriminate yourself.
Decrypting your data is a different thing, and it is virtually impossible for the government to claim they can look ONLY for the data they seek, and ignore all else. It's another thing to say they are looking in the garage for a corpse, and be able to avoid looking in the trunk of car parked on the street, despite walking by it repeatedly as they swarm over the garage.
Sorry, but I think we need much more protections. My phone has enough information on it to give law enforcement access to things they should need more than one warrant for, and discovery they should not be able to make while searching for something else.
deleting the extra space after periods so i can stay relevant, yeah.
To use the GP's analogy, if your garage smells like rotting corpse, a judge will issue a warrant forcing you to unlock your garage door.
No, the judge will issue a warrant allowing the police to break in if you don't unlock the door - an important distinction. Despite the warrant, If you can't find the key to the garage door, no judge would throw you in jail for that.
While I admit that having troops quartered in your house might, in fact, result in them making unreasonable searches and seizures, I suspect you should reread the Bill of Rights.
-- Two men say they're Jesus. One of them must be wrong. - Dire Straits
Posting AC, but there's one simple difference:
With a safe, if it's locked, the contents still exist.
If I encrypt a disk, the original data quite literally no longer exists. The encrypted disk is not a "container" for my data -- it is a completely different set of data.
The original data can only be recreated on cue if I supply my encryption passphrase. Therefore, by supplying the passphrase I am creating or assisting in the creation of evidence against me. I'm pretty sure the Fifth Amendment has something to say about being forced to do that.
The one major difference I can think of is that decryption requires a transformation of the data. By decrypting the data you've demonstrated the knowledge of how to perform that transformation. Opening a safe does not require transforming data, simply allowing physical access to it. If you had hard copy encrypted, obfuscated, or ciphered data within your safe, would the court be able to compel you to decrypt that?
I don't agree, first because we can no longer reasonably assume the government is always truthful in its allegations and statements.
The constitution was written because the founders assumed government could not be trusted with power. This is why government must *prove* a case against a free citizen beyond reasonable doubt. You assume the government is wrong until they prove otherwise. If you ever assume government is right, you're in trouble.
...quicker, easier, more seductive the darkside is...but more powerful, it is not.
It's different because you can also think of encryption like a secret language that only you can decipher. If you wrote down all of your incriminating information in this secret language, there is no way the government could compel you to translate it for them since doing so would incriminate you. Sure, we can make analogies all day, but when we come right down to it, an encrypted document is a lot more like a secret language than a safe.
-- Give me ambiguity or give me something else!
The reason is that any safe can be physically forced. This makes access inevitable. The combination only prevents property damage.
That is not the case with electronic encryption.
What if your safe contains a piece of paper with what appear to be random markings. Does the government have the right to assert that you "decode" the paper? What if it really *is* random markings?
A safe either contains something, or it does not, and that can be rather easily verified by looking at the contents. The same cannot be said for either the paper described above, or for a hard drive filled with noise and/or encrypted data.
https://www.eff.org/https-everywhere
The only thing a honey pot would prove is that your computer accessed child porn. Proving you viewed it is different.
There was a case (specifics escape me) where some guy hacked a wi-fi network and made it look like his neighbor was viewing child porn and making threats to political officials. The police originally had the same mentality: your computer, and therefore you, view child porn. Only after his company conducted their own investigation did they prove that he didn't. Note that I said company, not the police.
With Trojans, worms, and other malware, I would think this is an area that needs legal work: proving that an actual person accessed something illegal and not just a computer attached to an IP address.
We don't live in Shouldland.
The key is in your mind, and you have to make words to give it to others. It's not entirely the same.
But let's assume you can be compelled, whether they know what's in the container or not. I have been trying to think about ways to get around this. From an academic point of view of course :P
What if the pass key itself was incriminating (i.e. "I killed a guy in 1994 and his body is under the bridge.")? Could you plead the 5th? Might be a bit of a risk. (I mean...killing is bad.)
Truecrypt allows the plausible deniability with the drive in a drive. Give them the wrong code and it opens a second container with something more innocuous in it. For those who are actually afraid of giving in (to torture? desperation?) the under duress password could have the function of changing the real password to 500 random characters, thereby making it permanently inaccessible to anyone.
Another idea is to have a daily or weekly maintenance password. That is, you are required to type in a password once a day or once a week, and if you don't, the passkey changes to some random 500 characters and is permanently inaccessible. If your stuff is seized or you are arrested, all you have to do is sit back and relax. While I am sure it would be a problem for you to go around actively destroying evidence, I'm curious to see if you get in trouble for this. First of all, you aren't destroying evidence per se, rather it is being rendered inaccessible (automatically I might add). Second, while you can't actively destroy evidence, can you get in trouble for not actively preserving it for the authorities?
You and others are dancing around trying to poke holes in the 5th amendment. The spirit of the 5th amendment is to prevent the government from compelling you to help them prosecute you. The founders talked extensively about how it was immoral to require someone to help the government put them in jail. Providing encryption keys is helping the government prosecute you. In fact I'd argue the combination or key to a safe does exactly the same thing and the court rulings that allow the government to compel cooperation in opening safes also violates the spirit of the 5th.
This is only an issue because Judges go out of their way to violate the constitution when they think it should. As a result there is a case history in the US that providing the key or combination to a safe doesn't violate the 5th. Those rulings completely violate the spirit of the 5th even though they found weasel logic to get around a fixed interpretation of the words of the 5th. Just because this stupidity exists in case law isn't justification to piss on the 5th some more with a similar ruling on encryption.
All cynicism aside, we as a People need to find a way to allow the government to prosecute real criminals but also protect John Q. Citizen.
In all seriousness, as soon as the government starts making a distinction between real criminals and John Q. Citizen we can start letting our guards down on this but until then we should always err on the side of less power and intrusion.
I got here through a series of tubes
Oaths are also religious acts, and there would be 1st amendment concerns with forcing people to take an oath if they were, for example, an atheist. Just a fun fact.
Its 2012 - it's common enough to not be a "fun fact" anymore, just reality. ...". I put my hand on my chest and said "I affirm", and this didn't raise any eyebrows. It's common enough, and hopefully soon, the religious oath will be separated from government and no longer be given preferential/default treatment.
The last time I was in a court a few years ago, I was signaled to put my hand on a bible, raise the other and answer "do you swear to
If it were up to me, any testimony given by someone who professes to believe in supernatural beings by taking a religious oath should be treated as suspect; they've already demonstrated their willingness to put hearsay first.
Imagine that instead of a garage is a 10,000 lb, ultra high security safe. The kind where opening it by force is more than likely to destroy the contents. They will absolutely subpoena you for the combination to that safe and will absolutely hold you in contempt if you refuse to give it or if you claim that you can't remember it. Especially if they have evidence that you opened the safe on a regular basis (which is the kind of thing a good computer forensics team might be able to show).
You are so close to where the true scariness is about this yet so far. What is truly scary is that with an obstruction charge you have now a situation where you have to prove a negative or get life without a trial! Is there a single file anywhere in your possession you no longer know the password for? All it takes is for some government goon to say "Give us the password" and when you say "I don't remember it" BAM, you get to rot because you have no way of "proving" what you actually do and don't remember.
Got a copy of truecrypt somewhere? Even if you don't have it installed some goon can walk up to a judge and say 'Here is a copy of truecrypt we found on one of his discs. Since this software is used to hide data we believe the suspect has used it to hide illegal activities" and then when you tell the judge 'I don't have a hidden volume" thanks to obstruction you can rot because again how do you "prove" what knowledge is or isn't in your brain? Hell I have NO doubt that I have encrypted files I don't know the passwords to simply because i've played with everything from .RAR's built in encryption to truecrypt to just about every thing ever highlighted on /. and since I was just throwing random crap like text and pictures in them before trying out password crackers so needless to say I didn't give a shit enough to write the codes down and since i have 3Tb worth of space I've not been the greatest at hunting for and deleting old crap.
In the end what makes this so scary is with this they have the perfect catch 22, either you produce some evidence they can stick you with or if you say you can't remember unless you can somehow PROVE that you don't remember, which as pointed out is pretty much impossible, well they can then throw you in a hole and forget where the key is. With crimes IRL they can simply go around you with you cooperating. They can cut open the safe, kick open the door, etc, but with this unless you are using some sort of government approved crypto where the state has a master key you are screwed.
ACs don't waste your time replying, your posts are never seen by me.
I've been a court reporter for a few years now. I'm in court pretty much all day, every day.
Our judge is better than most. We certainly don't have a bible in the courtroom and every witness is asked "Do you swear or affirm under penalties for perjury that the testimony you are about to give..." before testifying. I'd say one in twenty people specify that they specifically affirm even though the question is deliberately phrased so that they don't have to specify. I like those people.
If it were up to me, any testimony given by someone who professes to believe in supernatural beings by taking a religious oath should be treated as suspect; they've already demonstrated their willingness to put hearsay first.
No argument there.