Slashdot Mirror


Mass. Supreme Court Says Defendant Can Be Compelled To Decrypt Data

Trailrunner7 (1100399) writes ... Security experts have been pounding the drum about the importance of encrypting not just data in transit, but information stored on laptops, phones, and portable drives. But the Massachusetts Supreme Judicial Court put a dent in that armor on Wednesday, ruling that a criminal defendant could be compelled to decrypt the contents of his laptops. The case centers on a lawyer who was arrested in 2009 for allegedly participating in a mortgage fraud scheme. The defendant, Leon I. Gelfgatt, admitted to Massachusetts state police that he had done work with a company called Baylor Holdings and that he encrypted his communications and the hard drives of all of his computers. He said that he could decrypt the computers seized from his home, but refused to do so. The MJSC, the highest court in Massachusetts, was considering the question of whether the act of entering the password to decrypt the contents of a computer was an act of self-incrimination, thereby violating Gelfgatt's Fifth Amendment rights. The ruling.

560 comments

  1. I lost the password by pjh3000 · · Score: 5, Funny

    I lost the password in a hard drive crash.

    1. Re:I lost the password by pjh3000 · · Score: 5, Funny

      ... the hard drive was recycled.

    2. Re:I lost the password by Anonymous Coward · · Score: 1

      The judge thinks you're lying, Contempt of court. Go directly to jail, Do not pass go, do not collect 200$.

    3. Re:I lost the password by pjh3000 · · Score: 2

      So why isn't Lerner in jail?

    4. Re:I lost the password by Anonymous Coward · · Score: 0

      That only applies to people who have no authority that could ever possible impact the judge in question.

    5. Re:I lost the password by ZombieBraintrust · · Score: 2

      He already admitted he could decrypt it. So not really an issue here.

    6. Re:I lost the password by sycodon · · Score: 3, Insightful

      Can they compel you to unlock a safe? A safe Deposit box? While authorities can get into these without your help, what if they couldn't?

      Electronic information is directly analogous to paper. Information is information regardless of how its stored.

      --
      When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
    7. Re:I lost the password by jythie · · Score: 3, Informative

      They can indeed compel you to unlock a safe, just like they can compel one to hand over documents during discovery.

    8. Re:I lost the password by Anonymous Coward · · Score: 0

      So you have to help the authorities if they can't decipher your handwriting?

    9. Re:I lost the password by Enry · · Score: 2, Informative

      She personally didn't lose the e-mail and much of it has already been recovered.

    10. Re:I lost the password by Anonymous Coward · · Score: 0

      He already admitted he could decrypt it. So not really an issue here.

      Yes... now he just needs to make a 'good faith effort' to actually attempt to decrypt it as ordered, but then 'find out', that, for some strange reason he is no longer able to decrypt it, and perhaps the encrypted files had been damaged or not gathered intact.

      He can then tell them "the password" as he "remembers" it, and valiantly fail in his efforts to help the authorities break into the encrypted files.

    11. Re:I lost the password by Anonymous Coward · · Score: 1

      No, they will just open the safe themselves. They are welcome to try to open my truecrypt volumes.

    12. Re:I lost the password by arbiter1 · · Score: 1

      Well the safe is different since its a physical object with a physical lock and/or key. The key for encrypted data is stored in your head which the 4th protects against data stored in your head. But that has been attacked a ton recently.

    13. Re:I lost the password by mythosaz · · Score: 1

      This is, essentially, the crux of the issue - are encrypted records and passwords the analog of combination locks on safes?

    14. Re:I lost the password by grahamm · · Score: 4, Insightful

      But having opened the safe, can they force you to 'decode' the entries on a paper document which are written in a code or cipher? If not, then they should not be able to force you to decrypt an electronic document which is written in 'code'.

    15. Re:I lost the password by jythie · · Score: 4, Insightful

      A safe can also have a combination lock or keypad, more frequently then a physical key.

    16. Re:I lost the password by bobbied · · Score: 1

      She may end up there, but I'm guessing she was not the one who ordered the drives destroyed (at least she didn't document the order).

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    17. Re:I lost the password by bobbied · · Score: 1

      Yes, legally you must... Now if they cannot read what you wrote, who's going to know?

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    18. Re:I lost the password by mi · · Score: 1

      So you have to help the authorities if they can't decipher your handwriting?

      Not if you claim you "can't read cursive" — not even (supposedly) your very own.

      --
      In Soviet Washington the swamp drains you.
    19. Re:I lost the password by Golddess · · Score: 1

      Electronic information is directly analogous to paper. Information is information regardless of how its stored.

      Correct. And it is not my responsibility to teach the police the made-up language I used when writing on that paper.

      --
      "I'm not sure I like the fugnutish tone you used in your post!" -RogL (608926)-
    20. Re:I lost the password by Isaac-1 · · Score: 1

      Assuming it is, I guess it is time for self destucting time locked crypto, maybe a password backed key on a usb device with self desctruct countdown ...

    21. Re:I lost the password by LordLimecat · · Score: 1

      Assuming it is, I guess it is time for self destucting time locked crypto,

      Thats not possible to do for a number of reasons, primarily because one of the first things theyll do is image your computer.

    22. Re:I lost the password by scottbomb · · Score: 1

      Because Attorney General Eric Holder won't do his job and appoint a special prosecutor.

    23. Re:I lost the password by dave.leigh7335 · · Score: 2

      He already admitted he could decrypt it. So not really an issue here.

      Sure it is. He mis-remembers it. Obviously his recollection is marred by the passage of time and the stress caused by the accusations. Also, it was a really complicated password that's hard to remember. And his dog ate it. Oh, and perhaps he hasn't spent any effort to refresh his memory, contemplating instead the fact that the rights listed in the Bill of Rights are inalienable. They are affirmed by, not granted by, the Constitution. A state judge doesn't get to waive them with not-terribly-clever re-definitions.

    24. Re:I lost the password by Totenglocke · · Score: 2, Interesting

      And THAT is what keyfiles are for. Pick a random .dll or some such that's part of Windows (or OS of your choice) as a keyfile so that there's nothing suspicious about the file itself. Simply don't select the keyfile when entering the password and you're good.

      --
      "The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants." ~Thomas Jefferson
    25. Re:I lost the password by Defenestrar · · Score: 5, Interesting

      No, as the series of court rulings have gone, the Fourth Amendment does not protect you from lawful search and seizure (such as a safe or hard drive). The combination to the safe, or encryption key to the drive, is not incriminating evidence and providing it to allow for lawful search and seizure does not violate your rights. They can admit evidence produced by oneself into court (such as two sets of books in one's own handwriting for a case of fraud) and that is not a violation of the Fourth (or Fifth) - just so with information one puts on a hard drive. What they can not compel one to do is testify against oneself (which is the Fifth by the way) nor assume guilt because you do not take the stand (not that a prosecutor won't toe that line with the jury). So, if one can keep all details of a crime in one's head and manage to destroy all other evidence which could be subject to lawful search and seizure - then you've got a shot at being a criminal mastermind.

      I'm not sure I entirely agree with the line of thought - but I can certainly follow the logic as well as the precedence.

      What would be interesting is if one's pass-code was material evidence with respect to the case - but a possible way around that would be limited immunity or ruling it as inadmissible evidence...It would make for an interesting case study.

    26. Re:I lost the password by DaHat · · Score: 2

      It's not so clear cut.

      They generally can't compel you to turn over your encryption keys so they can go on a fishing expedition through your encrypted hard drive, looking for evidence with which to proceed... but they can compel you if they know you have specific evidence that they will find (ie they saw kiddie porn on your PC before you closed it and it required a password to log back in)

    27. Re:I lost the password by Totenglocke · · Score: 0

      They already can open your TrueCrypt volumes - hence why the dev shut it down and issued a warning that it's not safe to use.

      --
      "The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants." ~Thomas Jefferson
    28. Re:I lost the password by Anonymous+Psychopath · · Score: 1

      I lost the password in a hard drive crash.

      That works, expect you get to sit in jail indefinitely for contempt as a result.

      --

      Eagles may soar, but weasels don't get sucked into jet engines.

    29. Re:I lost the password by Anonymous+Psychopath · · Score: 1

      Cue the whoosh replies...

      --

      Eagles may soar, but weasels don't get sucked into jet engines.

    30. Re:I lost the password by Anonymous Coward · · Score: 0

      Mod Parent Up: The computer is a safe, the information in it is a separate entity to be considered.

    31. Re:I lost the password by Cro+Magnon · · Score: 1

      Or, if she did document the order, it got lost in another HD crash.

      --
      Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
    32. Re:I lost the password by wagnerrp · · Score: 1

      Assuming it is, I guess it is time for self destucting time locked crypto,

      Thats not possible to do for a number of reasons, primarily because one of the first things theyll do is image your computer.

      What about this part?

      maybe a password backed key on a usb device with self desctruct countdown

      If the decryption key is stored on a USB key with a battery and RTC, it can wipe itself if you have not entered the password after a certain period of time. It can be tamper resistant and wipe itself if you attempt to open it. Now obviously nothing is 100% secure, but you get to the point where it basically becomes bomb disposal.

    33. Re:I lost the password by Charliemopps · · Score: 1

      I lost the password in a hard drive crash.

      But that's not what this case was about. He admitted to knowing the password, and refused to provide it. I've no problem with this ruling.

    34. Re:I lost the password by Shakrai · · Score: 2, Insightful

      That's an incredibly stupid idea. You might as well make the password a six digit numeric, because that's about how long it will take a computer to go through every .dll on a standard Windows installation looking to see if one is the keyfile.

      --
      I want peace on earth and goodwill toward man.
      We are the United States Government! We don't do that sort of thing.
    35. Re:I lost the password by Jane+Q.+Public · · Score: 2

      They can indeed compel you to unlock a safe, just like they can compel one to hand over documents during discovery.

      Not if it has a combination lock. Under some circumstances, that is.

      See, a lot of people here aren't getting what this is about. The 5th Amendment, and how it works.

      You cannot be compelled to produce knowledge -- "a product of the mind", as the courts put it -- if that could incriminate you. That includes an encryption key or a safe combination.

      But what many people don't seem to get here, and what many people find strange, is that this only holds if the contents are unknown. If the contents are already known, then the person isn't incriminating himself. So decryption / combination can be compelled. (It should also be noted that a safe isn't really a good example, though, because they only need probable cause to force it open, and the hell with the combination.)

      Example: a few years ago, a man was crossing the border with his laptop. He had an encrypted volume active and open when customs looked at it. A customs agent saw some child pornography on the encrypted volume, and showed it to another agent. Then the man somehow managed to turn off the laptop.

      In court, the judge ruled that because illegal material was already known to be on the drive, the judge could compel the man to hand over the decryption key. The man wouldn't be incriminating himself because he was already known to have illegal material there. (I would argue, though, that the man could have had other content on the drive, which was unknown, and which could have incriminated him for some other crime. In which case the ruling would be improper.)

      But again, it was only because specific illegal content was already "known with particularity" to be on the drive, that the judge could so order.

    36. Re:I lost the password by Cryacin · · Score: 1

      ... the hard drive was recycled.

      Sorry your honour, my hard drive was rinse-cycled.

      --
      Science advances one funeral at a time- Max Planck
    37. Re:I lost the password by Anonymous Coward · · Score: 1

      They already can open your TrueCrypt volumes - hence why the dev shut it down and issued a warning that it's not safe to use.

      [citation needed]

    38. Re:I lost the password by almitydave · · Score: 1

      Like if your password is "ididitimguilty"?

      --
      my, your, his/her/its, our, your, their
      I'm, you're, he's/she's/it's, we're, you're, they're
    39. Re:I lost the password by gstoddart · · Score: 1

      I know you're joking, but the reason I stopped writing in cursive was because I could no longer read my own damned writing, and I could write faster when I printed.

      I have a nephew who never learned cursive, and can't read it at all. It was simply never taught in his schools.

      --
      Lost at C:>. Found at C.
    40. Re:I lost the password by Rob+Y. · · Score: 2, Insightful

      Not to mention that the entire witch hunt for IRS 'discrimination against right-wing groups' is a bogus, political sideshow. And beyond that, not to mention that *all* of these political groups shouldn't be tax-exempt - or certainly not in the way that allows their donors to be anonymous.

      It never ceases to amaze me that presumably smart Slashdotters are so quick to subscribe to conspiracy theories (cue smarmy response about how non 'presumably smart' I am). And that they embrace nonsense just because they think they're libertarians and the issue at hand falls on the libertarian side of an issue. The wholesale compromise of U.S. democracy in favor of big cash contributions is a tragedy - for liberals, conservatives and libertarians alike. But the media love it. Ad sales spike like crazy around elections, and for TV stations, election season is probably what Christmas season has long been for retailers - a few months, without which they would operate in the red...

      --
      Posted from my Android phone. Oh, I can change this? There, that's better...
    41. Re:I lost the password by davester666 · · Score: 1

      it's different. this is more like "can/should they compel you to decode this secret writing on all these pages".

      --
      Sleep your way to a whiter smile...date a dentist!
    42. Re:I lost the password by Yakasha · · Score: 1

      Electronic information is directly analogous to paper. Information is information regardless of how its stored.

      Nope.

      SCOTUS ruled police need a warrant to search your cell phone. If you had the exact same data on paper in a briefcase with you at the time of your arrest, they could search your briefcase (for personal safety reasons or for contraband), see the papers, and use them as evidence.
      http://www.politico.com/story/...

    43. Re:I lost the password by Jane+Q.+Public · · Score: 5, Informative

      No, as the series of court rulings have gone, the Fourth Amendment does not protect you from lawful search and seizure (such as a safe or hard drive). The combination to the safe, or encryption key to the drive, is not incriminating evidence and providing it to allow for lawful search and seizure does not violate your rights.

      In most circumstances, this is just plain false. As explained (but not very well) in TFA.

      Unless it is already known "with particularity" that the drive or safe contains some specific illegal or incriminating material, a judge cannot compel someone to hand over a decryption key or combination. Because those are the only circumstances that would not compel him to incriminate himself. This has nothing to do with the Fourth amendment at all, it's just the Fifth.

      Having said that: if they have probable cause or a warrant, they can force open a safe without violating either the 4th or 5th Amendments. The 4th only requires probable cause, and it doesn't require the suspect to incriminate herself, so the 5th isn't violated.

      However, with decent encryption there is no way to do that with a hard drive, so the circumstances are very different and the 5th Amendment comes into play. The court cannot compel speech, or "a product of the mind" like a combination or encryption key, if in doing so the individual would incriminate himself. The exception -- the ONLY exception -- is when specific evidence or illegal material is already known to be inside, "with reasonable particularity" as the courts have put it. ONLY in those circumstances is a suspect not being forced to incriminate himself. (And of course if the court did compel disclosure, and the material in question turned out to not be there after all, then the witnesses who said it was would be in some very serious trouble.)

      Simply suspecting something is inside is not sufficient. Probable cause is not sufficient. It is a far higher standard of evidence.

    44. Re:I lost the password by Jane+Q.+Public · · Score: 1

      They already can open your TrueCrypt volumes - hence why the dev shut it down and issued a warning that it's not safe to use.

      Actually, the sum of the evidence says otherwise. The security audit has found nothing wrong with Truecrypt 4.1a, and in fact they plan to carry forward the TrueCrypt project when Phase II of the audit is completed.

    45. Re:I lost the password by Anonymous Coward · · Score: 0

      > that's about how long it will take a computer to go through every .dll on a standard Windows installation

      That's only if you know one of those is the keyfile. Having a number of keyfiles on my computer, nobody would think (ever) to test every single file on he system as a keyfile much less any file on archive.org file, which it could also be. An interesting idea, not stupid.

    46. Re:I lost the password by Anonymous Coward · · Score: 1

      Think of the bill of rights being a list of things of how not to subvert people thru the use of torture. It becomes much more clear about why the bill of rights are the way the are.

      Basically self incriminate means we can not beat it out of you.

      Look to the history of what the crown was doing to people in the years before it was written.

    47. Re:I lost the password by Totenglocke · · Score: 1

      Yes, but how many people are using 4.1a from what....10 years ago? Almost everyone would be using a newer and (from the evidence provided by the Dev) compromised version.

      --
      "The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants." ~Thomas Jefferson
    48. Re:I lost the password by tmosley · · Score: 1

      Security through obscurity isn't security, anon.

    49. Re:I lost the password by Jane+Q.+Public · · Score: 2

      Yes, but how many people are using 4.1a from what....10 years ago? Almost everyone would be using a newer and (from the evidence provided by the Dev) compromised version.

      Pardon me. Brain fart, as they say. I meant 7.1a. That's the one being audited, and it has turned out okay.

    50. Re:I lost the password by tmosley · · Score: 2

      Right, I'm sure they didn't just have a visit from the NSA (Not Secure Anymore) who wanted a backdoor in their software, and they refused to give them one, shutting down instead.

    51. Re:I lost the password by tmosley · · Score: 1

      This is sort of like saying "tell us where you buried the bodies or we'll jail you permanently for contempt". Actually no, it's EXACTLY like saying that. The key sure as fuck IS incriminating evidence, just the same as the location of a dead body.

    52. Re:I lost the password by Anonymous Coward · · Score: 0

      What if the contents of the drive reveal that you regularly talk to a certain group of people or even individuals? Would that not interfere with your right to peaceably assemble?

    53. Re:I lost the password by tmosley · · Score: 2

      So if they force disclosure of a password and the data that was "known" to be on there isn't there, do you get to sue for violation of your fifth amendment rights?

    54. Re:I lost the password by Jane+Q.+Public · · Score: 1

      That works, expect you get to sit in jail indefinitely for contempt as a result.

      Cool. So we can expect to see Eric Holder, Lois Lerner, the directors of the NSA and CIA, and the heads of the EPA all in prison soon?

    55. Re:I lost the password by MouseTheLuckyDog · · Score: 2

      Yes that is why they found an email from Lois Lerner requesting that Senator Grassley be audited.

    56. Re:I lost the password by MouseTheLuckyDog · · Score: 1

      Woks great until the next upgrade.

    57. Re:I lost the password by Anonymous Coward · · Score: 0

      All I read was "blah blah blah" leftist tantrum "blah blah blah"

      I'm tired of finger pointing.

      All members of both sides pull stupid kindergarten level stunts with major repercussions and need to be bitch-slapped with a 5 tine pitch-fork upside their heads, points first.

      The fucking morons are there to do what their constituents want, not what their political affiliation wants or what the corporation padding their wallet wants.
      No, corporations are not people, they are not constituents, regardless of what the bought and paid for SCotUS rules.

    58. Re:I lost the password by MouseTheLuckyDog · · Score: 1

      Furthermore they can compell you to reveal things, even testify, if it is used against someone else and not you.

    59. Re:I lost the password by Rigel47 · · Score: 3, Insightful

      It amazes me that you subscribe to the idea that a local desktop hard drive crash wiped out all email for a high-ranking IRS official... and that the IRS is essentially shrugging at any notion of ineptitude. Clearly you know fuck all about tech.

    60. Re:I lost the password by Jane+Q.+Public · · Score: 1

      So if they force disclosure of a password and the data that was "known" to be on there isn't there, do you get to sue for violation of your fifth amendment rights?

      Yes. Plus the witnesses who said it was there would probably face perjury charges a well.

    61. Re:I lost the password by TheCarp · · Score: 4, Interesting

      Not only that either.... he admitted not only that he COULD but, that the communications that they were looking for were, indeed in those encrypted volumes.

      As I understand, previous arguments and rulings have centered upon the idea that decrypting data would potentially give away information that the police didn't have already: like that you have the key and are associated with the contents.

      If the police find a USB key in my drawer, and I refuse to talk about it, they only know that I posessed it. They don't know whats on it...or that I actually know whats on it. For all they really know, it could be an empty encrypted parition that I setup and lost the key to (yes, I have done this a coupel of times), it could even be a drive someone asked me to hold onto.

      OTOH if I give them that information, then they can connect me directly with the unencrypted data, this makes a good amount of sense in that case.

      --
      "I opened my eyes, and everything went dark again"
    62. Re:I lost the password by MouseTheLuckyDog · · Score: 1

      She testified it wasn't her own.

    63. Re:I lost the password by MouseTheLuckyDog · · Score: 1

      Having read the liner sheet of "Point of Know Return", I can say that anything but really badly written cursive, should be able to be read by anyone who can read the same language. 80-90% of the letter look similar enough for there not to be a mistake.

    64. Re:I lost the password by ShanghaiBill · · Score: 1

      Not to mention that the entire witch hunt for IRS 'discrimination against right-wing groups' is a bogus, political sideshow.

      That does not excuse perjury or contempt of congress. Like it or not, congress is made up of the elected representatives of the people, with the constitutional authority to oversee the federal government.

    65. Re:I lost the password by Anonymous Coward · · Score: 0

      Or that records were deleted after 6 months, and were requested 3 years later.

      Talk about knowing fuck all. At least know the pertinent details if you're going to criticize.

    66. Re: I lost the password by Anonymous Coward · · Score: 0

      That would've been so much more impressive if you had also guessed their name ;)

    67. Re:I lost the password by Anonymous Coward · · Score: 0

      This is more like a one time cypher, so it is security.

    68. Re:I lost the password by bluefoxlucid · · Score: 1

      It's a password and keyfile combo. It's roughly the security of a password, with the added complexity that someone has to think there's a key file, think it's on the computer in clear text, and go trying shit with the password to compel you to decrypt it.

    69. Re:I lost the password by nabsltd · · Score: 0

      Security through obscurity isn't security, anon.

      You do realize that encrypting your hard drive with a key you keep in your head really is just security through obscurity...if somebody discovers the key, they can decrypt the drive. All the anonymous poster is doing is using a really long key, and a unique way to remember what that key is.

      It's not bad because he is using a file on the drive as the key...it's bad because the file could be updated at any time, thus wiping the key.

    70. Re:I lost the password by Anonymous Coward · · Score: 0

      Ultimately, the problem is one of a practical nature: until the incriminating evidence is actually shown to be on the encrypted hard drive, it is only suspected to be there, by any legal interpretation of "suspicion" -- if it was legally known to exist there, you could be found guilty without the bothersome effort of having to decrypt the data. Thus, by the wording of the ruling, the court is allowed to compel testimony in the form of a passphrase under literally any circumstance, since any suspect is, by definition, under "reasonable suspicion."

      Welcome to the new world order. Papers, please...

    71. Re:I lost the password by ShanghaiBill · · Score: 1

      They can indeed compel you to unlock a safe, just like they can compel one to hand over documents during discovery.

      Except that Discovery is a civil procedure that has nothing to do with criminal law. In civil court you have no fifth amendment rights, and there is no presumption of innocence.

    72. Re:I lost the password by nabsltd · · Score: 2

      The court cannot compel speech, or "a product of the mind" like a combination or encryption key, if in doing so the individual would incriminate himself. The exception -- the ONLY exception -- is when specific evidence or illegal material is already known to be inside, "with reasonable particularity" as the courts have put it.

      In this case, the defendant admitted the encrypted data is communications with someone who is not his lawyer, and the state showed that those communications are likely to be evidence in this case. So, this time, the ruling is correct.

      If, however, the defendant had an encrypted file and the state had no knowledge of what might be in it, then the mere fact that it is encrypted is not probable cause to issue a warrant to compel the release of the password.

    73. Re:I lost the password by Altus · · Score: 1

      Until phase 2 of the audit is complete they have no idea if the source has been compromised or not

      --

      "In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson

    74. Re:I lost the password by prasadsurve · · Score: 1

      ... the hard drive was recycled.

      and then my dog ate the recycled hard disk.

    75. Re:I lost the password by Anonymous Coward · · Score: 0

      I suspect he meant a usb-device that was self encrypting and features a self destruct if tampered with / past a certain time. Imaging wouldn't do anything against said as it is a microprocessor with a storage back end rather than just a storage device.

      Then you'd just be on the hook for destruction of evidence. Sure, it'd be hard to truely 'prove' but juries are pretty stupid.

      Wouldn't do much against most computer forensics either since the majority of apps (word/excel/etc) shove temp copies of everything upon load. I guess you could wire in reading apps and force their use instead to dodge creation of disk cached copies?

    76. Re:I lost the password by Anonymous Coward · · Score: 0

      Imagine an unbreakable physical safe and you knew where the key was. That would be the analogy. If they allow you to force you to reveal where the key is, why not a password?

      However, I think it gets complicated if you forget the password or where the key was placed. How can they prove you are lying?

      Now, what if to decrypt the HDD, you had a USB key? And what if, that key got lost or broken before trial? Or recorded over with pornography.

    77. Re:I lost the password by Registered+Coward+v2 · · Score: 1

      No, as the series of court rulings have gone, the Fourth Amendment does not protect you from lawful search and seizure (such as a safe or hard drive). The combination to the safe, or encryption key to the drive, is not incriminating evidence and providing it to allow for lawful search and seizure does not violate your rights. They can admit evidence produced by oneself into court (such as two sets of books in one's own handwriting for a case of fraud) and that is not a violation of the Fourth (or Fifth) - just so with information one puts on a hard drive. What they can not compel one to do is testify against oneself (which is the Fifth by the way) nor assume guilt because you do not take the stand (not that a prosecutor won't toe that line with the jury). So, if one can keep all details of a crime in one's head and manage to destroy all other evidence which could be subject to lawful search and seizure - then you've got a shot at being a criminal mastermind.

      I'm not sure I entirely agree with the line of thought - but I can certainly follow the logic as well as the precedence.

      What would be interesting is if one's pass-code was material evidence with respect to the case - but a possible way around that would be limited immunity or ruling it as inadmissible evidence...It would make for an interesting case study.

      INAL, but it seems part of the reasoning hinges on his admitting he had the key, that information was encrypted, and he dealt with the suspects involved; thus his act of decrypting would not reveal anything the prosecution didn't already know about his awareness of the documents. In other words, he said essentially "there is stuff of mine over there" and the court says he must open the door. I wonder if he had not said anything if the decision would go the same way. Ironically, I find it off tha a lawyer wouldn't "lawyer up." Everyone I know in law enforcement says "always lawyer up" and that "the first thing the smart crooks say is 'I want my lawyer...'"

      --
      I'm a consultant - I convert gibberish into cash-flow.
    78. Re:I lost the password by Anonymous Coward · · Score: 2, Informative

      As another AC, my agreement that Rigel47 is a low-information poster aka knows fuck-all about what he's talking about, won't mean much.

      But this WaPo summary of the situation which confirms that the IRS had a 6-month backup retention policy should be meaningful.

      I do not expect this information to change Rigel47's opinion one bit. Truth rarely convinces ideologues. But anyone else following along might learn something.

    79. Re:I lost the password by AutodidactLabrat · · Score: 2

      What we do know is that IRS and HEW communications are encrypted at every point, even internally. A lost password file control like "Keypass" and the entire server storage chain is permanently gibberish.
      For security purposes, those files are NEVER backed up by central servers (Key-in-Lock weakness) and so, once crashed....gone

    80. Re:I lost the password by AutodidactLabrat · · Score: 1

      Because it was sent to an UNencrypted receiver.
      UHD (because you are so backward)

    81. Re:I lost the password by AutodidactLabrat · · Score: 1

      It amazes me you think that autoencryption with only local password storage is not the norm at User Data Sensitive Sites like IRS and HEW.
      I agree. You know fuck all about security.

    82. Re:I lost the password by AutodidactLabrat · · Score: 1

      They have no authority to issue perjury or contempt warrants. Since Congress is OVER represented by the minority party that got 1.8 million less votes for the House in 2012, it follows that the representitives of the people did not vote for contempt.

    83. Re:I lost the password by Bob+the+Super+Hamste · · Score: 1

      I believe that the court can compel you to unlock a safe. The question I wonder is one I saw mentioned a long time ago here on /. is can the court compel you to interpret something you have written for the prosecution? What if I wrote some cryptic message in a made up language on some paper do I have to tell the court what it means or could I tell them to go pound sand?

      --
      Time to offend someone
    84. Re:I lost the password by Anonymous Coward · · Score: 0

      > That does not excuse perjury or contempt of congress.

      A party-line vote of "contempt of congress" says more about the parties' agendas than it does about the person. Especially since the vote was purely symbolic as they chose not to follow it up with any citation.

      As for perjury, that's just another talking point.

    85. Re:I lost the password by Anonymous Coward · · Score: 0

      So when you lose the Congress, just make up new fantasy laws for yourself. Cute.

    86. Re:I lost the password by Bob+the+Super+Hamste · · Score: 1

      This a thousand times. This is the type of question that should be asked when discussing the legalities around an encrypted file.

      --
      Time to offend someone
    87. Re:I lost the password by Bob+the+Super+Hamste · · Score: 1

      You have never seen my handwriting, let alone my cursive.

      --
      Time to offend someone
    88. Re:I lost the password by Anonymous Coward · · Score: 0

      Totally possible, because it's the key being destroyed. It doesn't matter what happens to the computer image. Granted they could still go the brute force route and try to decrypt it but I'd be willing to take my chances on that scenario. And the other nice thing about using a hardware key is, you don't know the password, you can't be compelled to give it up.

    89. Re:I lost the password by Aaden42 · · Score: 1

      Just use TrueCrypt on Windows XP. You should be fine.

    90. Re:I lost the password by david672orford · · Score: 2

      Ultimately, the problem is one of a practical nature: until the incriminating evidence is actually shown to be on the encrypted hard drive, it is only suspected to be there, by any legal interpretation of "suspicion" -- if it was legally known to exist there, you could be found guilty without the bothersome effort of having to decrypt the data. Thus, by the wording of the ruling, the court is allowed to compel testimony in the form of a passphrase under literally any circumstance, since any suspect is, by definition, under "reasonable suspicion."

      Welcome to the new world order. Papers, please...

      That is not quite what decision says. Reasonable suspicion is sufficient to get a search warrant and the authorities can take the hard disk and try to break the encryption. The defendant can be compelled to give them the key only if it is already proven (not just reasonably suspected) that he has it. This defendant lost because he bragged to the cops that he had the key.

      The reasoning is that when a defendant decrypts a hard disk for the police he is admitted that he had access to its contents. But he has already admitted that. So now by unlocking the drive he will be telling the police anything new. He is simply unlocking the door so that the cops can go in with warrant in hand.

    91. Re:I lost the password by Anonymous Coward · · Score: 0

      No, they can't. A bunch of lawyers all over the country have gotten so accustom to violating peoples rights by using tricky wording, that they don't even question it anymore.

      Once a person gives the password of a safe, they have provided word (written or spoken) evidence that they have control over that safe, and actually know the contents. The accusers will use that spoken or written word against the defendant.

      the 5th amendment is a Right, not a priviledge that can be swept aside.

    92. Re:I lost the password by david672orford · · Score: 2

      It's not so clear cut.

      They generally can't compel you to turn over your encryption keys so they can go on a fishing expedition through your encrypted hard drive, looking for evidence with which to proceed... but they can compel you if they know you have specific evidence that they will find (ie they saw kiddie porn on your PC before you closed it and it required a password to log back in)

      How sure they are that they know what is on the hard disk is not important as long as it was enough to get a warrant. According to this decision the important point is whether by unlocking the drive the accused will be admitting that the encrypted volume is his.

    93. Re:I lost the password by david672orford · · Score: 1

      This is sort of like saying "tell us where you buried the bodies or we'll jail you permanently for contempt". Actually no, it's EXACTLY like saying that. The key sure as fuck IS incriminating evidence, just the same as the location of a dead body.

      No, it is not like that at all. If he told them where the body was he would be admitting that he was somehow connected with the crime. This is more like: We suspect that you murdered and buried the body. Tell us the address of that summer cottage in Vermont you were telling us about so that we can go search there.

    94. Re:I lost the password by Anonymous Coward · · Score: 0

      "The combination to the safe, or encryption key to the drive, is not incriminating evidence and providing it to allow for lawful search and seizure does not violate your rights"

      Demonstrating that you knowing the encryption key might well be incriminating. In this case the defendant has already admitted to everything that would be revealed by punching in the encryption key. If he had kept his mouth shut we'd have a tougher case.

    95. Re:I lost the password by colin_faber · · Score: 1

      But still enough to maintain control of it? Your logic makes no sense.

    96. Re:I lost the password by Nehmo · · Score: 1

      I lost the password in a hard drive crash.

      First, I'll answer directly. If an American judge believed he/she had the authority to compel you to hand over the data, and you gave the *unable* excuse, the judge would simply assume you are able and rule against you until you found the ability. This may mean you stay in jail, you continue to be tortured, your girlfriend continues to be raped, your kid remains in foster custody, the state takes your money, or whatever.

      This has already been thought of. And one answer is engineering some form of plausible deniable.

      One idea is to make the existence of encrypted data invisible. Then you could try to claim everything is already visible. But that may not work with a dedicated inquisitor.

      In a better designed system, you should be able to provide a password to your inquisitor (the government, perhaps) and it would appear to be successful. But in reality, yet another password would be needed to get at the hidden data.

      --
      (||) Nehmo (||)
    97. Re:I lost the password by KevReedUK · · Score: 4, Insightful

      OK... so the fact that they have a 6 month retention policy is one thing, and does, indeed, pretty much invalidate Rigel47's post.

      BUT it does raise a perhaps more important question...

      IANAL, but I believe the IRS can audit you after up to 6 years. Bearing this in mind, and the fact that I think it is highly unlikely that they would accept the excuse of "I only have a 6-month retention policy on my receipts" as sufficient to allow you to get away without providing the relevant documentation, it does lead me to wonder... If they are forcing and enforcing long retention policies on those that they serve, why do they get away with only having to accommodate a twelfth of the retention period themselves?

      --
      Just my $0.03 (At current exchange rates, my £0.02 is worth more than your $0.02)
    98. Re:I lost the password by mi · · Score: 1

      She testified it wasn't her own.

      From the article (emphasis mine):

      Rachel Jeantel, star witness in the Trayvon Martin murder trial, was asked in Seminole Circuit Court in Sanford, Florida this week to read from a letter that she allegedly "wrote" to Mr. Martin's mother. The letter detailed what Ms. Jeantel allegedly heard while on the phone with the late Mr. Martin moments before he was fatally shot by 29-year-old defendant George Zimmerman.

      However, when prompted in court, Ms. Jeantel couldn't read that letter.

      Possibly, after being caught lying, she admitted, that it was not, in fact, written by her. But that is how the prosecution originally presented that "evidence" — and, strangely enough, nobody got prosecuted for perjury.

      --
      In Soviet Washington the swamp drains you.
    99. Re:I lost the password by Anonymous Coward · · Score: 0

      She did personally lose it, and none of it was recovered at all... hot damn they've got you spoon fed don't they? The 67,000 emails they have were not "recovered", they were other people's copies of their own parts of those conversations. Basically, any IRS staffer that she emailed or cc'd that hasn't also had a magical drive crash has had their email subpoenaed and anything from Lerner was stored. 6 high level staffers also implicated in this criminal activity have also fallen on the "hard drive crashed" excuse, which is beyond suspicious. To make it all even worse, it's come out on record that the IRS was paying for third party offsite backups of all email content during the time of all 7 of these drive crashes, and that their services were retained for an entire month if not longer after the data was "lost". Knowing they were under investigation, and knowing full well that they had complete offsite backups, the IRS terminated the contact with the backup company, leading to the intentional destruction of the backups as well.

      If any private citizen did exactly the same thing while under investigation by the IRS, they would go to prison for obstruction of justice or willful destruction of evidence.

    100. Re:I lost the password by ebyrob · · Score: 1

      No, you get to open your cold dead hand so they can pry out the encryption key. Let your next of kin work on the lawsuit.

      Where is the spine of modern secret-keepers?

    101. Re:I lost the password by mrjimorg · · Score: 1

      There's also "Alright, fine, its the words on that paper attached to the monitor plus 12345. What do you mean you don't have that paper? You lost it? Oh man, now I'll never be able to decrypt those drives!"

    102. Re:I lost the password by CaptnZilog · · Score: 1

      So if they force disclosure of a password and the data that was "known" to be on there isn't there, do you get to sue for violation of your fifth amendment rights?

      Well, the more important question is: what about things on there that they didn't know about beforehand?

      In other words, say they know this guy has documentation on mortgage fraud - ok, legally if they know he has specific documentation on there maybe they can force him to unlock it. But, for the sake of argument, say this involves the Russian mob and part of what is on the hard drive would implicate him in an as-yet unsolved (or uninvestigated as "natural causes/accidental") murder? If they compel him to unlock the drive for the "financial data" and they find proof of his complicity in a murder, is that grounds to charge him with conspiracy to commit murder, a charge they wouldn't have had any knowledge or proof of before then? Or, what if they find kiddie porn on it, can they then charge him with kiddie porn trafficing? Or is that then "fruit from the poisonous tree" gained illegally and not able to be used against him?

      The easy solution here, of course, is a court judgment that he cannot be charged with any new crimes based on what it revealed on the hard drive, or even simpler - finding him "guilty" based on the evidence you claim is already enough to prove he is guilty, and then offering him leniency on sentencing for those charges if he unlocks the drive to allow future investigations into others involved (or "turning him into an informant" basically).

    103. Re:I lost the password by Aaden42 · · Score: 1

      While it’s true that they will open a physical safe themselves if you refuse, you can indeed be held in contempt if you have the ability to open a safe and refuse to do so when presented with a valid warrant. The “physical safe” analogy is one of the things that’s (unfortunately) applied as an existing-law analogy to crypto.

      The distinction is that in order to get a warrant on the safe, they need probable cause that what they’re looking for (with a degree of specificity) is actually in the safe. That’s less clear with an entire hard drive (though if they’re looking for emails, the supposition that they’re on a hard drive isn’t much of a stretch). In this case, the guy admitted what they were looking for was in the “safe” and he know how to “open” it.

      Seems pretty much like he screwed himself.

    104. Re:I lost the password by Anonymous Coward · · Score: 0

      Your statement is true, but fails to address the analogy being referred to. The crucial issue with the safe is no matter what type of lock it has, it can be physically forced open. Whereas encryption with an appropriately strong password/key/algorithm cannot be broken no matter how much processor power you have.

    105. Re:I lost the password by godel_56 · · Score: 1

      It amazes me that you subscribe to the idea that a local desktop hard drive crash wiped out all email for a high-ranking IRS official... and that the IRS is essentially shrugging at any notion of ineptitude. Clearly you know fuck all about tech.

      I thought so too, but when you read the Ars Technica article on what a clusterfuck the IRS IT system is, It becomes a little more believable.

    106. Re:I lost the password by Svartalf · · Score: 1

      And, in recent times (as in within THIS month...) the Supreme Court of the US handed down a UNANIMOUS decision that they had to get a warrant to go digging about on a defendant's phone- this is the same thing.

      You have to have a legitimate reason and a warrant to do this. It's expected that this will go to the Supreme Court and be overturned just like the mobile phone story went down.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    107. Re:I lost the password by Anonymous Coward · · Score: 0

      And then they can give him a Darwin award for not being able to put the kiddy porn down long enough to pass through customs.

    108. Re:I lost the password by AK+Marc · · Score: 1

      Can they compel you to unlock a safe?

      Yes. They just have to ask differently.

      A safe Deposit box?

      Yes, they just have to ask differently.

      While authorities can get into these without your help, what if they couldn't?

      Then they'd put you in jail for contempt. It's happened before.

      Electronic information is directly analogous to paper. Information is information regardless of how its stored.

      Nobody has said otherwise. Well, except for the people deliberately trying to confuse the issue.

    109. Re:I lost the password by AK+Marc · · Score: 1

      They ask for the contents of the safe (or volume). By valid subpoena. When you don't provide them, they can throw you in jail forever.

      That's how it works with physical items. Why do you want special treatment for digital files above paper ones?

    110. Re:I lost the password by godel_56 · · Score: 1

      I lost the password in a hard drive crash.

      Apparently he admitted to the cops that he could decrypt the drive, but wouldn't. Which once again goes to show that when you are arrested by the cops SHUT THE HELL UP, or use TrueCrypt in "plausible deniability" mode (yes, I'm aware of TrueCrypt's current situation).

      The fact that the defendant is a lawyer makes his admissions even more stupid.

    111. Re:I lost the password by AK+Marc · · Score: 1

      They should just subpoena the files they believe exists on it, and throw him in jail forever if he doesn't provide them. That's how it works for paper, and there's no reason we should do it differently for digital.

    112. Re:I lost the password by John.Banister · · Score: 1

      No, just pjh3000 gets to sit in jail. Those people have friends in the government.

    113. Re:I lost the password by Rary · · Score: 1

      You do realize that encrypting your hard drive with a key you keep in your head really is just security through obscurity

      No it's not. It involves an obscure key, sure. But that's not what is generally meant by the phrase "security through obscurity". What is meant by that phrase is a system that is secure only as long as the system's implementation is kept secret. In the case of password protection, the implementation is known, it's just the key that is secret. In security through obscurity, if somebody discovers the implementation of the system, they can get in.

      An encryption system that relies on security through obscurity would be one that, if you got hold of the source code, you could decrypt anything encrypted with it, key or no key.

      --

      "You cannot simultaneously prevent and prepare for war." -- Albert Einstein

    114. Re:I lost the password by AK+Marc · · Score: 1

      More like subpoenaing the papers that prove your fraud. When you don't provide them, they throw you in jail for contempt. It's been done before. You can be compelled to provide incriminating evidence. That's how the current rules work.

    115. Re:I lost the password by MooseTick · · Score: 1

      "I would argue, though, that the man could have had other content on the drive, which was unknown, and which could have incriminated him for some other crime. In which case the ruling would be improper."

      That doesn't work. Otherwise, everyone who commits a murder should keep some cocaine handy. Then when they search your house for the murder you could argue that the cocaine constituted an illegal search because they weren't looking for that.

    116. Re:I lost the password by nytes · · Score: 2

      Anything found in the course of a legal search is fair game for prosecution.

      So if they enter your house with a warrant to search for drugs and find that body you've been keeping in the freezer, you're hosed.

      --
      -- I have monkeys in my pants.
    117. Re:I lost the password by lgw · · Score: 3, Insightful

      It's worth noting that the EPA also has a recent history of remarkably convenient hard drive crashes affecting an ongoing investigation.

      Sarbanes-Oxley made it very clear that this shit doesn't fly for companies. You produce the records, or you get serious legal punishment (one of the few corporate cries that can land the CEO in jail, in extreme cases). No excuses accepted.

      Why doesn't the government impose the same standard on itself? Yes, that was a rhetorical question.

      --
      Socialism: a lie told by totalitarians and believed by fools.
    118. Re:I lost the password by Defenestrar · · Score: 1

      Sorry - I made the mistake of assuming that people knew what lawful search and seizure means (i.e. a warrant except in very specific cases). In most cases judges don't hand out blanket warrants and, like you said, need to have justification more than "fishing expedition" (FISA cases aside).

    119. Re:I lost the password by Anonymous Coward · · Score: 0

      Having said that: if they have probable cause or a warrant, they can force open a safe without violating either the 4th or 5th Amendments. The 4th only requires probable cause, and it doesn't require the suspect to incriminate herself, so the 5th isn't violated.

      A bit pedantic, but in truth the 4th requires a warrant signed by a judge specifying the place to be searched and property to be ceased.

      Probable cause is a requirement for the issuing of the warrant, and is not itself sufficient justification for a search.

    120. Re:I lost the password by Jane+Q.+Public · · Score: 1

      That doesn't work. Otherwise, everyone who commits a murder should keep some cocaine handy. Then when they search your house for the murder you could argue that the cocaine constituted an illegal search because they weren't looking for that.

      No, THAT doesn't work. I am discussing a 5th Amendment issue. You're talking about a 4th Amendment issue. They are very, very different things.

    121. Re:I lost the password by muridae · · Score: 1

      Destruction of evidence, hindering a police investigation, and so on. And unless it is done at the flash memory chip level, they could get an image of the data.

      What might be useful is something like an old article I read on randomly changing 'root's password on a *nix system, so it was next to impossible to log in as root. A user with permission could still use sudo to do what was needed, and "sudo -i" would be available for a single admin. Or the practice of changing the encryption key to /tmp or the swap partition on reboots; the user has no way to recover the data from those locations once a reboot has occurred. A secure encryption method that keeps even the intended user from using it would be a very had thing to sell, unfortunately.

    122. Re:I lost the password by Jane+Q.+Public · · Score: 1

      In this case, the defendant admitted the encrypted data is communications with someone who is not his lawyer, and the state showed that those communications are likely to be evidence in this case. So, this time, the ruling is correct.

      That's not quite true. According to SCOTUS, in order to get around the 5th Amendment self-incrimination limitation, they have to KNOW, "with reasonable particularity", that it is definitely there. "Likely" is not sufficient, and even probable cause is not sufficient. Only firm knowledge allows this exception.

    123. Re:I lost the password by Anonymous Coward · · Score: 0

      A bit pedantic, but in truth the 4th requires a warrant signed by a judge specifying the place to be searched and property to be ceased.

      Pedantic my ass. More like ignorant.

    124. Re:I lost the password by ILongForDarkness · · Score: 1

      Make them spend months and millions to compel you to decrypt it. Then ... oh crap I thought that was the password. But I guess it might be something else.

    125. Re:I lost the password by Jane+Q.+Public · · Score: 1

      And, in recent times (as in within THIS month...) the Supreme Court of the US handed down a UNANIMOUS decision that they had to get a warrant to go digging about on a defendant's phone- this is the same thing.

      No, this is NOT the same thing. This is a 5th Amendment issue. The cell phone thing is a 4th Amendment issue. They are not even remotely similar.

    126. Re:I lost the password by Jane+Q.+Public · · Score: 1

      ltimately, the problem is one of a practical nature: until the incriminating evidence is actually shown to be on the encrypted hard drive, it is only suspected to be there, by any legal interpretation of "suspicion" -- if it was legally known to exist there, you could be found guilty without the bothersome effort of having to decrypt the data. Thus, by the wording of the ruling, the court is allowed to compel testimony in the form of a passphrase under literally any circumstance, since any suspect is, by definition, under "reasonable suspicion."

      That is not quite what decision says. Reasonable suspicion is sufficient to get a search warrant and the authorities can take the hard disk and try to break the encryption.

      [[[Sigh.]]] No, you're BOTH wrong.

      "Reasonable suspicion" is pretty much the lowest standard of evidence. You can be pulled over in your car, for example, if a policeman "reasonably suspects" that you have committed a traffic violation or broken some other law.

      Can he then search your car? Based on the above, and generally speaking, NO. In most cases, in order for a search (and always for a search warrant), there must be "probable cause". Probable cause is a higher standard of evidence than reasonable suspicion. It requires clear, articulable (and often tangible) evidence of a crime, not just suspicion. It would take probable cause, not reasonable suspicion, to seize the drive and attempt to decrypt it. But even probable cause is not sufficient, by itself, to compel a suspect to reveal a password.

      The defendant can be compelled to give them the key only if it is already proven (not just reasonably suspected) that he has it. This defendant lost because he bragged to the cops that he had the key.

      [[[Sigh again.]]] NO. That's not how it works. That's not even what this is about.

      It doesn't matter -- even a little -- whether he has the encryption key. The whole issue of the discussion here is whether the court can order him to cough it up IF he does have it.

      The court can order him to provide the encryption key ONLY if the court already KNOWS there is incriminating evidence on the hard drive. In that sense, GP almost got it right. As TFA says, in bold print: "The defendant is only telling the government what it already knows." Those are the only circumstances under which the court can get around the 5th Amendment self-incrimination protection. Because if the court didn't already know that -- pretty much for sure -- then giving them the key would be self-incrimination, and the Constitution says the court is not allowed to force him to do that. As strange as it may seem, that's how it really works.

      But GP's next statement -- that this means a court can compel decryption based on reasonable suspicion -- is way out of left field and totally wrong. The judge's ruling says nothing like that at all. The judge has changed no legal standards in any way.

      But it also has absolutely nothing to do with whether he has the key, or if they can prove he has the key. The key is immaterial here (except to note that if he doesn't have it, it doesn't do much good to order him to produce it).

    127. Re:I lost the password by Anonymous Coward · · Score: 0

      The Fourth Amendment does not protect you from lawful search and we gots law.

    128. Re:I lost the password by sexconker · · Score: 1

      They already can open your TrueCrypt volumes - hence why the dev shut it down and issued a warning that it's not safe to use.

      Actually, the sum of the evidence says otherwise. The security audit has found nothing wrong with Truecrypt 4.1a, and in fact they plan to carry forward the TrueCrypt project when Phase II of the audit is completed.

      If he NSA/FBI/CIA/ETC can lean on the developers of TrueCrypt to the point of them being unable to outright say their shit has been compromised, why do you trust the auditors? They are not immune to such pressure unless they're living off-world, and even then I bet they'd have family here that could be leveraged. Hell, for all you know the auditors aren't just potentially compromised, they could be direct NSA/FBI/CIA/ETC plants.

    129. Re:I lost the password by sexconker · · Score: 1

      No, as the series of court rulings have gone, the Fourth Amendment does not protect you from lawful search and seizure (such as a safe or hard drive). The combination to the safe, or encryption key to the drive, is not incriminating evidence and providing it to allow for lawful search and seizure does not violate your rights. They can admit evidence produced by oneself into court (such as two sets of books in one's own handwriting for a case of fraud) and that is not a violation of the Fourth (or Fifth) - just so with information one puts on a hard drive. What they can not compel one to do is testify against oneself (which is the Fifth by the way) nor assume guilt because you do not take the stand (not that a prosecutor won't toe that line with the jury). So, if one can keep all details of a crime in one's head and manage to destroy all other evidence which could be subject to lawful search and seizure - then you've got a shot at being a criminal mastermind.

      I'm not sure I entirely agree with the line of thought - but I can certainly follow the logic as well as the precedence.

      What would be interesting is if one's pass-code was material evidence with respect to the case - but a possible way around that would be limited immunity or ruling it as inadmissible evidence...It would make for an interesting case study.

      Horse shit.

      100 years from now Google Glass will be able to scan your brain and display your old memories for digital sharing, archival, and, of course, ad targeting.
      Lawful search and seizure includes asking about your whereabout, whether you killed someone, etc., so using your logic, scanning your brain to find out where you were and what you were doing is just fine and dandy.

    130. Re:I lost the password by sexconker · · Score: 1

      The witness would be the state, and the state doesn't get punished.

    131. Re:I lost the password by Anonymous Coward · · Score: 0

      But I'm under oath! I placed my hand on a book and everything!

    132. Re:I lost the password by Anonymous Coward · · Score: 0

      "So, if one can keep all details of a crime in one's head and manage to destroy all other evidence which could be subject to lawful search and seizure - then you've got a shot at being a criminal mastermind."

      Google truecrypt plausible deniability, then you can become that mastermind

    133. Re:I lost the password by LordLimecat · · Score: 1

      Trying to out-clever the FBI when it comes to crypto hardware is not something I would attempt. I feel like you would lose that fight, and they would end up with a duplicate key.

    134. Re:I lost the password by LordLimecat · · Score: 1

      And unless it is done at the flash memory chip level, they could get an image of the data.

      Im sure they have the hardware to de-solder the flash chip, and get all of the data they want off of it.

    135. Re: I lost the password by Chewbacon · · Score: 1

      Careful using "random files" as key files. If the file is modified, it becomes useless as far as a key file and so does your encrypted data.

      --
      Chewbacon
      The Bible is like Wikipedia: written by a bunch of people and verifiable by questionable sources.
    136. Re:I lost the password by Anonymous Coward · · Score: 1

      They can indeed compel you to unlock a safe, just like they can compel one to hand over documents during discovery.

      No, the analogies go as follows. They can compel you to produce a physical key in which to open a lock-box. They cannot compel you to open a safe if the combination only exists in your mind as that constitutes giving testimony (though apparently that is no longer true in Massachusetts). Of course the prosecutor is still free to hire someone to burn the safe open with a thermic lance or otherwise crack the safe.

      The article also states that:

      The court ruled, in a 5-2 decision, that merely entering the password does not imply that Gelfgatt created the documents on the encrypted machines or had sole control of them at all times and was not "testimonial".

      This totally invalidates the reason for forcing decryption. Now all the defense has to do is say that the evidence is not admissible since the court has already stipulated that it cannot be definitely linked to the defendant.

      As always IANAL.

    137. Re:I lost the password by cfalcon · · Score: 1

      If a brain scan is "reliable", rest assured it will be mandatory, and amendments will be ignored to make this happen.

    138. Re:I lost the password by SumDog · · Score: 1

      Contempt of Court is a lot less time than the possible crime you could be implicated by decrypting that disk. What's the most you'll get for contempt? A year tops?

    139. Re:I lost the password by Anonymous Coward · · Score: 0

      Contempt of Court is a lot less time than the possible crime you could be implicated by decrypting that disk. What's the most you'll get for contempt? A year tops?

      And after a year they ask you again; What is the password for this random block of bits. You will again claim that you do not remember and you get a other year of jail. This will go on for as long as the fascists are not deal with the violent justice they deserve.

    140. Re:I lost the password by Anonymous Coward · · Score: 0

      No, as the series of court rulings have gone, the Fourth Amendment does not protect you from lawful search and seizure (such as a safe or hard drive). The combination to the safe, or encryption key to the drive, is not incriminating evidence and providing it to allow for lawful search and seizure does not violate your rights. They can admit evidence produced by oneself into court (such as two sets of books in one's own handwriting for a case of fraud) and that is not a violation of the Fourth (or Fifth) - just so with information one puts on a hard drive. What they can not compel one to do is testify against oneself (which is the Fifth by the way) nor assume guilt because you do not take the stand (not that a prosecutor won't toe that line with the jury). So, if one can keep all details of a crime in one's head and manage to destroy all other evidence which could be subject to lawful search and seizure - then you've got a shot at being a criminal mastermind.

      I'm not sure I entirely agree with the line of thought - but I can certainly follow the logic as well as the precedence.

      What would be interesting is if one's pass-code was material evidence with respect to the case - but a possible way around that would be limited immunity or ruling it as inadmissible evidence...It would make for an interesting case study.

      I am dumbfounded by that! If you have to give them a safe combination, or a password, because law enforcement can't figure out for themselves that violates your rights. And with over zealous moron prosecutors, they will use anything to get some type of conviction, the guy maybe be innocent, they simply dont care, they want someone to pay for the crime. And idiot juries/judges also are inept at sorting thru what is true or false.

      Law enforcement has to prove the safe or laptop (in this case) has some sort of incriminating evidence then obtain a specific warrant, depending on the original warrant/s to seize "electronic equipment". Both could have personal information such as clients that want their privacy or remain anonymous, both could also have valuables that the would also be seized and the defendant would never get back, that doesn't mean those names or clients were part of the crime or victims of a particular scheme, and law enforcement and prosecutors will blackmail those clients in order to get something out of them. There could be other things as well that should remain private, but would be used -falsely- by prosecutors to get a conviction.

      Nothing against your perceived logic of the MASS Supreme Courts ruling. But I can see this going to a higher court, especially after the latest rulings from SCOTUS over privacy.

    141. Re:I lost the password by laughingcoyote · · Score: 1

      While it’s true that they will open a physical safe themselves if you refuse, you can indeed be held in contempt if you have the ability to open a safe and refuse to do so when presented with a valid warrant. The “physical safe” analogy is one of the things that’s (unfortunately) applied as an existing-law analogy to crypto.

      That's actually only true if they already know for certain it's your safe and you have access to it. Otherwise, admitting that you know how to open the safe (by opening it or providing the combination) is admitting that the contents of it are in fact yours. That's self-incrimination and you can't be forced to do it, though of course with a valid warrant they can still try to break into the safe. They just can't make you admit it's yours, and that's what you're doing if you open it.

      In this case, however, the idiot went and bragged to the police that yeah, that stuff is all mine! To extend the safe analogy, that's like saying to the police "Yeah, I know the combination, but I'm not giving it to you!" Now you wouldn't be telling them anything they don't know, so opening the safe is no longer self-incriminating. If he'd kept his mouth shut (first rule of being questioned by the police, keep your fucking mouth shut, they mean it when they say anything you say will be used against you), this case would likely have been decided differently.

      --
      To fight the war on terror, stop being afraid.
    142. Re:I lost the password by Citizen+of+Earth · · Score: 2

      He just needs to tell them that the passphrase he uses contains a confession to a crime. Then, he could not divluge his password without confessing to a crime, which he cannot be compelled to do.

    143. Re:I lost the password by Anonymous Coward · · Score: 0

      Probably. The trick here is while the can compel you to decrypt those documents they can't really be sure that what you decipher and give them are the actual contents.

    144. Re: I lost the password by Anonymous Coward · · Score: 0

      The defendant and all present have the 2nd amendment Right to bear arms, which can not be swept aside.

      Oh wait, rights in theory are not the same as rights in practice :(

    145. Re:I lost the password by Anonymous Coward · · Score: 0

      silly rabbit, laws only apply to US.

    146. Re: I lost the password by Anonymous Coward · · Score: 0

      Yes for a legitimate reason.
      Someone else said no it would be too soon. And it dropped.
      Very suspicious?????????

    147. Re: I lost the password by Anonymous Coward · · Score: 0

      The IRS does not have rules they make up. They have laws they have to follow. The laws do not make sense. We congress should fix them instead of holding which hunts.

      The IRS andthe TSA are designed and built by congress. Why do so many people and congressman act like they are some independent agency.

    148. Re: I lost the password by Anonymous Coward · · Score: 0

      I hold you in 'Contempt of Congress'.
      We since we hold Congress in contempt it would only be fair.

    149. Re:I lost the password by torkus · · Score: 1

      Kind of ironic that the government agency that requires 6 or 7 years of receipts/documentation be available can somehow limit themselves to a 6 month retention policy on THEIR documentation (well email, but these days that's definitely relevant).

      I work for a self regulated organization (finance) and we're required to retain every-fucking-thing for 7 years. It's not 'save your PST file' ... it's a WORM compliance archive of email that's completely automatic and not even visible to the user. It boggles my mind that the IRS doesn't have something like this. From the sounds of it they're literally downloading from exchange and deleting the server copy. What the actual fuck? I think the last time I did that anywhere in or out of the enterprise realm was the old Outlook Express client on Win 98 or something. Like 15 years ago.

      --
      You can get rich if you own a politician, but you have to be rich to buy one in the first place.
    150. Re:I lost the password by torkus · · Score: 1

      *tin foil hat*

      What's to say someone hasn't released a virus that infiltrates the live executable on PCs and tweaks a few bits to weaken the encryption? It's unlikely but not impossible. Verifying source code is not the same knowing the executable files in memory are clean. You need a verifiable real-time hash check every step of the way...etc.

      Not impractical to follow though. KNOX from Samsung does something relatively similar to prevent rooting and similar hacks. It may not stop them but it will shut down your security container (or the device) instantly if something changes it's hash or starts writing to memory outside it's sandbox/etc.

      So even after the audit (which I supported) I'd consider it 99.99999% safe. But don't think it will safe you if you do something to REALLY piss off the gov't.

      Also they'll just beat you with a wrench...queue xkcd

      --
      You can get rich if you own a politician, but you have to be rich to buy one in the first place.
    151. Re:I lost the password by dgatwood · · Score: 1

      Destruction of evidence, hindering a police investigation, and so on. And unless it is done at the flash memory chip level, they could get an image of the data.

      Of course, if one were the sort of person who would build a self-destructing USB stick, it would make more sense to just store part of the encryption key in a RAMDisk. Rebooting the computer wouldn't make any difference, but the rules of evidence require them to shut down the system to clone the drive, so when they ask you if you can decrypt the drive, you can honestly say, "No. You destroyed the key when you shut off the computer."

      Of course, you'll probably want to have a backup copy of the key somewhere, in some form, or at least a means of reconstructing it, but because you would only use it if you actually had to shut your computer all the way down, it doesn't necessarily have to be in a place that's easily accessible, nor any place where someone would realistically look. It could, for example, involve walking around the city in a particular pattern known only to you, and typing in the text of all the graffiti you see....

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    152. Re:I lost the password by david_thornley · · Score: 1

      Different sorts of data. I assume that they keep financial records around for at least seven years, but staff emails are not the same as financial records. I haven't heard of missing official records from that period, just emails. It may well be that the IRS was required to keep the emails longer than six months, but I don't know that.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    153. Re:I lost the password by david_thornley · · Score: 1

      It's also possible that whether I know the password or not is material in itself. If a USB drive is found in my proximity, and the court has reason to believe there's evidence of a crime on it, then just admitting that I know the password is incriminating. However, it sounds like this guy already claimed he could decrypt the stuff.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    154. Re:I lost the password by david_thornley · · Score: 1

      Perjury is a criminal offense. Like all such, it requires proof beyond a reasonable doubt, and the prosecutor may have thought there wasn't sufficient evidence. Or that it wasn't really important enough to prosecute. After all, Zimmerman was acquitted, so whether evidence against him may have been faked didn't change the verdict.

      Remember also is that perjury is lying under oath. If I say two contradictory things, and only one is under oath, then a prosecutor would have to prove that the statement under oath was false, not the other statement. (You can get in trouble for lying when not under oath, but it isn't perjury.)

      I don't know the details. She apparently couldn't read the letter when under oath. Did she claim under oath that she had written it? Are you sure beyond a reasonable doubt that she would necessarily have been able to read her own handwriting? I sometimes can't figure out what I've written a few days before, and I'm under considerably less stress than having heard part of a homicide of somebody I cared about.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    155. Re:I lost the password by Anonymous Coward · · Score: 0

      Use a decryption key that wipes any data you don't want them to see.

    156. Re:I lost the password by Reziac · · Score: 1

      Question:

      How is the password to an encrypted drive intrinsically different from the key to a safe deposit box?

      Discuss.

      --
      ~REZ~ #43301. Who'd fake being me anyway?
    157. Re:I lost the password by mi · · Score: 1

      Or that it wasn't really important enough to prosecute.

      Khmm... What happened to the "Injustice anywhere is a threat to justice everywhere" maxim?

      After all, Zimmerman was acquitted, so whether evidence against him may have been faked didn't change the verdict.

      Interesting logic... So, lying under oath is Ok sometimes?

      Did she claim under oath that she had written it?

      Yes. And it was not the first time she lied (under oath). But this time it was worse, because somebody else wrote that letter — and handed to her to pretend, it was hers. In other words, it was not a mere perjury, but a conspiracy to commit perjury (and malicious prosecution) — and no one was even investigated, much less prosecuted for it.

      Are you sure beyond a reasonable doubt that she would necessarily have been able to read her own handwriting?

      I am sure — but am not a juror at her trial, if only because no prosecutor had the guts to charge her.

      But she has already admitted — under oath — that she has not, in fact, written it. So we don't need to prove, she lied...

      --
      In Soviet Washington the swamp drains you.
    158. Re:I lost the password by Sciath · · Score: 1

      That begs the question; IF... law enforcement already has the "evidence" then why do they need the drive decrypted? Saying that you know something (in your mind) is completely different than turning over "hard (empirical) evidence". The fourth amendment put the burden of proof upon the government. People can say or admit to all kinds of "facts". But they have the right to recant previous statements or refuse cooperation in an investigation in order to exercise their right against self incrimination thereby returning the burden of proof to the government.

      --
      "Those who can make you believe absurdities can make you commit atrocities." - Voltaire
    159. Re:I lost the password by AutodidactLabrat · · Score: 1

      It's called "Gerrymandering" and the Republican party used control over district representation to produce a 'win' of more districts while losing the election.
      By at least 1.4 million votes
      Actual News Outlet report on the Gerrymandered Minority Government Of The House

    160. Re: I lost the password by rickb928 · · Score: 1

      Wrong. Her records were and are subject to the retention laws on the books, and 6 month retention does not meet the requirements of the law. Specifically ask records of communications between her, her subordinates, and other agencies, particularly the White House. And the law requires paper copies be created and filed.

        Massive failure to meet the requirements of the law.

      --
      deleting the extra space after periods so i can stay relevant, yeah.
    161. Re: I lost the password by rickb928 · · Score: 1

      There was no 'the election'. Each district elects their own Representatives or Senators. Stupid git.

      Is this not taught in high school any more?

      --
      deleting the extra space after periods so i can stay relevant, yeah.
    162. Re: I lost the password by rickb928 · · Score: 1

      Lerner was just an administrator of a department. Her bosses boss is responsible for enduring that the law is followed, that systems and processes are being employed to prevent this, and it is this administrator who should answer.

      And his testimony so far has been an uninterrupted display of contempt for the law, Congress, and us.

      --
      deleting the extra space after periods so i can stay relevant, yeah.
    163. Re: I lost the password by AutodidactLabrat · · Score: 1

      WRONG!! Every STATE elects Senators from the ENTIRE STATE.
      Yes, Stupid Git is indeed the word
      And when Republicans gained control in 2010 of 13 more states, they re-re-redistricted (including lawsuits to the Supreme Court that said 5-4 that this was legal to pass power to the "new" rulers) to give themselves a 1.4 million vote effective advantage.
      That's why we need direct democracy, this 'republic' is no longer representative!

    164. Re: I lost the password by rickb928 · · Score: 1

      You are correct, Senators represent the entire state. I'm so used to my old state, Maine , traditionally electing Senators from the North and the South that I think of one as 'my' senator.

      But your complaint about gerrymandering falls on deaf ears. Each party practices this, and so called 'direct elections' would change the dynamics in a massive fashion. I would expect 'direct elections' to cement the Democratic Party advantage indefinitely.

      I still cling to the 'State's part of 'The United States of America' as critical to our success, and to our political stability. That stability is on jeopardy largely due to, IMHO, Federal overreach and state failures.

      I find the Left is generally in favor of 'direct elections'. For what should be obvious reasons.

      --
      deleting the extra space after periods so i can stay relevant, yeah.
    165. Re:I lost the password by scotjam · · Score: 1

      If that is true, mod parent up!

    166. Re: I lost the password by AutodidactLabrat · · Score: 1

      If gerrymandering means 1 man = 1 1/80 votes, but only in Republican (or Democratic) districts, the stability of the American system is over and done, with the minority ruling the majority.
      That whole "Just powers from the consent of the governed" fails the test of Gerrymandering.
      thus the need for direct democracy, now that we have the necessary technology.
      For one thing, the buying of elections would end
      For another, respect for law when the MAJORITY OF THE PEOPLE decide what is law will go well up
      There are people like Glenn Beck who call Democracy " Two wolves and a sheep holding a vote on what is for dinner" but that is what we have in an UNrepresentative Republic.
      In a Republic, it only takes 31% minority to block the lawful and Constitutional will of the majority.

    167. Re: I lost the password by rickb928 · · Score: 1

      First, what do your mean by 'direct democracy? We elect our representatives now. Do you mean direct votes on specific bills or actions? That is at the last unnecessary, and risks making is a federalized nation, which at best ensures the demise of our constitution. What technology do we possess that now makes this possible? We have been able to accurately count votes nationally since the 70s, and really before. We don't need to count them instantaneously, nor do we national vote tallies unless you wish to obliterate the state's. Which I oppose without doubt or qualification.

      That argument, direct democracy, is the calling card of the Left, especially the Marxist. Count me out.

      --
      deleting the extra space after periods so i can stay relevant, yeah.
    168. Re: I lost the password by AutodidactLabrat · · Score: 1

      A republic (representatives isolating the voters from the issues) is not a democracy and is intended to keep power out of the hands of the majority.
      When voting took 2 weeks just to count (and there is no reason other than fear of criminality for not using internet voting) there MAY have been an excuse
      There is no such excuse.
      Let us each vote on every expenditure and hear every classified briefing. NO MORE SECRET LAWS!
      Time to obliterate states. Time for the PEOPLE to control the state just as Jefferson wanted.
      If you think "just powers from the consent of the governed" is anything but democracy, you do indeed think like all the other elites (How can peasants know what is good for them say the kings)

    169. Re:I lost the password by Anonymous Coward · · Score: 0

      Very nicely said. One point they seem to have omitted: decrypting the files might produce a whole lot of things that they don't currently know about. Would those things be inadmissible or should they have ruled that he has to produce the things they know he has without having to decrypt the drive in front of people logging his every move?

    170. Re:I lost the password by Kinky_B · · Score: 1

      And then a anonymous leak to the press of whatever else they found on the drive happens, and your life is over anyway

    171. Re: I lost the password by Anonymous Coward · · Score: 0

      Lol. Switzerland is marxist now? That must explain the terrible economy... both .ch and .us are federal of course.

  2. Except, of course, they have to prove you can by i+kan+reed · · Score: 2

    I mean, all you have to say is that you lost the actual key and cannot comply.

    1. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 1

      From TFS:

      He said that he could decrypt the computers seized from his home, but refused to do so.

    2. Re:Except, of course, they have to prove you can by HornWumpus · · Score: 0

      He should have remained silent. Being a lawyer he should have known that.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    3. Re:Except, of course, they have to prove you can by spacepimp · · Score: 1

      Sure, but lying is perjury. He shouldn't be compelled to incriminate himself according to the fifth amendment.

    4. Re:Except, of course, they have to prove you can by Penguinisto · · Score: 5, Interesting

      From TFS:

      He said that he could decrypt the computers seized from his home, but refused to do so.

      Just because he was a dumbass doesn't mean the rest of us have to be.

      But let's say you want to be honest - here's a conceptual idea:

      Encrypt your stuff on a drive with two-factor auth. The first is a key that expires after x number of days, renewing the expiration every time you access it (let's say 3 to 14 days, tops.) The second factor is a passphrase. Shouldn't be hard to cook up if you use a high-bit-count SSL certificate as your key, and the encryption software checks the date. Keep the key on a separate but random-looking USB stick, SD chip, whatever. When you're not using it, stick it in a camera, unused smartphone, or similarly hidden. To prevent BIOS/EFI tinkering, insure that the encryption software double-checks that the system time is within the window (between last successful access and new expiry date) on boot, and destroys the key if the date is outside that window. Same with insuring that the HDD is in the same hardware it originally sat in, destroying the key if the software detects that a series of MAC addys and serial numbers don't match up.

      After the keypair expires (after all, you've been in jail all this time and unable to access it, so...) you can truthfully say that the data is unreachable by any means (though I do suggest that your statement not end with the phrase "...so suck it, copper!") Of course, this means *you* can't access it either, but one would hope you had a backup of the data stashed somewhere beyond the reach of a warrant or the authorities' knowledge, yes?

      Fun mental exercise either way. :)

      --
      Quo usque tandem abutere, Nimbus, patientia nostra?
    5. Re:Except, of course, they have to prove you can by i+kan+reed · · Score: 1

      Again, I said they'd have to prove it, not that there wasn't leverage available.

    6. Re:Except, of course, they have to prove you can by Penguinisto · · Score: 2

      He should have remained silent. Being a lawyer he should have known that.

      Sometimes lawyers think they're smarter than the average person in matters of law, and often in demonstrating their 'prowess' end up proving that they're not. It happens.

      --
      Quo usque tandem abutere, Nimbus, patientia nostra?
    7. Re:Except, of course, they have to prove you can by Sarten-X · · Score: 4, Insightful

      As an accused boot-licking pro-establishment government-and-big-business shill, I agree.

      As a relatively sane individual who tends to think for myself, I also agree.

      As someone with passing familiarity with 4th-amendment case law, I also agree.

      This guy was a first-class idiot. An encrypted hard drive is little different from a locked safe. A court can order you to open it to reveal evidence, but the police need sufficient probable cause to convince a judge to issue that order. Saying "All the evidence is in there and I have the key" is pretty convincing probable cause that there's important relevant evidence in the safe (or disk). Saying nothing is a good way (and the only really safe way, as far as I know) to ensure that you're not giving the cops any additional assistance in proving your guilt.

      --
      You do not have a moral or legal right to do absolutely anything you want.
    8. Re:Except, of course, they have to prove you can by jythie · · Score: 1

      That would be a risky thing to do.

      Destruction of evidence is a separate crime, and simply having some type of electronic dead man's switch on it does not get one off the hook.

    9. Re:Except, of course, they have to prove you can by Penguinisto · · Score: 1

      True - you could say it was put into place to prevent corporate espionage, but that would be a toughie to sell.

      --
      Quo usque tandem abutere, Nimbus, patientia nostra?
    10. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Of course, the first thing that will happen is that a forensic copy of the drive and any USB sticks, etc will be taken and preserved. These images can then be used in a virtual machine, reverting to their clean state every time they are rebooted. The boot code can be traced and, since it's in a virtual machine, it can be given any answers it wants about its operating environment (i.e., it is impossible for the OS to ensure that the HDD in the in same hardware, etc. since the VM can lie, not to mention that the code that checks this could be disabled in the image).

      The date-based defenses are similarly useless in this scenario, since the penalty for failing an encryption check is not complete erasure of the keys, but just having to restart the VM on an unmodified copy.

      The main issue is that your time-based key has no mechanism to force its expiration/deletion except in the context of the system it is trying to protect. So if the system is offline (even for years past the expiration) the key remains usable with enough effort. What you probably actually want is an independent, tamper-proof system storing the key for one layer of the encryption. It isn't hard to imagine a device (or, online service outside of the jurisdiction) that you can securely send the current key and its expiration date. On boot up, the system requests the key from the device/service then creates/sends a new one. The device/service is trusted to securely delete the key when it expires.

    11. Re:Except, of course, they have to prove you can by mi · · Score: 2

      This guy was a first-class idiot.

      Or, maybe, he was just trying to create a precedent for the rest of us, huh? Some people are willing to die for the freedom of others, whereas this guy merely risked legal troubles... Neah, nobody but an idiot would do such a thing...

      --
      In Soviet Washington the swamp drains you.
    12. Re:Except, of course, they have to prove you can by Cigarra · · Score: 1

      Its not "evidence" until after the law case begins. That is, if you destroy something that MIGHT incriminate you should the government ever finds out, and said destruction takes place BEFORE they find out, it's not punishable. Source: teh interwebs.

      --
      I don't have a sig.
    13. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Can they say that compelling by force is just then?

      Seems like it is very vague as to what is justified, their limits if you will, to compel someone.

    14. Re:Except, of course, they have to prove you can by Safety+Cap · · Score: 5, Insightful

      He should have remained silent. Being a lawyer he should have known that.

      He must be a pretty shite lawyer. (Hopefully he isn't a criminal defense lawyer, because then he really IS a shite lawyer.)

      FTFA:

      “During his postarrest interview with State police Trooper Patrick M. Johnson, the defendant stated ... ‘[e]verything is encrypted and no one is going to get to it.’ The defendant acknowledged that he was able to perform decryption.”

      What a dumb-bumble-fark. He deserves to burn for bragging/taunting the cops.

      Rules for Talking to Cops

      ONE Don't talk to cops, except what you are legally required to say (you must ID yourself, to whatever extent your state's laws specify) TWO The only thing that should come out of your piehole from the time your are arrested (especialy during any "post-arrest 'let's get the suspect to incriminate himself' interview") are the words: "I wish to remain silent and I want a lawyer." TREE STFU until you get a lawyer FOUR Remember that Everything you say will be used to burn you. Cops can lie and get away with it, and if you lie to a cop, you're fried. Do not believe anything they say, and don't try to talk your way out of it because you'll lose. NaN Getting (and following) legal advice from random people on the internets is about the stupidest thing you could do.
      --
      Yeah, right.
    15. Re:Except, of course, they have to prove you can by jcochran · · Score: 2

      Wouldn't work.

      Reason?

      It's standard forensic practice to make bit level copies of media and examine the copies, not the original material. Your software can do anything it wants to with the USB stick and an overwrite simply means that a new copy is made from the original (using software and hardware under the investigators control) and they get to try again.

    16. Re:Except, of course, they have to prove you can by Mr.+Slippery · · Score: 3, Insightful

      An encrypted hard drive is little different from a locked safe

      An encrypted hard drive is entirely unlike a locked safe. It is much more like a notebook kept in a private code: if I write "June 26: red green Q 17 x-ray romeo eagle" in my journal, the state has no rightful authority to compel me to tell them what that means to me.

      --
      Tom Swiss | the infamous tms | my blog
      You cannot wash away blood with blood
    17. Re:Except, of course, they have to prove you can by mysidia · · Score: 4, Interesting

      Destruction of evidence is a separate crime, and simply having some type of electronic dead man's switch on it does not get one off the hook.

      A self-destroying/expiring system is not illegal.

      But the real problem with Penguinisto's idea is it won't work. When computer equipment is seized; the power is immediately removed, and the software can do nothing.

      Power removal and system reboots are common enough, that there's no way the only copy of important data is in RAM; although, even if there is, authorities might attach a Firewire/PCI/Thunderbolt device, and use Inception to RAM dump the lower 4GB to write-only media.

      Which brings me to the next point..... after the seized computer is shipped to a lab; the first thing they will do is remove the storage media from the computer, hook it up to a Write blocker (Which is a special hardware dongle that is inserted into the I/O path and blocks any Write operations, Security commands, or other destructive messages from being sent to the hard drive), before powering the system back on, booting from a read-only USB stick, and dumping a complete backup image of the entire disk to archive.

      In the event that there is an ATA security lock/ATA password setup on the drive; the lab can disconnect the normal disk drive controller, and attach a custom one. If this is an encrypted SSD; they will have equipment and details from the drive manufacturer (obtained under lawful order), required to read the keys off the controller's PRAM chips.

      They can also, lift the platters out of the drive, and have those imaged --- in case they suspect attempt to overwrite files with all zeros.

      In short: The idea of using two factor in software with expiring keys for data stored on a HDD is extremely naive, if you think a LEO's lab will screw up and lose the data because of it.

      Your only chance is if you have a really tamper-resistant HSM with a self-destruct mechanism, and the LEO cannot identify the manufacturer, or work out how to safely get in; considering the fact, forensic labs have many advanced diagnostic tools available that can be used to analyze unknown media modules, and chances are good they can cut in and analyze the logic and data stored on even so-called tamper proof electronics...

    18. Re:Except, of course, they have to prove you can by LordLimecat · · Score: 3, Informative

      To prevent BIOS/EFI tinkering, insure that the encryption software double-checks that the system time is within the window (between last successful access and new expiry date) on boot, and destroys the key if the date is outside that window. Same with insuring that the HDD is in the same hardware it originally sat in, destroying the key if the software detects that a series of MAC addys and serial numbers don't match up.

      This wont work, because you do not control the software used to decrypt it. If you are using a standard cipher (and you really, really should be using a standard vetted cipher), they will us their own decryption software that neither cares about certificate expiration nor about the new BIOS on the lab image that theyre using.

      No "time expiring" crypto method that actually works has been devised, most probably because it literally cannot be done in a secure way. The attacker controls the decryption software and the hardware-- not you.

    19. Re:Except, of course, they have to prove you can by LordLimecat · · Score: 1

      Not only that but a very common piece of forensic gear is a hard drive controller that blocks all write attempts (while reporting back that they were successful).

    20. Re:Except, of course, they have to prove you can by Mr.+Slippery · · Score: 2

      Destruction of evidence is a separate crime

      But since I have not committed a crime, the automated destruction of my private data to protect it from cyber-criminals in the event I lose control of it is not destruction of evidence.

      --
      Tom Swiss | the infamous tms | my blog
      You cannot wash away blood with blood
    21. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Even better, make your password be "I lost the actual key and cannot comply."

      That gives you a fighting chance on appeal.

    22. Re:Except, of course, they have to prove you can by Vellmont · · Score: 1


      After the keypair expires

      Computers have clocks in them that can be reset to any value you desire. How do you propose to cirvumvent that? If your proposal is "NTP", then I'd say that NTP can be very, very easily faked.

      Also, even if you COULD somehow prevent falsification of the date, you just need to hack the software that checks the date. How do you propose to make THAT unhackable?

      --
      AccountKiller
    23. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Yeah, and since he's ALREADY copped to the crime, he should have pro-actively decrypted the files, just to document all the restitution he's going to do, so somebody else's lawyer can't claim made up sums in a civil suit, since he left no paper trail

      Cooperate and throw yourself on the mercy of the court, dumbass.

    24. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Encryption software checking the date? Ludicrous. VMs. Besides, standard forensics procedure isn't to work on the original anyway. You make a copy, inform it that it's living at the proper time, and--oh look, the data is accessible again.

      Shouldn't be hard to cook up

      Crypto is harder than you think.

    25. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      No, I would say you are incorrect. The harddrive is the safe. If access to the data on the harddrive is impeded, then the defendant may be ordered to remove the impedement. The data on the harddrive is a different concern entirely. If the unencrypted data is not what is stored on the harddrive, too bad, the court can only order access to what is on the harddrive.

    26. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      A dead man's switch like described wouldn't be very reliable. You'd want it to be tripped by multiple levels of alarm. House windows/doors breached, case breached, special set of hotkeys pessed, etc.. Then it gives you 30 seconds (or however long you can stand being beaten with a pipe wrench) to enter a password before it wipes the key. Put it on a small battery backup. Use of thermite is optional, but not recommended, due to the risk of setting fire to the structure/being classed as a booby trap.

      Your information needs to be worth enough that it would be preferable to destroy it than have someone else gain access for this to work.

    27. Re:Except, of course, they have to prove you can by arbiterxero · · Score: 1

      Two Factor doesn't work like that.

      Two factor only works when authenticating to a service, not decrypting a volume.

    28. Re:Except, of course, they have to prove you can by jcochran · · Score: 1

      Or perhaps go one further....

      Have your password be "I admit guilt to all crimes and charges" and then use the 5th Amendment against self incrimination.

    29. Re:Except, of course, they have to prove you can by myowntrueself · · Score: 1

      Sure, but lying is perjury. He shouldn't be compelled to incriminate himself according to the fifth amendment.

      False confession of guilt as part of a plea bargain is also perjury but it happens all the time.

      --
      In the free world the media isn't government run; the government is media run.
    30. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      use Inception to RAM dump the lower 4GB to write-only media.

      Um, just a quick question... What good is the data if its put on "write-only media" ?
      FWIW I usually call that /dev/null

    31. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      They COULD do those things, but if they don't know ahead of time that it's all booby trapped, how many of those things do you think they likely did?

    32. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      There's a better way: a conditional burnword.

      Set up an encrypted set of volumes that all appear to be a single volume. Set the password. Then set burnwords.

      The password will decrypt the drive's true, hidden contents on the "real" volume, and allow management of the other, "non-real" volumes.
      The burnwords will expose a "non-real" volume's contents while hiding the other volumes.

      The first burnword will expose something completely normal.
      The second burnword will expose something slightly embarrassing.
      The third burnword will expose something extremely embarrassing.
      The fourth burnword will hose the contents of all volumes as long as they don't have a write-blocker, but will appear to fail to decrypt anything.
      The fifth burnword will nuke the drive.

      This is like truecrypt on steroids, and would give law enforcement nightmares. Only spooks would stand a chance. And that's the way it should be. Thieves, kiddie-fiddlers, and other random criminals don't need this kind of effort expended to take them down. CSI has made everyone believe that they're a special snowflake and should have millions of dollars of time and materials used for them at the exclusion of everyone else. Law enforcement has taken this as a sign that they need more funding. What they need is more balls to tell the "special snowflakes" to go cry it off like everyone else.

    33. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Not only that but a very common piece of forensic gear is a hard drive controller that blocks all write attempts (while reporting back that they were successful).

      Why not write a Fibonacci sequence or whatever instead. Then later, read it back to verify. IId also index things to hard to manipulate web browseable info too - like the price of gold, the dow, etc. Be a pain if you can't log in because the nutters hoard/dump gold on a given day, but there are plenty of workaround to ease that situation.

    34. Re:Except, of course, they have to prove you can by jcochran · · Score: 1

      As all the other posters have already mentioned, your plan won't work. But way back when anon.penet.fi was finally forced to reveal through the legal system, the real email address of a user, I did a bit of a mental exercise.

      How could someone create a pseudonymous remailer that would be extremely hard if not impossible to break through the legal system?

      The scheme I thought up was as follows.
            1. Maintain an encrypted database of email addresses and pseudonyms.
            2. Have the key to the above mentioned database stored only in RAM and never written to any persistent storage.

      The above scheme would work, but power failures and reboots would effectively destroy the database so it's not a complete solution. But to work around the power issues, add the following.
            3. A UPS to minimize power issues (not really required, but will reduce the down time)
            4. Have the key split into multiple parts and have those parts sent to multiple trusted parties in multiple legal jurisdictions. There's plenty of secret splitting techniques out there to do this. And if your escrow parties happen to be in the USA, Finland, Italy, Switzerland, etc., it would be rather difficult to have enough of them divulge the key portion that they've been entrusted with. And of course, have those parties instructed to destroy their key portion if they ever discover that legal proceedings have been engaged against you. And of course, have your lawyer instructed to inform those parties as well.

      So in the above situation if you lose power, or need to reboot, the system will be in an unusable state, but will contact the escrow parties to retrieve the key parts and reconstruct the encryption key. Once this happens, it resumes normal operation. But most other governmental attacks would have a very slight chance of success.

      Of course, other refinements could be added such as a periodic "ping" to the escrows informing them that things are still OK. If a sufficiently long time elapses without such a keep alive ping being received, the escrow would delete the key portion entrusted to it.

      To break such a system would be extremely difficult.

    35. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Destruction of evidence is a separate crime, and simply having some type of electronic dead man's switch on it does not get one off the hook.

      Politicians and appointed government bureaucrats who are members of the Democrat party are, of course, exempt.

    36. Re:Except, of course, they have to prove you can by Prune · · Score: 2

      There's a much better approach. There are secure key storage ICs you can buy for a few dollars a piece at the usual electronics distributors (Digikey etc.), which have a pin or set of pins to which a signal will cause instant secure erasure of the stored data. With one of these, the solution is quite trivial, and I've prototyped it before. Across it's ground and VCC pins, the device has a capacitor large enough to give it a fraction of a second of charge when disconnected from power. The erase signal pin is triggered by ANDed physical interlocks and power sense. If the power goes out, or the physical interlocks are opened, the key is instantly erased.

      --
      "Politicians and diapers must be changed often, and for the same reason."
    37. Re:Except, of course, they have to prove you can by Prune · · Score: 1

      Oops, "Across it's ground" --> "Across its ground"

      --
      "Politicians and diapers must be changed often, and for the same reason."
    38. Re: Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Say it aint so! Thousands of threads on the Imdb Message Board have told me that people never ever make mistakes, it's all just bad writing!

    39. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      stupid idea

    40. Re:Except, of course, they have to prove you can by charles2678 · · Score: 2

      If they're professional forensic analysts, pretty near 100%. I've torn a prosecutor's case to pieces (well, provided an expert report used to do so) for relying on analysis by folks who weren't forensic professionals (school district IT staff), and that was a decade ago. I'm sure that any defense attorney worth their salt knows folks like me, and any crime lab is prepared.

    41. Re:Except, of course, they have to prove you can by Great+Big+Bird · · Score: 1

      One thing I never got with the "don't talk to the cops" thing is what happens if you actually the kind of help you would generally phone them for — such as your daughter ran away, or somebody just burgled your home, etc?

    42. Re:Except, of course, they have to prove you can by HornWumpus · · Score: 1

      Try and call them for that.

      They will take a report, if you come down to the station.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    43. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      What if you set your encryption software up so that after entering the correct password it connects via the internet to a server you control. The server then provides the software the "correct" encryption key which is a long and something you do not actually have memorized. you can then put a time expire on the server where if you have not checked in every so often the key is securely deleted.

    44. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      So we should be ignoring everything you just said?

    45. Re:Except, of course, they have to prove you can by mysidia · · Score: 1

      They COULD do those things, but if they don't know ahead of time that it's all booby trapped

      If they don't do those things at a minimum, then they are grossly negligent, and the lab themselves may destroy evidence by accident, even if it is not booby trapped.

      Also; the defendant may accuse the lab of planting the evidence, and the lab needs to be able to show documented procedures and audit trail, demonstrating they can attest that the data hard drive could not have been changed by any of the analysts; and a verifiable checksum helps ensure the integrity of the evidence needed to help maintain a solid chain of custody.

    46. Re:Except, of course, they have to prove you can by stox · · Score: 4, Informative

      http://forensic.belkasoft.com/...

      "Solid State drives (SSD) introduced dramatic changes to the principles of computer forensics. Forensic acquisition of computers equipped with SSD storage is very different of how we used to acquire PCs using traditional magnetic media. Instead of predictable and highly possible recovery of information the suspect attempted to destroy, we are entering the muddy waters of stochastic forensics where nothing can be assumed as a given."

      --
      "To those who are overly cautious, everything is impossible. "
    47. Re:Except, of course, they have to prove you can by i+kan+reed · · Score: 1

      Keep in mind, of course, that if you have evidence that could help ID the correct suspect, you may have a moral obligation to provide it, if not a legal one.

    48. Re:Except, of course, they have to prove you can by HornWumpus · · Score: 1

      'Write only media' is a joke, no doubt older then you.

      To tell you how old. Trash cans used to be called 'write only drum memory'.

      Drum memory was a storage, back in the year or the flood.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    49. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      ‘[e]verything is encrypted and no one is going to get to it.’ ... What a dumb-bumble-fark. He deserves to burn for bragging/taunting the cops.

      You're assuming he actually did say that. Is there a video tape of him saying this, or just an officer's memory? Because I'd put money on the cops "remembering" something he didn't say.

      "They're encrypted with an unguessable key" becomes "I did it and all the evidence you need is encrypted on those computers there ha ha ha" when you involve memory plus the incentive to misremember.

    50. Re:Except, of course, they have to prove you can by Jumperalex · · Score: 1

      I don't see why not.

      First you are resumed innocent at least by US Law. So to claim that you setup the dead-man switch specifically to destroy evidence is to assume a priori that you are guilty.

      Second, there are completely legitimate reasons for the scheme presented. Such as preventing absolutely anyone else in the world, other than the police, from accessing the data without your knowledge or consent. The fact that it is so elaborate and/or effective (I can't comment on that last bit) is evidence of skill not guilt.

      Assuming a defendant didn't do something stupid like admit their real fear was prosecution using evidence of a crimes stored on those very same drives, I'd have a hard time as a juror finding the defendant guilty of evidence tampering. I am under no obligation to admit anything about those drives, to include my knowledge that the clock is ticking. That is the heart of the self-incrimination argument against having to decrypt a hard drive.

      Mind you my assertions above are not backed up by a law degree and in some ways are still tenuous given the current state of jurisprudence in the various US courts. Though iirc, the SCOTUS has weighed in with a narrow decision along those lines. But I might only be thinking of a circuit court decision.

      --
      If you can't be good, be good at it!
    51. Re:Except, of course, they have to prove you can by cryptoluddite · · Score: 1

      You can only destroy the key if it is outside the police control.

      What you do is to put half the key on the internet and store half locally password protected on the encrypted drive (so both parts are needed to decrypt). To decrypt you enter the local password and the DNS or IP address of the second half. The second half could even be in plaintext even since it's purpose is to make the other key half useless not to protect the data.

      Because the police don't know about this internet site they can't make a backup, so you can have it self destruct after a certain amount of time. If you can hold out for 7 days or a month or whatever then it won't matter if they have write blockers and clones, they will be undecryptable. Or better yet, since you're entering the internet address of the key you can give them one that does expire (a dummy cloud instance so you can log in and 'prove' the self-destruct mechanism), but you also posted the key to some random forum. Without knowing what forum and account there's no way to find the key, but if you actually get out then eventually and with enough TOR you can retrieve the key and get your data back.

      Of course really you'll just spend the rest of your life in jail for contempt even if you can prove a self-destruct mechanism...

    52. Re:Except, of course, they have to prove you can by chihowa · · Score: 1

      ...after the seized computer is shipped to a lab; the first thing they will do is remove the storage media from the computer, hook it up...

      This is what you take advantage of. Crack the drive open and rewire the drive so that attaching it to a normal power supply destroys the drive. This may be as easy as just swapping around the 12V, 3.3V, and 5V pins. Make the corresponding modifications to your computer.

      There's all sorts of empty space inside of modern SSD drives, so you could add an extra circuit to boost the voltage and apply it directly to the memory chips or fill the case with thermite or whatever. If you go this route, you don't even need to worry about strong encryption methods because the analysis will never get that far. If the failure is not catastrophic (say, melting into a puddle or bursting into flames), there might not even be any suspicion of foul play. Electronics die all of the time and SSDs have no outward feedback to indicate whether they're failing or not...

      --
      If you want a vision of the future, imagine a youtube comments section scrolling - forever.
    53. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      They would if June 26th was the date of the crime you're being investigated for.

    54. Re:Except, of course, they have to prove you can by mysidia · · Score: 1

      This may be possible. It is way outside the realm of possibility for the average user, even most computer programmers lack the requisite knowledge to rewire the drive. Even if they do rewire the drive, however; there are only so many amps load which the PSU will allow to be delivered, and current limiting devices are readily available.

      This is what you take advantage of. Crack the drive open and rewire the drive so that attaching it to a normal power supply destroys the drive.

      Maybe... are you sure they don't plug the drive back into the same chassis, after installing the write blocker?

      If they're super careful and CYA in their techniques; they may do this first image capture, and then have another analyst repeat the process the second time on their own equipment, in order to accomplish two things: (1) verify the image, (2) independent confirmation of the first captured image.

      They may take photographs, visual imaging, and do some other inspections of the hardware for signs of alterations or tampering, before powering things on. Changes to the power system wiring are trivial detect.

    55. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Simple - see https://code.google.com/p/beerbottle/. Then when asked for the password give them the duress password but just before they hit enter scream "No wait! I think that's the wrong password" and wham - you didn't destroy the data - they did!

    56. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      An encrypted hard drive is little different from a locked safe.

      While this is the analogy the legal profession has been using, it is a terriblephysically forced open. This means compelling someone to open a safe is merely reducing the cost in time and money of opening the safe. Whereas with good cryptography used correctly, encrypted data can never be recovered without knowing the key.

    57. Re:Except, of course, they have to prove you can by rastos1 · · Score: 2

      Remember that Everything you say will be used to burn you. Cops can lie and get away with it, and if you lie to a cop, you're fried. Do not believe anything they say, and don't try to talk your way out of it because you'll lose.

      Out of interest - what makes a lawyer so special that he can talk to the cops? Are lawyers vaccinated against cop-tricks or something?

    58. Re:Except, of course, they have to prove you can by mysidia · · Score: 1

      There's a much better approach. There are secure key storage ICs you can buy for a few dollars a piece at the usual electronics distributors (Digikey etc.), which have a pin or set of pins to which a signal will cause instant secure erasure of the stored data.

      This is fine for securing a small amount of data you can retrieve at will through another source, e.g. by entering the passphrase or downloading from remote site.

      You wouldn't store a hard drive's worth of data on key storage ICs; for them to be useful, you actually do need to be able to still get at your own encrypted data after a power blip.

    59. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      lying under Oath in a court of law is perjury. Lying to an lawyer is just giving them a taste of their own medicine.

    60. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      This is false. Modern seizure maintains power precisely to enable forensic memory access to encryption keys. If your cops are yanking the plug, they are not doing it right.

    61. Re:Except, of course, they have to prove you can by anethema · · Score: 1

      You aren't really under arrest then.

      While it is a general good policy, when it really applies is when you have been arrested.

      --


      It's easier to fight for one's principles than to live up to them.
    62. Re:Except, of course, they have to prove you can by LordLimecat · · Score: 1

      Theres no reason they couldnt use a warrant to sieze the server, unless it was out-of-country.

    63. Re:Except, of course, they have to prove you can by Sabriel · · Score: 1

      That sounds like a scenario in which you better make extremely sure of your UPS arrangements.

      "Mwuahahaha! Now my criminal empire is secured against all possible government interference!"

      *gets jostled by minion, drops IC, watches in horror as the little battery powering it springs loose and bounces across the floor*

      "FFFFFFFFFU-"

    64. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Encrypt your stuff on a drive with two-factor auth.

      An interesting idea in theory, but in reality it just won't work. Digital forensics NEVER does anything to an original device, they always clone it first. So they can fail and reclone the drive as many times as is necessary. Secondly, you can not rely on the system date for anything as the system clock can be set through BIOS to any date required. Even things like Internet time servers can be forged.

    65. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      STFU until you get a lawyer

      Except that the Supreme Court has already ruled that remaining silent is an admission of guilt. [[http://yro.slashdot.org/story/13/06/17/2220214/supreme-court-decides-your-silence-may-be-used-against-you]]

    66. Re:Except, of course, they have to prove you can by garyebickford · · Score: 1

      I have an associate who is _very_ familiar with this issue, especially as it applies to self-encrypting hard drives. According to him: Under US law, if you have never told the password to anyone, and have never written it down, (and I suppose now haven't told the police that the incriminating evidence is in there!), it is illegal for them to try to coerce you to give it to them. Police have actually gone to jail for trying.

      In this case, the idiot told them that it's in there, which gave them probable cause. So I think that this case is really about the idiot.

      Note that some, or none of this applies outside the US.

      Also, according to the same person, by the end of this year or early next year all hard drives will be manufactured as SEDs. It's in the software of nearly all of them now whether it's mentioned in the specs or not. In MS Windows (and most other OS?) encryption is turned off by default. Big companies like Google increasingly use SEDs, because this means that they can sell off the used hard drives later, or send them out for recycling or whatever, without worrying about what's on them. Erasing the key means they are clean for all intents and purposes.

      --
      It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
    67. Re:Except, of course, they have to prove you can by Sabriel · · Score: 1

      The whole premise of "don't talk to the cops" is one of risk management. Don't be confrontational, don't try to outwit them in an argument, don't show off how smart (you think) you are, etc. Be nice, be meek, be quiet. You lose nothing if the cop is a good cop and you reduce the risk of losing everything if the cop is a bad cop. Leave the lion-handling to the experts, i.e. your laywer, who isn't you, who can say things you can't, and who hopefully has many years of experience in knowing how to negotiate with the police.

      Obviously (well, hopefully) your kid running away or your house getting burgled are situations where "call the cops" trumps "don't talk to the cops". YMMV.

      I've a couple of friends who are cops. It's not (generally) that dangerous physically, compared to some jobs, but it is dangerous mentally - a few years of being a cop and the world starts getting divided into "perp", "vic", "witness", "suspect", etc. And it starts creeping into their social life. It's a monochrome perspective that no amount of increased pay can solve, and I'm very much in favor of giving cops generous leave entitlements instead - indeed, mandating an amount of leave every so often - as much for society's benefit as their own.

    68. Re: Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Here's one for you. The hard drive has been modified to include a voltage pump attached to the data pins. If an attempt to read past the end of /boot is issued before a write (boot loader records last image and date), the drive firmware turns on the voltage pump frying itself and the attached machine. Label it tamper resistant for the obvious reason.

    69. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      You know, getting that lawyer can get quite some time... we might have one for you in a week if you are lucky. But if you speak to us now, you might be free to fo this afternoon.

      And while you wait for that lawyer, you have to stand up in the holding cell once every 30 minutes to prove you are alive. Day and night. After a few days you are willing to talk to the cops without a lawyer.

      This is how it works in a few European countries at least.

    70. Re:Except, of course, they have to prove you can by bentcd · · Score: 1

      Out of interest - what makes a lawyer so special that he can talk to the cops? Are lawyers vaccinated against cop-tricks or something?

      The lawyer isn't under suspicion and so need not be afraid that the cops are trying to build a case against him.

      A lawyer that is under suspicion should only say "I wish to remain silent and I want a lawyer" just like anyone else.

      --
      sigs are hazardous to your health
    71. Re:Except, of course, they have to prove you can by bentcd · · Score: 1

      STFU until you get a lawyer

      Cops can lie and get away with it

      So is there anything to stop a cop from saying, "I'm your court appointed lawyer now tell me everything"?

      --
      sigs are hazardous to your health
    72. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Out of interest - what makes a lawyer so special that he can talk to the cops? Are lawyers vaccinated against cop-tricks or something?

      They are in the same racket. They both profit off of "criminals" so they are on the same team there.

      Cops win the more cases go to court, as do lawyers.

      They "lose" when there are no "criminals" and law-breaking going on.

      Same reason Jesus loves sinners. He has no angle, no blackmail, nothing to gain from trying to convert "good" people. He has everything to gain from setting people up, so that they can be "saved" later.

    73. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      But what if his disks were actually all zeroes, and the encryption algorithm is a XOR? Shouldn't the pad be protected by the fifth amendment? When do you do the shift between the data being on the disk and it just being random noise?

    74. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      This is mostly in the context of a criminal investigation, but even there, just give them the relevant information. Don't say more than you need to.

    75. Re:Except, of course, they have to prove you can by Ginger+Unicorn · · Score: 1

      Presumably the best plan would be to get your lawyer to handle that situation.

      --
      (1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons
    76. Re:Except, of course, they have to prove you can by i+kan+reed · · Score: 1

      Well, that's extremely expensive.

      Your choices are :
      1. Pay $2000, report that shooting you saw, with minimal indemnity
      2. Report that shooting you saw, with a paranoid fear that you'll be a suspect
      3. Keep silent, possibly drawing suspicion on yourself, if you somehow get reported as a witness(why wasn't he talking, if he knew?), pay $5000 for a lawyer after you now need one.

      It's not as cut-and-dry as the "never talk to the police" crowd like to make it out to be.

    77. Re:Except, of course, they have to prove you can by Stellian · · Score: 1

      what makes a lawyer so special that he can talk to the cops? Are lawyers vaccinated against cop-tricks or something?

      Anything dumb your lawyer says can't be used against you (since he cannot be witness against his client) or against himself (since he's not the suspect). A really really dumb lawyer can be charged with conspiracy and end up next to the defendant but it's exceptionally rare and the burden of proof is monumental (mafia lawyers involved in the same operation with their client).

      You, on the other hand, are already a suspect, the tiniest slip ('I didn't like him, but I did not kill him !') can send you to the gauntlet ('Ladies and gentlemen of the jury, the defendant despised the victim - by his own official testimony'). The greatest trick your lawyer has is that he isn't you.

      Talking to the police while suspected of a crime is like performing brain surgery on yourself.

    78. Re:Except, of course, they have to prove you can by david_thornley · · Score: 1

      A good lawyer knows what should be said and what should not. A good lawyer, for example, would advise his client to not admit anything about any encrypted files, or claim the ability to decrypt them.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    79. Re:Except, of course, they have to prove you can by david_thornley · · Score: 1

      The actual password means nothing, unless it actually contains information about the crime that the prosecution doesn't already have. If it were a passphrase like "the raped and mutilated bodies can be found buried about four miles southwest of Joe's house", the court might order you to enter it yourself.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    80. Re:Except, of course, they have to prove you can by grnbrg · · Score: 1

      There is a hierarchy of trustworthiness with the judge at the top, and the dirty criminal at the bottom. Anything the police say will be believed over what you (the dirty criminal, otherwise why would you be arrested) say. Lawyers are above the police in that hierarchy.

    81. Re:Except, of course, they have to prove you can by HornWumpus · · Score: 1

      How about we replace them with fresh bullies every 5 years or so?

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    82. Re: Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      You are assuming they know it exists. I didn't study vampire tap for nothing.

    83. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      anything your lawyer says on your behalf is not said by you. that alone gives you a larger degree of protection then you may realize.

    84. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      Getting (and following) legal advice from random people on the internets is about the stupidest thing you could do.

      So... I shouldn't follow your advice?

    85. Re:Except, of course, they have to prove you can by Ginger+Unicorn · · Score: 1

      Don't you get a free lawyer if you can't afford one? I'm not American so I don't know

      --
      (1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons
    86. Re:Except, of course, they have to prove you can by Prune · · Score: 1

      Are you serious? The post specifically says secure _key_ storage. Only the encryption key needs to be kept this way. You could have an exabyte data warehouse encrypted with that key. If the key is safe, so is the data.

      --
      "Politicians and diapers must be changed often, and for the same reason."
    87. Re:Except, of course, they have to prove you can by Anonymous Coward · · Score: 0

      One slight flaw. The firmware on the drive can be changed. Of course, this is a security escalator. Nothing keeps people from copying the actual magnetic platters, assuming they know the suspect is doing this. Might as well go all out and have the key self-destruct on some barely visible added component. Or move the data outside jurisdiction in the first place. One interesting concept is randomly encrypting archives with PGP or the like in a deniable manner. You literally can't know what's in the file if it's from a PRNG or another person. This is similar to Freenet.

      I wonder if anyone's solved the 'rubberhouse' exploit, hehe.

  3. Lois Lerner Method by bhlowe · · Score: 5, Insightful

    Take the 5th and say your computer crashed. That works for the IRS.

    1. Re:Lois Lerner Method by gstoddart · · Score: 1, Insightful

      You don't get to take the 5th, apparently. The cops have the computer in their possession.

      So, they will detain you until you provide the information they require to convict you.

      But if they have to, they'll convict you of failing to provide the information they need to convict you, and then continue to detain you.

      "Ense petit placidam sub libertate quietem " (By the sword we seek peace, but peace only under liberty)

      Except when we don't.

      Papers please, comrade. Cooperation is mandatory.

      --
      Lost at C:>. Found at C.
    2. Re:Lois Lerner Method by Anonymous Coward · · Score: 0

      Papers please, comrade.

      Glory to Arstotzka.

    3. Re:Lois Lerner Method by LordLimecat · · Score: 3, Insightful

      Except that thats not the ruling, and in your rush to karma-whore you apparently did not read the story. The reality is more nuanced than that, but of course reality gets fewer insightful votes than regurgitating nonsense about authoritarianism.

    4. Re:Lois Lerner Method by gstoddart · · Score: 1

      in your rush to karma-whore

      Do not confused legitimate loss of faith in mankind and disillusionment with karma whoring.

      They're not the same thing.

      It may well be nonsense about authoritarianism. But it's sincere nonsense. I sound like this in real life too.

      --
      Lost at C:>. Found at C.
    5. Re:Lois Lerner Method by Anonymous Coward · · Score: 0

      He could be partially right thought bhlowe failed to keep silent with the "my computer crashed" defense, when the police already has it they can easily find out that he lied. IANAL so I can't even begin to guess what sort of negative consequences a suspect faces when caught lying about evidence or how not staying silent on the matter affects his right to remain silent.

    6. Re:Lois Lerner Method by garyebickford · · Score: 1

      Nope, the key fact is the idiot. He gave them probable cause by saying the data was in there. Without that, they couldn't make him give up the password. That's existing case law.

      --
      It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
    7. Re:Lois Lerner Method by Anonymous Coward · · Score: 0

      But if he doesn't mention or answer regarding whether the computer's drive is encrypted in the first place, if there is in fact any information on it at all, citing his 5th Amendment right to refuse self-incrimination, they have to establish that the drive is encrypted to even proceed with this line of questioning...establish that it's not just gibberish or noise...

  4. Shoulda had a hard drive failure by Anonymous Coward · · Score: 1

    We all know the leading cause of hard drive failure is subpoenas.

  5. Five dollar wrench attack by Anonymous Coward · · Score: 0

    You can 'compel' all you want, but we know what's really happening.

  6. Corrupted by Anonymous Coward · · Score: 0

    These encrypted drives are corrupt; they will not accept my password. Sorry.

    1. Re:Corrupted by Applehu+Akbar · · Score: 1

      Nice try, but if the Fifth Amendment does not apply in Massachusetts, then the Eight wouldn't apply either.

    2. Re:Corrupted by mi · · Score: 1

      Nice try, but if the Fifth Amendment does not apply in Massachusetts, then the Eight wouldn't apply either.

      Well, the Second stopped applying decades ago as well.

      --
      In Soviet Washington the swamp drains you.
    3. Re:Corrupted by mysidia · · Score: 1

      Nice try, but if the Fifth Amendment does not apply in Massachusetts, then the Eight wouldn't apply either.

      Hm... since the fifth Amendment is federal law, and the Mass. Sup. court is a state court; the question of federal law might be appealed to the federal circuit.

      As it is the federal courts that have the final say over questions involving federal law.

    4. Re:Corrupted by whistlingtony · · Score: 1

      that's funny, 'cause I own a gun... weird. It's almost like the second amendment is fine and dandy, and you're just whining....

    5. Re:Corrupted by Shakrai · · Score: 1

      If you live in MA you can't (legally) own a firearm without first obtaining permission from the Commonwealth, permission that can be denied for almost any reason by your local Police Chief. Ditto for trying to carry said firearm in public. Both of these are actions that are allowed by default in the vast majority (approx 40) of the United States. MA is so hostile to the notion of self-defense that it's technically illegal to carry pepper spray there without a license. I'm hard pressed to think of a State that's worse with regards to the 2nd Amendment. New Jersey perhaps, though it's a toss up.

      Pretty ironic seeing as how the American Revolution got going in MA over an attempt to disarm the population.

      --
      I want peace on earth and goodwill toward man.
      We are the United States Government! We don't do that sort of thing.
    6. Re:Corrupted by mi · · Score: 1

      that's funny, 'cause I own a gun

      Only because the Executive government granted you their permission, whereas the Second Amendment explicitly says that both keeping (which you do), and bearing (which you do not mention) a weapon is a right, which only the Judiciary can suspend (upon a guilty verdict). That it is treated as a mere privilege, which the Executive can grant or withdraw on a whim, is a violation of the Second Amendment. Hence my "whining".

      --
      In Soviet Washington the swamp drains you.
    7. Re:Corrupted by david_thornley · · Score: 1

      The US Constitution is the supreme law of the land in the US. Specifically, the Fourth and Fifth and Eighth always apply.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    8. Re:Corrupted by mysidia · · Score: 1

      The US Constitution is the supreme law of the land in the US. Specifically, the Fourth and Fifth and Eighth always apply.

      Of course they don't always apply.... the amendments only apply to matters of law where the courts have found that the amendments pertain to. For example: after an implicit waiver of the 5th amendment against testimony against one self: --- in case a defendant signs a confession, without coercion, the right no longer applies, and from then on, the defendant can be compelled to appear as a witness in the case.

      In this case; the basic argument is that since disclosing the keys is not testimony, and the defendant already admitted they do actually have the keys --- that the 5th amendment does not prevent law enforcement from being able to compel the defendant to answer the question: which is now not considered testimony in and of itself, but a barrier preventing access to physical evidence under the defendant's control.

      This is tantamount to admitting in open court, that you know the exact location of the weapon used to commit the specific murder in this case, and then being ordered by the Judge to provide that location to the prosecution, so that they may secure it: this is not a 5th amendment violation, you implicitly waived your rights when you admitted guilt, and now, you are lawfully required to complete the formalities needed to affirmatively prove your guilt.

  7. The relevant part by robinsonne · · Score: 1
    The relevant part of the ruling:

    We now conclude that the answer to the reported question is, "Yes, where the defendant's compelled decryption would not communicate facts of a testimonial nature to the Commonwealth beyond what the defendant already had admitted to investigators." Accordingly, we reverse the judge's denial of the Commonwealth's motion to compel decryption.

    So what they're saying is that since the decryption key isn't "testimony" it doesn't count under the 5th Amendment. (IANAL)

    1. Re:The relevant part by SteWhite · · Score: 2

      Exactly - another key sentence in there is:

      "In the Commonwealth's view, the defendant's act of decryption would not communicate facts of a testimonial nature to the government beyond what the defendant already has admitted to investigators. As such, the Commonwealth continues, the defendant's act of decryption does not trigger Fifth Amendment protection."

      So if he had not admitted anything already and had refused to decrypt, the ruling may have been different.

    2. Re:The relevant part by funwithBSD · · Score: 1

      In other words, he "testified" on the matter, and thus could not claim 5th midstream.

      --
      Never answer an anonymous letter. - Yogi Berra
    3. Re:The relevant part by Anonymous Coward · · Score: 2, Funny

      So what they're saying is that since the decryption key isn't "testimony" it doesn't count under the 5th Amendment. (IANAL)

      Guess I'm safe then. My decryption key is "testimony". Lowercase, no special characters or digits.

    4. Re:The relevant part by Anonymous Coward · · Score: 1

      Agreed. The kicker for me is this:

      "The facts that would be conveyed by the defendant through his
      act of decryption--his ownership and control of the computers and their contents, knowledge of the
      fact of encryption, and knowledge of the encryption key--already are known to the government
      and, thus, are a "foregone conclusion." [FN14] The Commonwealth's motion to compel decryption
      does not violate the defendant's rights under the Fifth Amendment because the defendant is only
      telling the government what it already knows."

      Basically the guy screwed up by talking to the police in the first place. As a lawyer he should have known better! If he had just kept his mouth shut, the police would not have _known_ that his computers contained documents relevant to their investigation. They could have _speculated_ that his computers contained such information but that probably would have resulted in an entirely different ruling. Looks like his arrogance got the better of him.

    5. Re:The relevant part by sabri · · Score: 3, Insightful

      So if he had not admitted anything already and had refused to decrypt, the ruling may have been different.

      That is irrelevant. The question at hand is whether or not the Government can force you to provide evidence against yourself in a criminal case. Now I'm just a stupid immigrant, but my understanding from the 5th Amendment is that nobody "hall be compelled in any criminal case to be a witness against himself". I don't care how much the police think they know. If they need his harddrive, their case is not solid and the suspect should not be required to provide incriminating evidence.

      Being forced to provide evidence against yourself pretty makes it the Soviet Republic of Massachusetts.

      --
      I'm not a complete idiot... Some parts are missing.
    6. Re:The relevant part by Anonymous Coward · · Score: 1

      How is providing the encryption keys any different from complying with a search warrant for paper files. The constitutional prevents "unreasonable search and seizure". Of the government has a valid reason for the search and the judge concurs by issuing a warrant the defendants rights have been respected.

    7. Re:The relevant part by jythie · · Score: 2

      You can not be forced to testify against yourself, but you can be forced to hand over evidence that exists.

    8. Re:The relevant part by suutar · · Score: 2

      from what I've read, the interpretation is that you may not be forced to _create_ evidence that may be used to convict you at the request of a government entity. Answering a question from a government employee is creating statements that didn't already exist. Filling out a form is creating documents that didn't exist. Evidence that they already have can be followed up. Evidence that is known to already exist can be demanded (blood samples, DNA samples, papers in a safe), and the fifth won't help because you're not creating anything.

      Following this interpretation, data on the drive already exists. Taking the fifth when asked if you know the password may be allowable, but once knowledge of the password has been admitted, it's down to the "demanding evidence that exists" category and the fifth doesn't help.

      I'm not saying that's the ideal answer, but there is a certain logic to the position.

    9. Re:The relevant part by Anonymous Coward · · Score: 0

      This is more like someone who burned the papers but then claimed to memorize their contents.

      Then the government is able to say that they "know" that he "remembers" thus he should be given a stack of black paper and a pen, then forced to rewrite the incriminating evidence against him.

      The true contents of the drive are "scrambled" just as paper would be after burnt. The key is analogous to simply rewriting the documents. Without his memory, the contents are not available.

    10. Re:The relevant part by ruir · · Score: 1

      My encryption key is "I wont say it".

    11. Re:The relevant part by Anonymous Coward · · Score: 0

      IANAL, but I was under the impression that you could be forced to get out of the way while the authorities look for evidence, not that you had to find it for them.

    12. Re:The relevant part by LordLimecat · · Score: 1

      IANAL, AFAIK, etc etc-- but my understanding is that the 5th has long been held to not protect against the court compelling you to divulge the combination to a safe holding key evidence.

      The argument here seems to be that thats the digital analogue (lol) that we're dealing with here. Even if you were to argue that its a bad ruling-- and as I am not a lawyer, I wont go there-- thats a far cry from "the Soviet Republic of Massachusetts". The guy could have kept his mouth shut and they wouldnt have been able to compel anything.

    13. Re:The relevant part by LordLimecat · · Score: 1

      Following this interpretation, data on the drive already exists.

      In before crypto geeks attempt to claim that encrypted data is "just noise" and does not contain actual data.

    14. Re:The relevant part by Anonymous Coward · · Score: 0

      "but you can be forced to hand over evidence that exists."

      Funny, I don't recall any suspected killers being held indefinitely because they wouldn't tell the prosecution where they supposedly hid the body/murder weapon?

    15. Re:The relevant part by canajin56 · · Score: 1
      It's not irrelevant. It's extremely important because of the Act of Production Doctrine.

      Under the Act of Production Doctrine, the act of an individual in producing documents or materials (e.g., in response to a subpoena) may have a "testimonial aspect" for purposes of the individual's right to assert the Fifth Amendment privilege against self-incrimination to the extent that the individual's act of production provides information not already in the hands of law enforcement personnel about the (1) existence; (2) custody; or (3) authenticity, of the documents or materials produced.

      For example, let's ignore computers: You are wanted for wire fraud. The police search your home with a warrant for accounting documents. They find a small fire safe in the back of your attic. They ask for your combo and like a smart criminal you say "lawyer" and nothing else. So they will see if their safe crackers can open it without risking damage to the contents. Lets say it's a sort of safe where you need to blow it open, and this may destroy the documents it might contain. So they need that combo. They go to a judge and want a subpoena for the combonation. Or rather, they subpoena the contents of the safe. You don't have to tell them the combo, but you do have to open the safe for them if you want to keep the combo secret. At least, that's what they get if the judge sides with them. So the question is, where does this fall WRT the Act of Production Doctrine. The safe was in the corner of your attic. It could have been there when you moved in. It could be your roommates. You could be aware of its existence, or not. You could have put its contents inside of it, or not. At this point, the police do not know any of these answers. So by the Act of Production Doctrine, opening the safe would be testifying as to all of these things. Therefore, the Fifth would protect you from this demand. However, if they dust it for prints and find that your prints are all over the tumbler, then you're on shakier ground. The judge may rule that this shows that your control of the safe is now a "forgone conclusion" and issue the subpoena. Of course, you could say "Well yeah, it was here when I moved in, I tried a few obvious combos, they didn't work, I gave up". That will be up to the judge to decide. Contrary to /. belief, judges are not robots, and are allowed to make this kind of judgement. If you say "I bought that years ago, I don't even remember the combonation anymore" then it is up to the judge, again, to decide if you're lying. If he thinks you're lying, he can lock you up for contempt to "jog your memory". IIRC there is no limit to how long this can go on. It's a shitty thing to happen if you legitimately don't remember your safe combo. But it's nothing anywhere CLOSE to new.

      On the other hand, if instead of saying "lawyer" you said "hahaha, stupid coppers, only I know the combonation, and if you try to crack the safe you will destroy all of the evidence of my many crimes! The Firth will protect me and I'll walk!" then a judge will almost certainly accept your volunteered testimony on the matter and rule that it is a "foregone conclusion" that you know the safe combo (and that you know it contains the documents the police are looking for). So, don't say that.

      In this case, the defendant did the second thing, though without all of the "I did it" bits. He admitted the laptop was his, he admitted it contained encrypted emails discussing the allegedly fradulent things the company was doing, and he admitted that he still knows the password. So the legal question was not "can we compel somebody to reveal a key" because that's already legally decided. The question is "is a password a key? or is it just a word?" The judge ruled that a password was a key, and since the defendant was no longer protected by the Act of Production Doctrine due to his own previous testimony, he can be compelled to use that key. This will only apply to you if the Act of Production Doctrine does not protect you.

      --
      ASCII stupid question, get a stupid ANSI
    16. Re:The relevant part by Anonymous Coward · · Score: 0

      Because it's not analogous. What can be ordered is he removing of any impedement that may exist in accessing the harddrive - if the data on the harddrive is encrypted, then that's all you get.

    17. Re:The relevant part by Anonymous Coward · · Score: 0

      Because your statement makes no sense. "Suspected" killers mean they haven't admitted to killing anyone. And you can't hold anyone "indefinitely" (I assume you're referring to detention over contempt of court for failure to produce evidence) that you can't prove has the information. So, either your "suspected" killer already admitted to doing it and would therefore be in jail anyway, or you can't prove that he did it and so it can't be proven that he has the info so can't be held.

    18. Re:The relevant part by Wookact · · Score: 2

      If the government serves you with a search warranty for your paper files you do not go and collect them into a box and hand them over. You step out of the way and they gather them. The government issues a search warrant for your combination safe, you stand out of the way while they open it. If the government issues a search warranty for your encrypted documents, you are now expected to supply them? Um no. You stand out of the way and allow them to go get them.

    19. Re:The relevant part by danomac · · Score: 1

      Mine is "iforgot".

    20. Re:The relevant part by im_thatoneguy · · Score: 1

      It's the center of the case. The 5th protects you from self incrimination but you can be compelled to offer up a key to a safe. (And why wouldn't they). The gray area is a safe they find buried in your back yard. If you admit to knowing the combinations then you are taking ownership of the safe and the evidence within. If you say I never knew there was a safe buried there then you aren't liable for the gun contained within.

      It's less of a gray area though if they dig up a safe and the police ask you "Is this your safe?" "Yes" "Can you open it?" "yes". You've admitted to having the key/combination. You've admitted the evidence that they found is yours. Similarly once a police officer suspects you of a crime and gets a warrant he can force you to unlock your door and let them in. They can't force you to unlock someone else's door and let you in if it's not established that it's your house.

    21. Re:The relevant part by dcollins117 · · Score: 1

      The Commonwealth's motion to compel decryption does not violate the defendant's rights under the Fifth Amendment because the defendant is only telling the government what it already knows.

      The thing that gets me is that the government doesn't know the password so he is telling them something they don't already know.

    22. Re:The relevant part by Bob+the+Super+Hamste · · Score: 1

      But do I have to help the government interpret the data?

      --
      Time to offend someone
    23. Re:The relevant part by AK+Marc · · Score: 1

      More like the actual Miranda rights should be read off as "You have the right to remain silent. If you give up that right, you may not claim it later."

      He talked, then was compelled for something related after. The courts claim that the 5th doesn't protect him because he already waived it. He can't claim it back.

    24. Re:The relevant part by AK+Marc · · Score: 1

      If the government serves you with a search warranty for your paper files you do not go and collect them into a box and hand them over.

      Subpoena then. For a subpoena, you do collect them in a box and hand them over.

    25. Re:The relevant part by AK+Marc · · Score: 1

      If he thinks you're lying, he can lock you up for contempt to "jog your memory". IIRC there is no limit to how long this can go on. It's a shitty thing to happen if you legitimately don't remember your safe combo. But it's nothing anywhere CLOSE to new.

      Like the lawyer who admitted "hiding" $2.5M from his wife, but when the divorce came to court, claimed he could no longer get it back. The judge didn't believe that someone would "lose" $2.5M with no records, but he claimed that the place he sent it overseas "lost" it and was shady enough of an operation that they refused to cooperate to validate or invalidate his story.

      The judge ruled that fanciful, so he was held for 14 years in contempt. He was released when it was determined that further holding held no coercive function.

      If he had just said "Of course I destroyed that $2.5M. I burned it so the bitch couldn't get it" he might have been more believable and not served time.

      http://en.wikipedia.org/wiki/H... for one reference. The rest is remembered by me from news of the time. I was mid 20s when he was first held in contempt.

    26. Re:The relevant part by sabri · · Score: 1

      The judge ruled that fanciful, so he was held for 14 years in contempt.

      This. Exactly this. This is what makes the Government evil. We have all these rules saying that you can't be put in jail without law enforcement providing evidence that you committed a crime. Yet, fact of the matter is, even on the Soviet States of America, you are at the mercy of a single Government employee.

      --
      I'm not a complete idiot... Some parts are missing.
    27. Re:The relevant part by garyebickford · · Score: 1

      If he had not admitted involvement, and said that the evidence was in there, he wouldn't be in the situation. He gave them probable cause for a search. This is much like telling the cops, "I've got dope in the trunk, but I won't open it." There are other comments that go into more detail so I won't bother.

      --
      It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
    28. Re:The relevant part by AK+Marc · · Score: 1

      They "proved" a crime to the satisfaction of a judge, and multiple appeals judges.

      They had proof he hid money. He had no proof he lost the money he hid. So, to the court's satisfaction, he had committed fraud, and the contempt charge was to compel a confession.

    29. Re:The relevant part by sabri · · Score: 1

      So, to the court's satisfaction, he had committed fraud, and the contempt charge was to compel a confession.

      You are proving my exact point.

      If someone is suspected of committing fraud, he should be tried for fraud according to criminal law. That means he should be given a proper trial where a jury decides, and when found guilty, a sentence with an end. What happened in the above case, is a single judge on a non-criminal trial suffering from the Judge Dredd syndrom: judge, jury and executioner.

      --
      I'm not a complete idiot... Some parts are missing.
    30. Re:The relevant part by AK+Marc · · Score: 1

      It was a civil fraud. He confessed to having had money. He then refused to provide it, or evidence he didn't have it anymore.

      That's exactly how it is supposed to work. Though I think in his case, the contempt charge was partially punitive, as if it happened as he did describe, he did an electronic equivalent of piling up his cash and burning it to make sure "she" didn't get it. Which is illegal some places, but not there.

    31. Re:The relevant part by sabri · · Score: 1

      Though I think in his case, the contempt charge was partially punitive,

      And any system under which someone is kept in prison without any criminal charges for 14 years is a Judge Dredd system, indicative of an abusive government.

      I have a hard time believing someone would volunteer to be in prison for 2.3 million dollars. That equals ~$450 a day, which any decent laywer will make in an hour.

      --
      I'm not a complete idiot... Some parts are missing.
    32. Re:The relevant part by AK+Marc · · Score: 1
      $450 an hour for a lawyer? That seems high.

      And any system under which someone is kept in prison without any criminal charges for 14 years is a Judge Dredd system, indicative of an abusive government.

      Yup, carefully worded. He was charged, but contempt in a civil trial is usually not a criminal offense. He was charged, tried, and convicted. But with contempt, it is a Judge Dredd system, where the judge is all three branches.

    33. Re:The relevant part by Anonymous Coward · · Score: 0

      a stack of black paper and a pen

      For instant redaction!

    34. Re:The relevant part by Uberbah · · Score: 1

      They had proof he hid money. He had no proof he lost the money he hid. So, to the court's satisfaction, he had committed fraud, and the contempt charge was to compel a confession.

      Yes, they were demanding that he prove a negative, which is of course impossible to do. If the government couldn't prove that he still had the money, the government had no business holding him.

    35. Re:The relevant part by AK+Marc · · Score: 1

      Yes, they were demanding that he prove a negative, which is of course impossible to do.

      So receipts are imaginary? He "spent" the money, and couldn't prove the positive that he spent the money.

      If the government couldn't prove that he still had the money, the government had no business holding him.

      You are asking the government to prove the negative. That he didn't spend the money.

    36. Re:The relevant part by Uberbah · · Score: 1

      So receipts are imaginary?

      I went to Wal-Mart last night. I did not keep my receipt. Was my trip to the store imaginary?

      You are asking the government to prove the negative. That he didn't spend the money.

      Willfully obtuse. Anyone who's passed 2nd grade civics knows it's the government's job to prove your guilt (hiding the money), not your job to prove your innocence(money was spent).

    37. Re:The relevant part by AK+Marc · · Score: 1

      Willfully obtuse. Anyone who's passed 2nd grade civics knows it's the government's job to prove your guilt (hiding the money), not your job to prove your innocence(money was spent).

      You are the one that's willfully obtuse. The government proved he had possession. He then deliberately hid it from the government, so the government can't "prove" anything past that point. That is sufficient to hold him in contempt for not providing the money known to exist, or proof it no longer exists.

      He claimed he was defrauded. Then refused to file a fraud complaint against the person (or persons) who defrauded him. The inconsistent behavior and proof he had the money, but no indication of where it went after he deliberately hid it.

    38. Re:The relevant part by Uberbah · · Score: 1

      You are the one that's willfully obtuse.

      Fraid not. Having the money at some point and trying to invest it - what the government was able to prove - was not violating the law. He was kept in jail because the judge thought he was hiding the money - something the government was never able to prove.

      Then refused to file a fraud complaint against the person (or persons) who defrauded him. The inconsistent behavior and proof he had the money, but no indication of where it went after he deliberately hid it.

      Which would be relevant in a perjury case if he turns up this weekend in a yacht, but irrelevant to keeping him in prison for one year, much less 14. It's the government's job to prove your guilt, not your job to prove your innocence.

    39. Re:The relevant part by AK+Marc · · Score: 1

      It's the government's job to prove your guilt, not your job to prove your innocence.

      He wasn't accused of a crime, so the government didn't need to prove guilt. He was ordered in a divorce proceeding to provide the money he was shown to have, or prove he no longer has it. He refused to do either, so was held in contempt. He was "proven" to have committed the crime of not obeying the court. That was the only "crime" committed.

  8. in what way is this not self-incrimination by Anonymous Coward · · Score: 0

    just as with a confiscated safe. Authorities should be forced to crack into it themselves.

    1. Re:in what way is this not self-incrimination by pixelpusher220 · · Score: 2

      A key is a physical object and as such can be compelled. You aren't participating in your testimony by providing the physical item; you have to provide LOTS of other information during disclosure so it's not like you can't be compelled to provide something that physically exists.

      The difference here is that the key is theoretically in his mind and so he would have to participate in providing that; hence why it's generally been found that keys can be compelled but combinations on locks can't and similarly passwords can't be.
      BR Of course the amendments have been eroding for some time now...

      --
      People in cars cause accidents....accidents in cars cause people :-D
    2. Re:in what way is this not self-incrimination by Ceriel+Nosforit · · Score: 1

      Seems like he had already incriminated himself when he talked to the cops. That's a strange thing for a lawyer to do to begin with...

      --
      All rites reversed 2010
    3. Re:in what way is this not self-incrimination by Anonymous Coward · · Score: 0

      Courts think they can compel people to do so, but this is false. The burden of proof lies with the accuser, and the defendant has no obligation to assist in that endeavor. Claiming that providing them a key is not testamony when in fact the information obtained will result in evidence against him, is the act of snake oil salesmen. Do you doubt in a court of law that they would reveal that he provided them the key, and so it is proof that he exercised control and had the information? That is testifying against himself.

      If he does not remember the password, or if his defense is that somebody else controls that laptop, then telling them the password, he in effect will be testifying against himself or his family, and destroying his own defense.

      If I have a door with a padlock on it, and they want into it, I am not going to provide them the key under any circumstance, but they can get a hacksaw and cut it. The same is true with encryption. It's not the job of the defendant to compensate his accusers for the inadequacies of their tools.

      Let them ask the NSA for help. According to Snowden they are allegedly able to get around all encryption aren't they?

    4. Re:in what way is this not self-incrimination by chihowa · · Score: 1

      A key is a physical object and as such can be compelled.

      In what circumstances are you compelled to produce physical objects? If this was the case, wouldn't murder trials always start by compelling the defendant to produce the murder weapon and the body?

      --
      If you want a vision of the future, imagine a youtube comments section scrolling - forever.
    5. Re:in what way is this not self-incrimination by chihowa · · Score: 1

      To further clarify my point: the key, as a physical object, can be seized if it can be found. The safe can also be seized and its lock forced, but none of that requires the cooperation of the defendant.

      ...you have to provide LOTS of other information during disclosure...

      You actually don't have to provide anything other than to identify yourself. As a defendant, you don't have to cooperate in the investigation against you. It may help you to cooperate (if you're innocent and can prove it), but you aren't required to do so.

      --
      If you want a vision of the future, imagine a youtube comments section scrolling - forever.
    6. Re:in what way is this not self-incrimination by Anonymous Coward · · Score: 0

      The physical object compelled is the key to a safe. The safe exists, so clearly there is a key to it. If the safe is provably the property of the accused, they can be compelled to produce the key. A murder suspect could certainly be compelled to produce his personal firearms for testing against the ballistics of a bullet - the same way they can compel you to be fingerprinted. Fingerprints don't incriminate you, their presence on the murder weapon is what incriminates you.

      A key to safe is nothing more than than a key to a safe...unless of course you used the key to kill someone ;-)

    7. Re:in what way is this not self-incrimination by Anonymous Coward · · Score: 0

      you can believe what you want to believe, but physical objects can be compelled...and are routinely. They aren't aiding anything, they simply exist.

      They can and do compel you to give your fingerprints...or do you think people shouldn't be fingerprinted when arrested?

  9. Ruling doesn't change much. by timrod · · Score: 5, Informative

    If you read the ruling, the court admits that the only reason they said the defendant could be compelled to decrypt his data was because he had already admitted to the police that he was involved in the case, and that the details of his involvement were on the hard drive. I'm sure if he had kept silent the entire time and told them nothing, it would've been a different story.

    1. Re:Ruling doesn't change much. by rahvin112 · · Score: 3, Funny

      You would think a lawyer would know better than to talk to the police.

    2. Re:Ruling doesn't change much. by Nyder · · Score: 2

      If you read the ruling, the court admits that the only reason they said the defendant could be compelled to decrypt his data was because he had already admitted to the police that he was involved in the case, and that the details of his involvement were on the hard drive. I'm sure if he had kept silent the entire time and told them nothing, it would've been a different story.

      I don't agree. Even if he admitted he as involved, giving up any evidence of his involvement is self-incrimination. They don't know how much he was involved and his evidence would show that. Obviously if he gives it to them, it will show exactly what he was doing, thus proving he was guilty, which would be self-incrimination if he gives it.

      They need to prove he broke the law with other evidence, then what he has encrypted, because legally, they aren't allowed to have him give up the info.

      --
      Be seeing you...
    3. Re:Ruling doesn't change much. by pixelpusher220 · · Score: 1

      I haven't RTFR but while yes he's said he's involved, I wouldn't expect he'd have to tell them WHAT his involvement was...that's the prosecutions job.

      The ruling (from accounts) seems to be separating the providing of the password from the contents of the drive - which is an unreasonable search. If they already know what he's done from what he's said, they could easily give him immunity for anything else found on the drive except what backs up what he's already said - then there's no 5th violation.

      Also generally speaking, the warrant to search a drive has to be pretty damned specific, so if they already know what he did...it seems odd to request access to the drive.

      --
      People in cars cause accidents....accidents in cars cause people :-D
    4. Re:Ruling doesn't change much. by Anonymous Coward · · Score: 0

      Now prove the NSA didn't install a dummy password prompt and the hard drive doesn't "decrypt" to whatever the fuck they want it to.

      There is no such thing as digital evidence anymore.

    5. Re:Ruling doesn't change much. by Rary · · Score: 4, Informative

      You may not agree, but it seems to be well established in law that once you admit to the crime and identify the existence and location of evidence, you've waived your 5th Amendment right.

      --

      "You cannot simultaneously prevent and prepare for war." -- Albert Einstein

    6. Re:Ruling doesn't change much. by Anonymous Coward · · Score: 0

      The 5th Amendment never allowed a defendant to cherry-pick. Once you open your mouth, you've waived your rights for that line of inquiry. For example, if you freely volunteer the fact that you rent a storage locker, you can't then refuse to reveal the name of the rental company just to hinder the investigation. Once this guy told them what was encrypted on the laptop and that he had the key, he was screwed.

      Rule number one: SHUT THE FUCK UP. This is doubly true if you think you are smart donkey. From the moment you are arrested to the moment you have a lawyer, there is nothing in the world you can say to improve your legal outcome.

    7. Re:Ruling doesn't change much. by Anonymous Coward · · Score: 0

      Sure. He admitted to a crime and identified the existence and location of evidence - it was on a harddrive. Presumably, their is nothing preventing the harddrive from being accessed. The encrypted data can be read off just fine.

    8. Re:Ruling doesn't change much. by Overzeetop · · Score: 1

      So if you admitted to killing the president, and that the murder weapon was in a locked safe that would take 1000 years to break into, you could not be compelled to open that safe?

      --
      Is it just my observation, or are there way too many stupid people in the world?
    9. Re:Ruling doesn't change much. by Anonymous Coward · · Score: 0

      Why would you have to admit you know how the password to your own computer? How the hell is that incriminating?

    10. Re:Ruling doesn't change much. by Anonymous Coward · · Score: 0

      If you confessed to the crime, why would they need to recover the murder weapon? Your confession is enough to convict you.

      And what does the President have to do with anything? That some animals are more equal than others and that the Constitution doesn't apply if a crime is committed against a supercitizen?

    11. Re:Ruling doesn't change much. by Anonymous Coward · · Score: 0

      The fifth amendment never allowed the government to cherry pick. The Constitution limits the powers of the government, not the rights of the citizens. If there was a case where the right was waived, it would be spelled out in the powers given to the government. That it isn't spelled out means that there are no exceptions.

    12. Re:Ruling doesn't change much. by Anonymous Coward · · Score: 0

      If you confessed to the crime, why would they need to recover the murder weapon? Your confession is enough to convict you.

      In the interest of justice, I would want to see further proof. People confessing to crimes they didn't commit is more commonplace than you'd think.

    13. Re:Ruling doesn't change much. by KevReedUK · · Score: 1

      From the moment you are arrested to the moment you have a lawyer, there is nothing in the world you can say to improve your legal outcome.

      Technically not true...

      If you say you want legal representation, that is:

      a) Something you can say
      b) Something that can improve your legal outcome

      --
      Just my $0.03 (At current exchange rates, my £0.02 is worth more than your $0.02)
    14. Re:Ruling doesn't change much. by physicsphairy · · Score: 1

      Because forensic analysts have determined the same gun used to kill the president may have been used to kill the Joint Chiefs. Because they think someone else may have used your gun. Because they believe the person who sold you your gun is an accomplice. Because you are contesting your confession.

      It's a rather cynical view that the only point of trying someone for a crime is to send them to prison for that crime. The point is to find out the truth and mete out justice accordingly. That requires a full evaluation of all of the evidence. In this case, the lawyer has admitted the evidence exists and is located on the harddrive, but it's not clear how the details of that evidence will affect the case and subseqeunt sentencing.

    15. Re:Ruling doesn't change much. by david_thornley · · Score: 1

      If you admitted to killing the President, you've confessed and other details are irrelevant. If it were known that the murder weapon were in a certain locked safe, whether you could open it would be material evidence in your trial, and you could not be forced to give the combination unless there was already very strong evidence that you could. If the court knew that the murder weapon was in the safe and that you could open it, because that's what you already told the police, because you're stupid, then they could compel you to open the safe.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    16. Re:Ruling doesn't change much. by JoelKatz · · Score: 1

      "Boy am I glad my client talked to the police!" exclaimed no lawyer ever.

  10. I lost the password by Anonymous Coward · · Score: 5, Insightful

    if it's good enough for the IRS....

  11. WTF? How is this not self incrimination? by istartedi · · Score: 1

    Next stop, SCOTUS and get new lawyers if they don't want to take you there.

    --
    For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
  12. Re:WTF? How is this not self incrimination? by 0123456 · · Score: 3, Insightful

    It's not self-incrimination in the same way that the intersate commerce clause gives the Federal government the power to regulate absolutlely anything that might have any impact on interstate commerce even if it never leaves your house.

    That is, it's clearly a blatant violation of the Constitution, to everyone but lawyers.

  13. Welcome to new America by Culture20 · · Score: 0

    The will of the people is embraced.
    The will of the people is extended.
    The will of the people is extinguished.

  14. Important Caveat by Rary · · Score: 5, Informative

    Haven't read the entire ruling, only scanned it, but there is an important caveat in it:

    We now conclude that the answer to the reported question is, "Yes, where the defendant's compelled decryption would not communicate facts of a testimonial nature to the Commonwealth beyond what the defendant already had admitted to investigators."

    Seems like this guy has said "I did this, this, and this, and these files show that, but I don't want to let you see them", and the Court has ruled that he has to, because he's already admitted to those things, and therefore he would not be incriminating himself in doing so.

    Of course, the reality may be that there's evidence of further illegal activities that he hasn't admitted to in the encrypted files. That might make the case for self-incrimination. I'd have to read the full ruling to see what, if anything, they said about that possibility.

    --

    "You cannot simultaneously prevent and prepare for war." -- Albert Einstein

    1. Re:Important Caveat by mrchaotica · · Score: 1

      Of course, the reality may be that there's evidence of further illegal activities that he hasn't admitted to in the encrypted files. That might make the case for self-incrimination.

      But in making such an argument, wouldn't he then be admitting them, thus invalidating the case for self-incrimination? Sure, it's a catch-22 (and therefore should not be true), but the judicial system doesn't seem to care about that anymore...

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    2. Re:Important Caveat by Rary · · Score: 2

      Just doing a little digging into the details of the 5th Amendment in practice, and found this interesting tidbit:

      The Court acknowledged that it is well established that a witness, in a single proceeding, may not testify voluntarily about a subject and then invoke the Privilege against Self-Incrimination when questioned about the details.

      That could very well apply in this case, so that even if there is additional evidence in the files beyond what he has admitted to, the moment he started admitting to some of it, he effectively waived his self-incrimination right.

      --

      "You cannot simultaneously prevent and prepare for war." -- Albert Einstein

    3. Re:Important Caveat by Sarten-X · · Score: 1

      The question at hand is

      "whether the act of entering the password to decrypt the contents of a computer was an act of self-incrimination"

      What I find interesting is that the answer is "no", implying that merely unlocking an encrypted disk does not in any way imply a criminal action. That would also necessarily mean that having an encrypted disk is affirmed by judgement to not be a criminal action

      --
      You do not have a moral or legal right to do absolutely anything you want.
    4. Re:Important Caveat by Anonymous Coward · · Score: 0

      The 5th Amendment clearly states, "... nor shall be compelled in any criminal case to be a witness against himself...". It doesn't say anything about exceptions or waiving rights once a person starts talking. The wording is pretty straightforward.

      No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.

    5. Re:Important Caveat by DrJimbo · · Score: 1

      What the large print giveth, the small print taketh away.

      --
      We don't see the world as it is, we see it as we are.
      -- Anais Nin
    6. Re:Important Caveat by Andreas+Mayer · · Score: 1

      Just doing a little digging into the details of the 5th Amendment in practice, and found this interesting tidbit:

      The Court acknowledged that it is well established that a witness, in a single proceeding, may not testify voluntarily about a subject and then invoke the Privilege against Self-Incrimination when questioned about the details.

      That could very well apply in this case, so that even if there is additional evidence in the files beyond what he has admitted to, the moment he started admitting to some of it, he effectively waived his self-incrimination right.

      So ... what if he said that there's also information on the laptop that is not related to the case - i.e. about something which he didn't talk about - but which might be illegal?
      Then giving up the encryption keys would be self-incriminating, no?

    7. Re:Important Caveat by Anonymous Coward · · Score: 0

      may be....you cannot take that as an admission...

    8. Re:Important Caveat by david_thornley · · Score: 1

      Your claim of possible self-incrimination cannot be used as evidence of guilt in a court of law. Otherwise, the Fifth would be absolutely useless.

      Now, if there's further incriminating evidence in the files, I'd think the Fourth would be more relevant. A warrant must be specific about what the authorities are searching for, and while they may take note of things they see in the execution of the warrant they may not deliberately look anywhere else. (If the judge thinks you're likely hiding the dead body in your house, the police may note the drug paraphernalia left on the dining room table, but they can't open a drawer or anything else too small to hold a body.) Therefore, if the warrant specified a search for email, the investigators would only be able to look at files that might contain email.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  15. criminal defense attorney and programmer here by Anonymous Coward · · Score: 5, Informative

    This is why you don't talk to the cops, especially if you find yourself in the fortunate situation of having illegally acquired 13 million dollars and encrypted all of the evidence. If you say nothing to the cops, you win. The only way you lose is if you brag to them about how awesome a job you did at getting away with the crime.

    The people up here who are saying "tell them you lost the key" "tell them it was scrambled not encrypted, etc" are all idiots. Lying to the cops is a crime. Telling them nothing is the superior response.

    Cop executing search warrant: "it's asking for a password"
    Def: "I want a lawyer, I'm not talking to you"
    Cop: "You encrypted it, didn't you?"
    Def: "lawyer lawyer lawyer"
    Cop: "We'll just get a warrant anyway and you'll go to jail. Help us help you."
    Def: "did't you hear me? I want a lawyer"

    That being said, I'm in FL so I'm covered by the 11th circuit ruling. Either way, silence is golden. I'd say that at least 30 percent of my cases would have turned out much better if clients hadn't consented to searches, admitted to elements of crimes or just generally blabbed when they should have remained silent.

    1. Re:criminal defense attorney and programmer here by Anonymous Coward · · Score: 0

      I would imagine your cases would have also turned out better if your clients weren't guilty.

    2. Re:criminal defense attorney and programmer here by Anonymous Coward · · Score: 0

      /You/ are the idiot for not reading either the article or the responses: people suggesting he lie are assuming he's already made the mistake of bragging about his deeds, as is the case. In this instance, if he lies by saying that he has provided the correct password, the court has to a.) know that he's lying, and b.) prove that he's lying. Assuming, of course, that the rest of the court system is even remotely just, then the onus is on the prosecutors to prove that there is data in that scrambled data, /and/ prove that he's knowingly withholding the method by which it can be unscrambled.

    3. Re:criminal defense attorney and programmer here by Anonymous Coward · · Score: 0

      Perhaps surprisingly, criminal defense consists mostly of providing legal services to people who have committed crimes and gotten caught. That's pretty much how it works about 95% of the time.

    4. Re:criminal defense attorney and programmer here by Anonymous Coward · · Score: 0

      Wasn't there a book written on this subject, "Three Felonies a Day" or something like that. In the current legal systems eyes we're ALL guilty of something that could put us in jail for a long time. The only things limiting the number of incarcerated are the "justice" systems resources (court time, police time, prison money) and the precarious public perception that those in jail deserve it. I think 1 in 100 people have been in jail for a significant amount of time and we have the highest prison population of any country on the planet, not per capita, total, and we have a pretty significant lead on the "competition" (Russia I think).

    5. Re:criminal defense attorney and programmer here by Anonymous Coward · · Score: 0

      I can't even figure out what scenario this is. Are you saying while executing a search warrant cops just log into computers on scene? That makes no sense. If you have a warrant for a computer/drives/etc. you take the item and log it into evidence for the computer techs to examine later. Or maybe this is post-warrant at the station when the tech is going through the computer and they brought the owner in to talk. Well, then the request for an attorney makes no sense. You're not in custody at that point so if you want an attorney you need to call them yourself. Or, you can just walk out. But the police don't have to arrange an attorney for you. Or, maybe the person is in jail and was brought in, but that still doesn't make any sense, because then the meeting would have been scheduled through the attorney.

      And what's with the "We'll just get a warrant anyway and you'll go to jail." The warrant has already been served. How else did the cops get the computer? Why do they need a second warrant for an item enumerated in the first warrant? Is this how you imagine things working. 1. Warrant to enter home. 2. Warrant to seize computer. 3. Warrant to open said computer. 4. Warrant to turn on computer. 5. Warrant to try and access computer. It's just 1. warrant listing computer as thing to be seized. The cops can do whatever they need to do to access it after that. As for the going to jail part that would be ordered by the judge for contempt of court for failing to disclose certain testimony/evidence. The problem with your scenario is that it probably wouldn't happen unless the person already admitted it thereby eliminating any further incrimination. That is, you admit crime 1, evidence for crime 1 is on the computer and there is no other evidence for further crimes. You can be compelled because the evidence doesn't incriminate you further. However, if you admit crime 1 but there is evidence of crimes 2-100 on the computer you can't be compelled (there was a case exactly on this point about child porn through the airport. The feds decrypted one drive then said we've got him on this stuff now compel him to decrypt the rest. But they also said they would increase charges depending on what they found on the other drives. The court said that you can't compel in that instance, because of the possibility of new charges). However, if you admit crime 1, evidence of crimes 2-100 are on the computer and you are given immunity to 2-100 then you can be compelled because there is no further incrimination.

      The problem with instance 2 is that how do you know if there will be more charges? I don't know; it's unique to each circumstance. I don't know enough about the MA case to say how the Court determined that, so I can't say if it's proper or not.

    6. Re:criminal defense attorney and programmer here by Anonymous Coward · · Score: 0

      Only 30% of your clients would benefit from asserting their rights? I would have thought it would be at least double that.

    7. Re:criminal defense attorney and programmer here by Svartalf · · Score: 2

      Precisely. There's several copies of a prominent law professor's lecture on the subject and spells out PRECISELY why you don't do things like that.

      https://www.youtube.com/watch?...

      Now, the burning question would be, "how did they get access to his encrypted system files?"- without a warrant, they're just as screwed in light of the recent Supreme Court rulings. You need a warrant for those things- and you need to state you're looking for a specific on them before they can legitimately reach the conclusion the Mass Supreme Court arrived at. Without that, it's just like the Fourth Amendment violation I experienced about 5 years ago. No *VALID* warrant? No case. No seizure allowed.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    8. Re:criminal defense attorney and programmer here by Anonymous Coward · · Score: 0

      It is standard procedure that if there is a suspicion that encryption is in use on a computer that falls under the scope of the warrant and is running at the scene that the running system be triaged. This includes the possibility of imaging the running computer at the site of the warrant prior to seizure and inventory. It could also include dumping a copy of RAM for dissection later, which has a very high probability of yielding the private encryption keys. Additionally, the system could be seized and transported in a running state and then fully examined back in the lab under controlled circumstances.

      There are approximately a million reasons that consent could be granted for a search and then withdrawn that would require a warrant to be obtained. There are also situations where evidence is uncovered of a different crime that requires an amended scope to the original warrant. These things happen.

      I spent the better part of a decade as a government forensic analyst and have worked these situations many times. As a good rule of thumb - don't take the advice given by 99.9% of the helpful posters on this thread - unless you want a nice long stay at club fed.

      Regardless, the parent is definitely not someone experienced in the fineries of defending a person when confronted with a situation such as this. Based on the language and terminology used, I wouldn't be surprised to find the poster wasn't even a real attorney. But, it's the internet - go figure.

       

    9. Re:criminal defense attorney and programmer here by LiENUS · · Score: 1

      Cop executing search warrant: "it's asking for a password"

      Wouldn't the cop executing the search warrant have just lost the case at this point? Seems to be dicking around on computers containing evidence outside of a forensics lab would ruin the chain of custody.

  16. Re:WTF? How is this not self incrimination? by gatkinso · · Score: 1

    He already incriminated himself when he told the cops that there was evidence on the encrypted drives.

    --
    I am very small, utmostly microscopic.
  17. Second key by OnAutopilot · · Score: 2

    Would it be possible to have a system where you have a second key that "decrypts" to an empty drive? I don't see how they could prove that you used your primary or fake key.

    1. Re:Second key by drjohn_97 · · Score: 1

      The ruling mentions this, and says he's compelled NOT to enter a different password that shows other data than what is being requested.

    2. Re:Second key by Anonymous Coward · · Score: 0

      > Would it be possible to have a system where you have a second key that "decrypts" to an empty drive?

      That is how truecrypt works.

      Yes I am aware of the recent controversy around truecrypt. That would be off-topic.

    3. Re:Second key by TheCrazyMonkey · · Score: 1

      Truecrypt has/had something like that. It allows you to have a secondary, hidden partition in the "free" space of the disk image. Alas, it appears to be dying without a good replacement that I know of.

    4. Re:Second key by Anubis+IV · · Score: 1

      In fact, there are multiple ways of handling schemes such as that. Different passwords may decrypt to partitions that are empty, only contain your benign data, only contain your incriminating data, or may erase everything. Decrypting a partition that is empty or erasing everything is a pretty obvious ploy, but if you actually keep your benign data on a partition separate from the incriminating data, it'd be a lot harder for them to prove anything.

    5. Re:Second key by Moskit · · Score: 1

      TrueCrypt Hidden Volume.

      Oh wait, TrueCrypt is now Not Secure As :-(

    6. Re:Second key by Vellmont · · Score: 1

      Yes, (though it's not exactly an empty drive). It's called deniable encryption, and is intened to stand up to "rubber hose cryptanalyis". (Or court orders as the case may be).

      http://en.wikipedia.org/wiki/D...

      --
      AccountKiller
    7. Re:Second key by blueg3 · · Score: 1

      I don't see how they could prove that you used your primary or fake key.

      A good starting point would be not telling the police the contents of the encrypted hard drive before decrypting it (as he did). Now they have a pretty good guess as to what the drive ought to contain.

    8. Re:Second key by Totenglocke · · Score: 1

      So, essentially, the court ruled that he must "open the safe" and if the evidence that they want isn't there, he'll be convicted. Either way, the court just ruled that this guy is going to jail, regardless of what is or isn't on that laptop. What a load of bullshit.

      --
      "The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants." ~Thomas Jefferson
    9. Re:Second key by Tolvor · · Score: 1

      Bestcrypt (commercial-ware) also has the functionality to hide an invisible second encrypted partition inside a first. It seems to be the best alternative to TC.

    10. Re:Second key by Anonymous Coward · · Score: 0

      An empty drive wouldn't be the best thing, but if you're organized, you'd be able to keep your mundane business in one side, while storing your "other" activity in the other. I don't know of any encryption systems that do this, but it's an interesting concept for a new product.

    11. Re:Second key by dgatwood · · Score: 1

      Just so long as you're aware that "erase everything" is useless against law enforcement, who start by shutting down your system and cloning the drive, then booting your machine off of the clone. In fact, it's worse than useless, because it qualifies as attempting to destroy evidence, and is trivially provable by comparing the original to the clone. So you'll go to jail just for trying that.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    12. Re:Second key by Anubis+IV · · Score: 1

      VERY true, and something I realized I forgot to mention the moment I hit the button to post that comment. Thanks for bringing it up.

    13. Re:Second key by david_thornley · · Score: 1

      Actually, he was going to jail after he told the police far more than he should have. If you are read your Miranda rights, and then tell the police you did the crime, you're going to prison. In this case, he told the police that there was specific encrypted evidence and that he could decrypt it. At that point, assuming the evidence would be enough to convict him, he was screwed.

      Moral of the story: if the police have arrested you, have read you your Miranda rights, and are questioning you, keep your damn mouth shut. Tell them you refuse to answer and you want a lawyer. Say nothing else. Don't boast to them. Don't lie to them. Don't think you're clever and drop tantalizing hints. Point one of Miranda says you have the right to remain silent, and point three says you can get a lawyer. Take both of them to heart.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  18. ...I can't recall by Anonymous Coward · · Score: 0

    works for the GOP leaders when they testify...or their cronies.

  19. Next stop contempt by Russ1642 · · Score: 1

    He'll have to call their bluff by not providing the password, and they'll probably hold him for contempt. Then there will be a public opinion campaign to have him released.

  20. Yeah, no. Crossreference ... by Anonymous Coward · · Score: 0

    Boyd v. United States. This scenario is no different than in Boyd, except for the fact in Boyd the records were on paper and in this case they are electronic. Where can I donate to the defense fund?

  21. in what way is this not self-incrimination by Anonymous Coward · · Score: 0

    just as with a confiscated safe. Authorities should be forced to crack into it themselves.

    According to this ruling, if I tell the police that I keep records of 'X' in my safe, I can be compelled to open it for them. If I keep my big mouth shut, which is what this guy should have done, then they may be forced to crack it.

  22. "triggered"? by Anonymous Coward · · Score: 0

    the defendant's act of decryption does not trigger Fifth Amendment protection

    There is NO constitutional NOR legal requirement for a right to be "triggered" in order for it to be applied.

    What terrible weasel words;

    But his admission of involvement sealed the deal against him -- he should've maintained the 5th throughout
    the whole process.

  23. Re:Face it ... by Anonymous Coward · · Score: 0

    I'd like to get a bill on Congress that mandates that U.S. citizens must house military personnel in their homes at their own expense. It's unconsitutional of course, but when did that ever stop anyone?

  24. Re:WTF? How is this not self incrimination? by Anonymous Coward · · Score: 0

    Well, it's just like if you told the cops that you had indeed been around the crime scene at the time they asked you about, and so they're allowed to FMRI your memories out about that period of time to prove you're guilty.

    Totally not self incriminating. The "self" has been redefined to mean: A collection of molecules that you used to be, but are not now.

  25. This is what happens when you elect Republicans... by Anonymous Coward · · Score: 0

    They have not a shred of common sense. They aren't smart enough to comprehend rights so all they do is fuck over the public like this.

  26. Digital vs Physical by Quantus347 · · Score: 4, Insightful

    I get the legalese argument the guy as trying to make and the narrow line they tried to draw with the ruling, but Im not sure why it even got past the original judge.

    If it had been the exact same situation, just a combination lock on on physical file cabinet in his office, once a proper court subpena was issued Law Enforcement might have asked for the combination as a courtesy but would have been perfectly within their rights to simply cut the thing open. And if they found evidence of some unrelated crime, that is long been fair game just like a drug bust during a traffic stop.

    Maybe it's different by State, I dont know

    --
    Common Sense isn't as Common as people think...
    1. Re:Digital vs Physical by JeffOwl · · Score: 2

      The difference is that a locked file cabinet is trivial to circumvent without the cooperation of the key or combination holder. Once they had the warrant the police wouldn't bother with the courts, they would hire a locksmith or some other such expert to break open the cabinet or safe. Apparently the encryption on the hard drive in this case is much more difficult if not impossible for anyone at the state level to break it within a reasonable time period. So to avoid waiting 5 years and spending lots of $ on super computer time, they went to a judge to see if the threat of jail would shortcut the process.

      Oblig: http://xkcd.com/538/

    2. Re:Digital vs Physical by Arker · · Score: 2

      "If it had been the exact same situation, just a combination lock on on physical file cabinet in his office, once a proper court subpena was issued Law Enforcement might have asked for the combination as a courtesy but would have been perfectly within their rights to simply cut the thing open."

      The only difference appears to be that the LE agency involved purports to be incapable of 'cutting the lock.'

      Well that and the unwise statements made to police by the defendant voluntarily. It would be interesting if a similar case could be constructed with an un-cuttable physical lock, but of course such things do not exist...

      --
      =-=-=-=-=-=-=-=-=-=-=-=-=-=-
      Friends don't let friends enable ecmascript.
    3. Re:Digital vs Physical by Anonymous Coward · · Score: 0

      I think the question is this:
      The cops show up with a warrent to search your house, including a safe. They ask you for the combination to the safe. You provide it. They find something bad. Now here is the question:
      Can the fact that you knew the combination to the safe be used against you at trial? And, if the answer is "yes" does that mean you can get 5th amendment protection to not give said combination? And, can the cops void that protection by saying that the fact you knew the combination will not be allowed as evidence in trial.

    4. Re:Digital vs Physical by dcooper_db9 · · Score: 2

      Breaking the lock only requires reasonable cause. Compelling the defendant to provide the security code introduces the fifth amendment question. Breaking encryption takes time and money that the state would rather spend elsewhere.

      --
      I do not block ads. I do block third party scripts.
    5. Re:Digital vs Physical by Anonymous Coward · · Score: 0

      Maybe it's different by State, I dont know

      Ah, but this isn't a state, it's the Commonwealth of Massachusetts, land of the Massholes

    6. Re:Digital vs Physical by AK+Marc · · Score: 2
      He confirmed he had relevant documents. They could have subpoenaed the records, rather than the key.

      It would be interesting if a similar case could be constructed with an un-cuttable physical lock, but of course such things do not exist...

      They do, if you have a sufficiently booby-trapped safe. If broken open, it destroys the contents.

    7. Re:Digital vs Physical by guruevi · · Score: 1

      There are safes out there that are virtually impossible to break into. And when you do attempt, they destroy the contents inside.

      --
      Custom electronics and digital signage for your business: www.evcircuits.com
    8. Re:Digital vs Physical by david_thornley · · Score: 1

      Assuming he was using decent encryption with a decent key, it would take a lot more than five years to break the encryption. Even AES-128 will defy brute-force attempts until the Sun runs out, and there's no known crack that would change that.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  27. How is encryption different from a safe? by bledri · · Score: 0

    This is slashdot, so I didn't read the article. I'm thrilled with this, but I wonder how encryption is any different than a safe. If the government has the legal authority (via a warrant) to open a safe, why wouldn't they have the same authority to decrypt your documents? I'm not arguing that I like the idea, but I don't see how encrypted documents would be a 5th amendment right if documents locked in a safe are not. Can you be compelled to open a safe?

    --
    Some privacy policy Slashdot.
    1. Re:How is encryption different from a safe? by gstoddart · · Score: 1

      If the government has the legal authority (via a warrant) to open a safe, why wouldn't they have the same authority to decrypt your documents?

      The difference is they can physically open the safe. They may lack the ability to decrypt your stuff.

      This is the difference between what they can get on their own with a warrant, and what they would need to compel you to help them with.

      And I have a hard time seeing how compelling you to provide them with information they don't have and can't get on their own isn't going against the intent of the 5th amendment.

      --
      Lost at C:>. Found at C.
    2. Re:How is encryption different from a safe? by Major+Blud · · Score: 1

      IANAL, but the government can open the safe themselves, but I'm not sure that they can "force" you to open your safe. Same thing with the encrypted drive; the government is free to spin their wheels trying to figure out their keys on their own, but they can't force the key from you directly.

      --
      If you post as Anonymous Coward, don't expect a reply.
    3. Re:How is encryption different from a safe? by Anonymous Coward · · Score: 0

      I don't know how encryption may be legally different from a safe, but I know this:

      The government can brute-force your safe in less than 2^100 seconds.

    4. Re:How is encryption different from a safe? by mbone · · Score: 1

      You do not have to participate in the opening of your safe. A locksmith or torch can do that without you.

      Your encrypted documents, on the other hand, may not be crackable without your help.

      Note that courts seem to feel that Iris-scans, fingerprints, etc., are not "testimony," and so are not protected. That's something to keep in mind if you wanted to purely rely on biometric keys for your encryption.

      IANAL, and this is not legal advice.

    5. Re:How is encryption different from a safe? by Anonymous Coward · · Score: 0

      > Can you be compelled to open a safe?

      Probably not, if it has a combination lock.
      With a warrant they can always break open a physical safe. But that method does not compel the owner to do anything.

    6. Re:How is encryption different from a safe? by Anonymous Coward · · Score: 0

      The difference is they can physically open the safe. They may lack the ability to decrypt your stuff.

      I don't have to help them open the safe. The cops are fully entitled to try and break in to the safe.

      If the safe is made of hardened steel and it's 4 feet thick and will cost 2 million dollars to open, that's not my problem.

    7. Re:How is encryption different from a safe? by Anonymous Coward · · Score: 0

      Then you don't understand the fifth amendment. The intent of the 5th amendment is to prevent the government from forcing you to create evidence against yourself. In this case the evidence already exists, just not in an easily accessible form.

    8. Re:How is encryption different from a safe? by Anonymous Coward · · Score: 0

      That's something to keep in mind if you wanted to purely rely on biometric keys for your encryption.

      Many people don't understand biometrics and their limitations.

      Biometrics is a device that measures some property about you (iris, retina, fingerprint, photo, etc) and compares the measured value with a previously stored value.

      All you're doing is moving the point of trust to the measuring device. Can the measuring device be compromised? Impersonated? Fooled?

    9. Re:How is encryption different from a safe? by Anonymous Coward · · Score: 0

      They may very well be unable to open a safe that is booby-trapped. Tamper with it, and a thermite charge incinerate everything inside faster than they can get anything out.

      The real trick is to have two keys. One unlocks the real data, the other unlocks fake data. Of course the fake data should be something plausible. So when they eventually "convince" you to provide a key, you grudgingly hand over the fakery key.

    10. Re:How is encryption different from a safe? by bledri · · Score: 1

      I am not thrilled with this and I wish that slashdot allowed editing (with an edit history.)

      --
      Some privacy policy Slashdot.
    11. Re:How is encryption different from a safe? by bledri · · Score: 1

      > Can you be compelled to open a safe?

      Probably not, if it has a combination lock. With a warrant they can always break open a physical safe. But that method does not compel the owner to do anything.

      Interestingly that article seems to imply you can be compelled to hand over a physical key, but not a combination as it is "contents of the mind." So if the key is stored on physical media it may not be considered "contents of the mind." And if it's stored in your mind, it can probably be brute forced fairly quickly.

      --
      Some privacy policy Slashdot.
    12. Re:How is encryption different from a safe? by garyebickford · · Score: 1

      I am associated with someone who does know this stuff. If you never write down your password, never tell anyone else, and as this case shows, don't tell anyone what's in there, they can not compel you, in the US.

      --
      It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
  28. So whats the case law on keys by silas_moeckel · · Score: 1

    Has anybody else been compelled to give up a physical key or did they just get a warrant and use a locksmith? Seems this is the digital equivalent but the state is bitching that since the locksmith is to expensive and takes to much time so they need different rules.

    --
    No sir I dont like it.
    1. Re:So whats the case law on keys by Quantus347 · · Score: 2

      Not quite, but you are making a good point. According to The Ruling the only reason the motion was filed and this issue came at all up was because the guy happened to have used a particularly effective encryption software that the State was unable to circumvent. But they tried and would have been perfectly allowed to use any of the information found had they succeeded. Which is like saying that the 5th amendment would protect the contents of my safe, but only if I can afford a top-of-the-line one.

      --
      Common Sense isn't as Common as people think...
    2. Re:So whats the case law on keys by mbone · · Score: 2

      A better analog might be, suppose someone said in testimony

      I buried all my documents in a box out in the desert.

      Could they then be compelled to provide the location if police searches turned up a blank? Seems like they could.

      Of course, if you are willing to go to jail and wait it out, the "compulsion" is never forever, Seems like that might depend on just what's in those documents.

    3. Re:So whats the case law on keys by Rary · · Score: 1

      According to The Ruling the only reason the motion was filed and this issue came at all up was because the guy happened to have used a particularly effective encryption software that the State was unable to circumvent.

      No, according to the ruling, this came up as an issue because the guy had already incriminated himself by saying "I did it, and the evidence is in these files".

      You don't really get to willingly incriminate yourself, then suddenly start trying to hide behind the right not to incriminate yourself.

      --

      "You cannot simultaneously prevent and prepare for war." -- Albert Einstein

    4. Re:So whats the case law on keys by Anonymous Coward · · Score: 0

      I think they are bitching because its impossible for them to decrypt it, its like having a safe buried deep in the middle of a mountain with no way to get to it other then years and years of digging and searching hoping to find the right place.

    5. Re:So whats the case law on keys by AK+Marc · · Score: 1

      Plenty of people have received subpoenas for things that incriminate themselves. They provide it, or go to jail for contempt.

    6. Re:So whats the case law on keys by Anonymous Coward · · Score: 0

      The thing is that the state having the right to open it themselves does not actually preclude them having the right to compel the owner to open it.

      Usually it's trivial to force open a safe, so law enforcement would usually rather ask once and then do it themselves if you refuse than wast time getting a judge to compel you to help. In the case of good encryption it can be anywhere from very expensive to mathematically impossible with current technology to crack the encryption.

    7. Re:So whats the case law on keys by david_thornley · · Score: 1

      Now, if you tell them the incriminating stuff is in a box out in the desert, and can convince them it's reasonable you don't know where it is, they can't make you. Obviously, whether you know where the box is is relevant to your case, so making you give them the location would violate the Fifth. The guy in question said that he did know where the box was.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  29. He walked into this one by MikeRT · · Score: 4, Insightful

    I think the correct response here would be to say that you can plead the 5th on the question of whether you can decrypt it or not, and if you claim the 5th compulsion is illegal. However, once you make an affirmative statement you waive the right to not be compelled. In terms of a key, it would be like if you had an almost impenetrable door that used a single key. The police ask you if you are in possession of said key while they have a valid warrant. You say yes, which means they have a right to compel you to hand over the key per the valid warrant. However if you shrug and plead the 5th it should not be on you at that point.

    1. Re:He walked into this one by DoofusOfDeath · · Score: 1

      However, once you make an affirmative statement you waive the right to not be compelled.

      IANAL, but this legal theory strikes me as bullshit. Not bullshit as in, "contrary to what the SCOTUS ruled at some point", but bullshit as in, contrary to a reasonable reading of the Constitution by a citizen of normal intelligence.

    2. Re:He walked into this one by Anonymous Coward · · Score: 0

      To clarify, while they have a valid warrant that includes the contents behind the door, or, like in this ruling, if you admitted you were involved in the case they were investigating and that all the details were safely locked behind your super-door.

  30. This is not entirely what it appears in summary by Anonymous Coward · · Score: 0

    Before everyone goes off the deep end, this is a bit of a special case. The reason the court can require him to decrypt the data in this instance is that he has already admitted the crime and that the encrypted data relates to the crime. Thus, nothing new (in terms of crimes committed) would be revealed by decrypting. If he had admitted to nothing and the court had only circumstantial evidence or suspicion of his crime, he could then successfully argue that decrypting the hard drive is self incrimination.

    1. Re:This is not entirely what it appears in summary by Quantus347 · · Score: 1

      Unless I missed it (I know I broke Slashdot rules and actually read the ruling) I dont think he had actually admitted to the crimes themselves, only that he did admit that he was in possession of the Encryption Key. Presumably they already had compelling evidence of the crime itself or they wouldn't have been investigating him in the first place.


      From the Ruling:
      On the day of his arrest, the defendant was interviewed by law enforcement officials after having
      been advised of the Miranda rights. In response to questioning, he said that he had more than one
      computer in his home. The defendant also informed the officials that "[e]verything is encrypted
      and no one is going to get to it." In order to decrypt the information, he would have to "start the
      program." The defendant said that he used encryption for privacy purposes, and that when law
      enforcement officials asked him about the type of encryption used, they essentially were asking for
      the defendant's help in putting him in jail. The defendant reiterated that he was able to decrypt
      the computers, but he refused to divulge any further information that would enable a forensic
      search.

      --
      Common Sense isn't as Common as people think...
  31. Different from a subpenoe? by Anonymous Coward · · Score: 0

    How is this really different than subpoenaing a set of documents? I mean, the court is compelling someone to produce evidence that they have. There are some tails ... is losing/destroying the key destroying evidence? Perhaps. However, I don't see an order to decrypt any different than an order to provide evidence. I mean, right from the 4th "... secure in their ... papers ... unless ..." If there's probable cause adequate to compel the documents, then compelling the decryption thereof is no more an intrusion to the person's security. Now, going further, only the particular documents that are described in the warrant may be copied and searched, but that's a technical measure.

  32. Not far wrong. by westlake · · Score: 1

    So what they're saying is that since the decryption key isn't "testimony" it doesn't count under the 5th Amendment. (IANAL)

    The roots of the privilege against self-incrimination lie in use of torture to extract confessions, but judges remain firmly convinced that all relevant evidence should be admissible in court. They do not like carving out exceptions.

    1. Re:Not far wrong. by schwit1 · · Score: 1

      When did the 5th amendment right become a privilege?

    2. Re:Not far wrong. by Anonymous Coward · · Score: 0

      There is no "roots of the privilege against self-incrimination". First, it's not a privilege, it is a right, and it's clearly defined. No intrepretation is required.

      The court rulling is nothing more than the court skirting it's responsibility to law, and the judge violating his oath of office.

    3. Re:Not far wrong. by Anonymous Coward · · Score: 0

      When did the 5th amendment right become a privilege?

      If you admit to something and then plead the 5th, your right doesn't protect you from what you've said.

      You exercise that right by doing exactly what it allows.

    4. Re:Not far wrong. by Anonymous Coward · · Score: 0

      Never use the word 'privilege'. It is a RIGHT. Privileges are granted, rights simply exist. We must never, ever allow the government to convince us that anything is a "privilege"--and they try very, very hard, such as with driving. The people who manage drivers' licenses are very deliberate and precise in their use of language to attempt to get people to believe their point of view, which is rooted in nothing since the Constitution does not permit the government to grant privileges, nor does it even mention the term. We need to be just as deliberate and precise the other way.

  33. No need to lie by Anonymous Coward · · Score: 0

    If authorities ask for the decryption key, don't lie, simply plead the fifth when they ask. State that you are invoking your fifth amendment rights against self-incrimination -- that way you are shielded from future perjury charges for lying about knowing the key.

    Seems like a nice legal loophole.

    1. Re:No need to lie by PPH · · Score: 1

      My encrypted volume password: "IPleadTheFifth".

      --
      Have gnu, will travel.
  34. As a lawyer he should have known better by Arker · · Score: 4, Informative

    The ruling appears flawed, I sympathize with the dissent, but yeah. This guy screwed himself, in typical lawyer fashion, with excess arrogance.

    He did not have to tell the police anything here, he has probably lectured his clients many times on exactly why they should never talk to the police, does not matter if you have nothing to hide, does not matter if you think you have done nothing wrong, and if you have done something but think you can talk your way out of it you are a fool. Ask for your lawyer then shut your mouth, and do not answer any questions, I dont care if they ask you about the weather, the reply is 'ask my lawyer.'

    From the language used in the opinion, if he had simply shut his mouth and not started bragging/volunteering information, he would be in a very different situation today.

    --
    =-=-=-=-=-=-=-=-=-=-=-=-=-=-
    Friends don't let friends enable ecmascript.
  35. Re:Face it ... by darkmeridian · · Score: 1

    That's pretty edgy and cool but it's also completely wrong. Read the decision. Let's start with the simple notion that the Fifth Amendment protects you against self-incriminating testimony, but it is not an absolute bar against all kinds of self-incrimination. The court can still compel you to provide non-testimonial aid in their prosecution of you. For instance, the court can get a blood test to show that you were drunk while driving, or swab your cheek to test for DNA, get an example of your voice to play to witnesses, to have you participate in a line up, provide a sample of your handwriting, a sample of your hair, putting on a costume that the suspect was wearing, etc. If this were not the case you'd never be able to convict anyone of any crime.

    The defendant in this case was read his Miranda rights. He said that the computers were encrypted, and that he could decrypt the files but would not do so. That doomed him. The court said that decrypting the hard drive was not testimonial in nature. If he had shut the fuck up and said nothing, then the court would probably would have denied the prosecutor's motion because decrypting the drive would be an admission that he knew and owned the contents of the drive. But this fuckhead had already bragged to cops that he could decrypt the data but wasn't going to do so. Thus, there was no self-incrimination.

    --
    A NYC lawyer blogs. http://www.chuangblog.com/
  36. Plausible deniability by PeeAitchPee · · Score: 1

    This case illustrates why it's so important to have something like the recently-shut down TrueCrypt project out there. If prosecutors can't prove the existence of an encrypted volume, they can't keep you in jail for not giving up the keys for something which might not exist.

    1. Re:Plausible deniability by Lumpy · · Score: 1

      Tell that to the residents of Gitmo... They can imprison you FOREVER without being charged or tried in a court of law.

      The PATRIOT act got rid of a lot of your rights in that respect.

      --
      Do not look at laser with remaining good eye.
    2. Re:Plausible deniability by Anonymous Coward · · Score: 0

      This case illustrates why it's so important to have something like the recently-shut down TrueCrypt project out there. If prosecutors can't prove the existence of an encrypted volume, they can't keep you in jail for not giving up the keys for something which might not exist.

      Yeah, right. If there's any external corroborating evidence that you have files with relevant evidence in them (and there often is or prosecutors wouldn't be after you in the first place), the fact itself that you're using TrueCrypt strongly suggests that you have hidden volumes (after all, nitwits keep suggesting it for hiding evidence) and you will be compelled to produce the keys for them or rot in jail for contempt of court.

      tl;dr "Correlation doesn't imply causation, but it does waggle its eyebrows suggestively and gesture furtively while mouthing 'look over there'."

    3. Re:Plausible deniability by KevReedUK · · Score: 1

      If prosecutors can't prove the existence of an encrypted volume, they can't keep you in jail for not giving up the keys for something which might not exist.

      Except that in this case, the prosecutors can (and did) use the testimony already given to prove (he was, after all, daft enough to admit it!) that encrypted data did exist, that it contained the files that they were looking to find, and that he could cooperate in their retrieval of the files but was unprepared to do so.

      --
      Just my $0.03 (At current exchange rates, my £0.02 is worth more than your $0.02)
    4. Re:Plausible deniability by amxcoder · · Score: 1
      This case illustrates a couple things for sure:

      1. It is important to have Encryption software (like TrueCrypt) available to people, as that is the only way in this day and age, that will actually allow ones papers and effects to be personal. This example shows how lawyers and judges will parse words to make up what ever they want, even when the constitution is clear. Case law has watered down so much of the constitution that it doesn't even resemble the original document anymore.

      2. Before handing over the key, like this guy is being forced to do, it is important for the person to balance what the punishment will be if he DOES turn it over (and give them evidence to convict him), to what the punishment will be if he decides to NOT COMPLY with the order. In some cases, it may be better to turn it over, as the crime punishment won't be so bad, in other cases, it would be better to not release the key, even if they held you in jail for years. Depending on what evidence you had on the drive, and what crime your being prosecuted for.

      3. This is another example of at least State law enforcement not being able to crack drive encryption software, which means "it does work" to a point. Granted, they aren't the NSA or military trying to get at these files, but there is encryption software available that provides enough protection to cause this case to come out and others like it. Which begs the question: what software did he use? I would bet money it was TrueCrypt that he was using, but even if not, other cases have involved TC, which could be another argument against what TC's website said when they went under (about it not being secure anymore).

    5. Re:Plausible deniability by david_thornley · · Score: 1

      Hidden volumes may be useful. Of course, if you tell the police that there is a hidden volume, that you know the key to it, and that it has the incriminating stuff, you've pretty much blown all the usefulness.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  37. Re:Face it ... by gstoddart · · Score: 1

    Tell me this again in 10-15 years.

    Because the way we're going, I have little faith any of this will be true by then. Governments are increasingly deciding the law means whatever they decide it means.

    Would I love to be wrong? Absolutely.

    --
    Lost at C:>. Found at C.
  38. The dog ate my homework. by westlake · · Score: 1

    I mean, all you have to say is that you lost the actual key and cannot comply.

    Didn't work for Calvin. It won't work for you.

    The lie ends in a citation for contempt and a stay in a Ricker's Island holding cell until your memory improves, or hell freezes over, whichever comes first.

    1. Re:The dog ate my homework. by i+kan+reed · · Score: 1

      that is unconstitutional. Sorry. They can add charges for perjury if they can demonstrate you lied, but extrajudicial punishment is still unconstitutional.

    2. Re:The dog ate my homework. by Anonymous Coward · · Score: 0

      That's a cute notion, and you won't get any argument from me that it was the intention of our founders to make that the case, but the fact of the matter is that judges can hold you for contempt as long as they feel is necessary. I recall a case of a man held in contempt, without charge, for 14 years, because he refused to tell a judge where he had hidden some money -- he was only set free because the judge got tired of the whole thing.

    3. Re:The dog ate my homework. by david_thornley · · Score: 1

      It might work. Calvin's problem was that he claimed to the police that he could decrypt the stuff. Don't say anything like that, and have some actual time passed between the last time you entered the key and now, and the judge may think it likely enough that you won't be jailed for contempt. In any case, if knowing the key vs. not knowing it would tend to incriminate you, you can just refuse to answer.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  39. No Question the Drive is His, No 5th Amend. Issue by jratcliffe · · Score: 1

    The Supreme Court has ruled that you can't be compelled to provide a password, if the fact that you have the password is, in and of itself, incriminating. So, if there's a hard drive that the police have reason to believe contains child porn (just as an example), and you haven't acknowledged that the drive is yours, then the police can't compel you to provide the password, since to do so would be to admit that the drive is yours (or at least provide strong evidence that it is). If there's no question that the drive is yours, however (particularly if you've admitted that it's yours), then providing the password doesn't in and of itself incriminate you.

  40. Re:Face it ... by Bryan+Ischo · · Score: 1

    Well then I have good news for you! You're wrong. Absolutely.

  41. Let's face it there's no more law by gelfling · · Score: 1

    Come on, there's no more rule of law or Bill of Rights in the US. Get over it, it's gone. And remember to worship and hail Lord Bama.

    1. Re:Let's face it there's no more law by Anonymous Coward · · Score: 0

      Dear Simpleton,

      This was a decision by a Massachusetts court.

      Let's talk after this has worked it's way up the appeals chain.

  42. Tsk. Bad Happy Fun Court. by Anonymous Coward · · Score: 0

    From the ruling:

    "Can the defendant be compelled pursuant to the Commonwealth's proposed protocol to provide his key to
    seized encrypted digital evidence despite the rights and protections provided by the Fifth Amendment to
    the United States Constitution and Article Twelve of the Massachusetts Declaration of Rights?

    and,

    "We transferred the case to this court on our own motion. [FN3] We now conclude that the answer
    to the reported question is, "Yes, where the defendant's compelled decryption would not
    communicate facts of a testimonial nature to the Commonwealth beyond what the defendant
    already had admitted to investigators." Accordingly, we reverse the judge's denial of the
    Commonwealth's motion to compel decryption. [FN

    In which case the decrypted evidence would be redundant, unnecessary, and even irrelevant, hardly justifying compulsion, even in the Reich, er... the Commonwealth.

    Operation Chokepoint strikes again??? Sure this was a scam, but unless the guy was blowing the money on hookers, cocaine, or the ponies, and couldn't pay up when it came time, it amounts to a harmless form of arbitrage, paling by comparison to what goes on in Congress and on Wall Street every day.

  43. Re:Face it ... by pla · · Score: 1

    the Fifth Amendment protects you against self-incriminating testimony, but it is not an absolute bar against all kinds of self-incrimination.

    Sure... And we didn't torture people at Gitmo - Al "Torquemada" Gonzalez made sure to redefine the term to make everything perfectly kosher.

    When the government can just redefine pesky terms to mean whatever the hell it wants, yeah, the GP has it correct - We have no rights, except the right to do our best to stay under the radar and pray we never piss off the wrong person in power.

  44. DEAR COURTS..... by Lumpy · · Score: 1

    Be sure they give you the password to that secret hidden encrypted volume called /dev/random. I am sure they are hiding a lot of evidence in there, in fact trying to copy it off the system it has consumed 4 6tb hard drives so car with no end of stopping...

    --
    Do not look at laser with remaining good eye.
    1. Re:DEAR COURTS..... by garyebickford · · Score: 1

      Well in fact that volume does contain all the information ever recorded. So if they look long and hard enough, they _could_ find what they're looking for. But they might first find the dual of that information, that disproves the allegations. It's a matter of luck. Also, the Sun might burn out first making the case moot.

      --
      It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
  45. Same lie, two people, different outcome by Anonymous Coward · · Score: 5, Interesting

    Judge thinks you are lying. You're a geek, who presumably knows how to secure information on a computer. You saying "I lost the data" is equivalent to saying "My whole life is a lie and I don't actually know how to do any of the things I always talk about." Bullshit. You didn't lose the data. Your RAID6 didn't have a three-drive failure, and your backups weren't untested.

    Same judge can think Lerner is telling truth. Lerner is an administrator, and she uses an iPhone and thinks the "e" on her desktop is the Internet, Her saying "I lost the data" is equivalent to her saying "I think the car's oil might be low, but I haven't looked. but the problem really could be oil, because I read a story in Readers Digest about a couple who saw some smoke coming out their hood, and when they finally got to town for someone to check it out, it turned out they were low on oil!" Her act is consistently dumb enough that no dumbness could be out of character.

    When Lerner is asked the airspeed of an unladen swallow, she smiles helplessly, shrugs, and says "I don't know. What did you swallow?" When you're asked, you smugly immediately instinctively counter with "African or European?" and when the judge says "European," your eyes suddenly dart around and you say, unconvincingly, "Uh... I don't know anything about swallows."

    1. Re:Same lie, two people, different outcome by TheCarp · · Score: 4, Insightful

      > You saying "I lost the data" is equivalent to saying "My whole life is a lie and I don't actually know how to do any
      > of the things I always talk about." Bullshit. You didn't lose the data.

      Funny you would say that because.... you know I have a bunch of encrypted partitions, some of which I actually can't open. Some of it is encrypted with keys that I deleted because they were not needed. For example I have one particular one I can't open, because I never saved the key....it was only a temporary place to pull some data off encrypted tape to search for something.... after I no longer needed it, I just unmounted it. At the time I meant to go back and look for more, I never did, then I forgot the key....big deal....I have the tape still.

      Course, I could never prove to anyone else that the data in there is the same as is on the tape....but.... frankly, that wasn't one of my concerns when i created it....I just didn't want to write it all to unencrypted disk and leave it sitting there.

      I also have a few emails encrypted to my pgp key from the 90s. I can't seem top decrypt my key even though I thought i remembered the password. I only keep it around because someday I might guess right and there would be some minor use to having it.

      Guess my whole life is a lie because I lost some data. I better go resign my day job right now!

      --
      "I opened my eyes, and everything went dark again"
    2. Re:Same lie, two people, different outcome by Aaden42 · · Score: 1

      I confess. My backups are untested. You got me. Put the cuffs on!

    3. Re:Same lie, two people, different outcome by 517714 · · Score: 1

      You said the data is on the tape, therefore it isn't lost . You said you deleted the unneeded data, therefore you didn't lose it, you disposed of it. I see nothing accidental in your actions - or those of the IRS. The part about your whole life may be true nonetheless.

      --
      The US government have made it clear that we have no inalienable rights; any we do not defend vigorously will be taken.
    4. Re:Same lie, two people, different outcome by TheCarp · · Score: 2

      > You said you deleted the unneeded data, therefore you didn't lose it, you disposed of it.

      Yes, however the point remains that it means I have encrypted data that I can't decrypt; for really no nefarious reason and no lie. Its there, its encrypted, there does exist a key that could turn it back into the data that was.... but I could neither decrypt it nor prove it matches that other data that I can decrypt. Best anyone, even a forensic investigator could do is take my word for it.

      Really in the end, the only point here is that the stink test proposed doesn't work....a professional familiar with encryption is actually quite likely to have data he can't decrypt for one reason or another.

      Hell, to be honest, I do occasionally wonder that it might be a liability. Then I think.... fuck em, maybe I should just make some full partitions of just random data for kicks.

      --
      "I opened my eyes, and everything went dark again"
    5. Re:Same lie, two people, different outcome by Anonymous Coward · · Score: 0

      Judge thinks you are lying.

      Thinking isn't sufficient. To put someone in prison, you should need to show beyond reasonable doubt that they're lying.

    6. Re:Same lie, two people, different outcome by Anonymous Coward · · Score: 0

      Yea- I have encrypted partitions on flash media and CDs and/or read-only flash media that while thoroughly utilized and worn I no longer can recall the passwords for. This is because of the amount of time that has passed since I last accessed them and the length and complications of the passwords. There is NO data retained when I boot from the media which would update a time stamp indicating its last use. This was by design. If somebody knows there is evidence on the drive that doesn't mean I can still decrypt it. Even if I could decrypt it 6 months ago by the time you want me to decrypt it there is a high probability I wouldn't be able to.

    7. Re:Same lie, two people, different outcome by symbolic · · Score: 1

      This is absolutely a plausible scenario. Just because someone has an encrypted partition (or two, or three, etc), does not, without exception, mean that these partitions are accessible. A forgotten key is not beyond the scope of reasonableness.

    8. Re: Same lie, two people, different outcome by Anonymous Coward · · Score: 0

      What Judge?
      The inquisitors a congressman looking for sound bytes.
      If it was a search for the truth the I.T. Would be there to explain what actually happened.
      Not some head Burtacrat.
      This is Slashdot who would you ask about what crashed and why. The President of your company or you?

    9. Re:Same lie, two people, different outcome by TheCarp · · Score: 1

      OTOH I would say there are some limits. Its one thing to say "oh shit that laptop with the layer of dust on it? No I forget, its been years".... but "Oh the laptop I use every day AND my desktop, yes I forgot those"

      And certainly a whole nother ball game when you say "I encrypted all the evidence of my crime here" ROTFL "no I forget the key"....good luck with that.

      --
      "I opened my eyes, and everything went dark again"
  46. Re:Face it ... by gstoddart · · Score: 1

    Well, we shall see I guess. There's still plenty of time.

    --
    Lost at C:>. Found at C.
  47. remain silent by Anonymous Coward · · Score: 0

    Sorry, remaining silent (by not decrypting the drives) is an act of self-incrimination? You might as well throw out the 5th amendment then.

  48. Re:No Question the Drive is His, No 5th Amend. Iss by Smidge204 · · Score: 1

    Even if the hard drive isn't yours, or it hasn't been established that it's yours, if they know you have the password for whatever reason they can compel you to give it up. Failure to do so would at least be obstruction, or perhaps as bad as aiding and abetting.

    Provided they also have probable cause to think there's evidence on that device of course.
    =Smidge=

  49. Unforunate developments by dnaumov · · Score: 1

    I haven't even looked, but I bet the comments are full of posts saying something along the lines of "What if I forgot the password?" Unfortunately, this cop-out won't work or if it will, it won't for long. In many countries, the courts have already taken a stance that in such a scenario, it's at the court's discretion whether to actually believe your claim of forgetfulness or not. There is no reason to believe the exact same thing won't happen in the US.

  50. The password should incriminate on another crime by whitedsepdivine · · Score: 1

    If a password self incriminates yourself on another crime it throws a new twist into the whole mix.

  51. Re:WTF? How is this not self incrimination? by blueg3 · · Score: 1

    In two ways. First, being compelled to provide evidence that already exists isn't protected under the 5th Amendment, only giving testimony. (There are lots of details here, but that's the short version.) Second, once you volunteer information, you waive your 5th Amendment protections for that line of inquiry. (Again, details.) He told the police that the encrypted drive contained evidence and that he had the ability to decrypt it. Not a good move.

  52. Re:Face it ... by Totenglocke · · Score: 1

    Clearly, you've never dealt with our joke of a "justice" system.

    --
    "The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants." ~Thomas Jefferson
  53. Re:Face it ... by Anonymous Coward · · Score: 0

    Uh.....it began a while ago

  54. The nature of testimony by Anonymous Coward · · Score: 0

    If you read the dissenting opinions, the dissenting judges make the distinction between the two different testimonial acts. By decrypting the drives, the defendant is testifying that:

    1.) He has some control over the drives
    2.) He has the information required to make them readable and
    3.) The documents on the drives are authentic

    So if he hadn't already admitted to the above, it would not be a foregone conclusion and he could not be compelled to decrypt the drives. However, he had, so fine, fair enough.

    However, the government has not (in the opinion of the other judges, and me, but IANA{L|J}) identified the evidence they are seeking on the drives specifically enough. If the government knew that there were (say) financial records in your safe they could subpoena the documents and compel you to open the safe if you admitted to knowing the combination, but if they had no clue what was in the safe but suspected it was probably important, they should not be able to force you to open in as part of their evidence fishing expedition regardless of whether or not you admitted that it belonged to do.

    Another important point is that the Commonwealth has not, in some of the judges opinion, put into place the legally required safeguards to ensure that details of lawyer-client communications that are probably on some of these devices are inviolate as required under law.

  55. 5th amendment? by Anonymous Coward · · Score: 0

    I'm no lawyer, but...

  56. You talk, it's your fault by MikeRT · · Score: 2

    but bullshit as in, contrary to a reasonable reading of the Constitution by a citizen of normal intelligence.

    And how so? He waved his ability to execute their search in their faces and then suddenly is surprised when his failure to STFU per the 5th was held against him.

    If an ordinary person believes they can give a cop legally valuable information about a case against them and not expect to have that used against them, their intelligence doesn't even rise to the level of pop culture references (you have the right to remain silent, anything you say...)

    And let's be clear here. This was a lawyer, not an ordinary person. Odds are higher an ordinary person would have been smart enough to just shut up whereas this guy probably thought he'd use some fancy legal maneuvering he learned along the way to win on a technical point.

    1. Re:You talk, it's your fault by DoofusOfDeath · · Score: 1

      And how so?

      As I understand it, and I could be wrong, the courts' stance seems to be that once a person says something to the cops, he cannot plead the 5th regarding anything else on the topic. I.e., once they have a toe in the door, you're no longer protected by the Bill of Rights.

      It's that all-or-nothing doctrine that strikes me as absurd. I think a much more reasonable interpretation would be that the accused can stop talking whenever the hell he wants, and the court and police need to just go screw themselves.

      I have absolutely no patience for watering down the Bill of Rights.

    2. Re:You talk, it's your fault by Anonymous Coward · · Score: 0

      And how so?

      As I understand it, and I could be wrong, the courts' stance seems to be that once a person says something to the cops, he cannot plead the 5th regarding anything else on the topic. I.e., once they have a toe in the door, you're no longer protected by the Bill of Rights.

      It's that all-or-nothing doctrine that strikes me as absurd. I think a much more reasonable interpretation would be that the accused can stop talking whenever the hell he wants, and the court and police need to just go screw themselves.

      You can. There are a lot of nonlawyers trying to give an interpretation on a very nuanced decision based upon a minimal understanding of 100s of years of case law and legislative history stretching back to before the US was a country. I'm not knocking people; just trying to make the point that understanding the constitution requires more than just reading it and deciding what you think it means. A lot of modern layperson "constitutional scholars" hold ideas about what the constitution means that run contrary to how the founders actually acted. I don't see how they can claim to be following the founders intent while condemning the founders acts (e.g. implied powers).

    3. Re:You talk, it's your fault by chihowa · · Score: 1

      ...understanding the constitution requires more than just reading it and deciding what you think it means.

      It really doesn't, though. The validity of our entire government hinges on the support of the governed and the idea that understanding the basis of government (which is a short document in plain English) is beyond the capability of ordinary citizens abuses that validity.

      If a simple and straightforward statement like, "No person... shall be compelled in any criminal case to be a witness against himself..." can be twisted to mean that a person can be compelled to do so, then the changes that history has made to the document are much greater than "nuance".

      --
      If you want a vision of the future, imagine a youtube comments section scrolling - forever.
    4. Re:You talk, it's your fault by anethema · · Score: 1

      Well I mean, if you say you have an encrypted drive, you know the password, and the contents of the drive DO pertain to the case, you aren't incriminating yourself further to provide the key really. You have already plead guilty in a way, they just need the details.

      --


      It's easier to fight for one's principles than to live up to them.
  57. I forgot my password by jsepeta · · Score: 1

    and my 128-bit crypto-key

    --
    Remember kids, if you're not paying for the service, YOU ARE THE PRODUCT THAT IS BEING SOLD.
  58. Re:WTF? How is this not self incrimination? by Defenestrar · · Score: 1

    ... The "self" has been redefined to mean: A collection of molecules that you used to be, but are not now.

    Indeed - you can't cross the same river twice (or exact aggregate quantum spin state).

  59. I need you focused. by westlake · · Score: 1

    It's called deniable encryption, and is intened to stand up to "rubber hose cryptanalyis".

    I don't think even the Wikipedia claims that the geek's "plausible deniability" would protect him from a literal Liam Neeson interrogation.

  60. The best part of the ruling. by Anonymous Coward · · Score: 0

    The best part of this is that a lawyer will be going to prison!!!

  61. Damned if you do. by AnotherBlackHat · · Score: 1

    "We know you did it, so until you confess, we're going to hold you in contempt of court."

    The court is claiming that they really, truly, pinky swear know he did it, because they heard him say so, so that whole "can't force you to testify against yourself" thing doesn't apply.

    I don't believe the spirit of the 5th is that it doesn't apply when we know you're guilty.

  62. Re:Face it ... by Anonymous Coward · · Score: 0

    I tend to agree. But I guess I am confused as why just because he let it be known that he has an encrypted drive, and that he had the capability to decrypt, why that necessitates that there is incriminating evidence on the hardrive. I think those things are separate. Unless he said something to the effect of "The evidence you are looking for is here, and you cannot get it because it is encrypted!!! And I don't want to decrypt it. blah blah blah" . But supposing this guy was actually innocent, and his computers were seized, and he said the same thing that I thought he said. He said that "the computers were encrypted, and that he could decrypt the files but would not do so, not because there is evidence on there, but because I respect my own rights to privacy, and my right not not have my things unreasonably seized." I guess I am just confused as how they know there is evidence on that machine, a warrant is typically for when you know what for and where you are looking.

  63. Re:No Question the Drive is His, No 5th Amend. Iss by Anonymous Coward · · Score: 0

    Your brain is unquestionably yours, and the police have reason to believe that it contains incriminating evidence, so you can be held in contempt until you provide testimony to such, right? Right?

  64. Another way... by LoyalOpposition · · Score: 1

    That's why my password is, "I agree to indemnify Loyal Opposition and hold him blameless."

    ~Loyal

    --
    I aim to misbehave.
  65. Re:Face it ... by Anonymous Coward · · Score: 0

    Wow a three digit ID and yet so naive. The rights have been eroding for years, they will continue to do so.

  66. not legally. by bussdriver · · Score: 1

    The constitution is supreme. No law can over-ride the amendments to the constitution. It takes an amendment to do that. The Patriot act is unconstitutional lawyer games which nobody in their right mind would allow (except a lawyer and their definition games where things like the supreme court ruling tomatoes are vegetables by their own unscientific definition.)

    1. Re:not legally. by Lumpy · · Score: 1

      You are 100% incorrect.

      All it takes to override the constitution is guns. And they have all the guns.

      --
      Do not look at laser with remaining good eye.
  67. Doh by Anonymous Coward · · Score: 0

    First, a lawyer should be smart enough to maintain plausible deniability. Not remembering the password, or claiming he had no idea how it got encrypted, would be a better option than simply saying no.

    A judges are sinners, and their sin is pride. if you hurt their pride, they respond accordingly, and that can be good or bad depending on the specifics.

    Providing any password in effect provides the means for investigators to use the information against him. In effect he would be testifying against oneself,

    I would never provide it.

  68. Go with plausible deniability instead by hodet · · Score: 1

    Create a hidden OS then decrypt your decoy.

  69. Re:WTF? How is this not self incrimination? by istartedi · · Score: 1

    No sale.

    ...nor shall be compelled in any criminal case to be a witness against himself...,

    That's just the relevant part of the 5th. No part of it makes any distinction between "providing evidence" or "trestifying". The way I see it, these are just two of several ways in which you could "be a witness". No doubt the court created this distinction for some purpose, and is building one mockery of our rights on top of a precedent set by another mockery. It's mockery all the way down... until you get to the turtles.

    --
    For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
  70. No - The Fifth by Anonymous Coward · · Score: 0

    As I understand it, the logic goes like this - you cannot selectively use the fifth to hide some parts of testimony once you have stated others.
    "I didn't shoot him, Freddy shot him. I saw him."
    Where were you standing?"
    "I plead the fifth."
    "Where did Freddy get the gun?"
    "I plead the fifth". ...and so on.

    Because once the court has heard the one detail (testimony or statement), they are entitled to the whole truth. You cannot selectively reveal some details and not others.

    The essence of this case appears to be that the defendant told the police that the evidence was on the encrypted drive and he knew how to unlock it. Having gone that far, he is now obliged, when served with a subpoena, to provide all relevant documentation that he has hidden. Sucks to be him. If the only way to comply with the subpoena is to provide his password, well, doubly sucks to be him.

    1. Re:No - The Fifth by chihowa · · Score: 1

      they are entitled to the whole truth.

      On what basis are they entitled to this?

      --
      If you want a vision of the future, imagine a youtube comments section scrolling - forever.
  71. Giving up computer password by Anonymous Coward · · Score: 0

    Simply tell the judge that you are not computer literate, however, you will try to open the hard drive with your password, which is FORMAT DRIVE.

  72. Simple Solution by gregulator · · Score: 1

    Here is a simple solution.

    Make your passphrase an admission of guilt to some crime.

    "IStoleACandyBar" would be a self-incriminating statement, and thus protected by the 5th. (If you did actually steal a candy bar.)

    1. Re:Simple Solution by PPH · · Score: 1

      "TheJudgeWasInOnIt"

      --
      Have gnu, will travel.
  73. Re:WTF? How is this not self incrimination? by blueg3 · · Score: 1

    No part of it makes any distinction between "providing evidence" or "trestifying".

    The word "witness" does. A witness is someone who provides testimony in a legal proceeding. It is not someone who provides non-testimonial evidence relevant to a legal matter.

    The way I see it...

    ...is not the way the law works. Testimony is separate from other kinds of evidence, and the 5th Amendment covers testimony. (The 4th Amendment provides different protections to other kinds of evidence.)

    Despite how frequently it occurs, it turns out that your home-grown, intentionally-overbroad, untrained interpretation of the Constitution is not, in fact, a good basis for reasoning about the law.

  74. NO by Anonymous Coward · · Score: 0

    If the information is already known, then they don't need it decrypted.

    This is nothing more than a fishing expedition for more information, and they want to use that information against him, and others. But by law he cannot be forced to testify against himself or his family. So this is another attempt of the fascist police state attempting to exceed their authority.

    He should exercise his right to remain silent, because anything he says can and will be used against him.

    I would never give it up.

  75. Re:No Question the Drive is His, No 5th Amend. Iss by nabsltd · · Score: 1

    Even if the hard drive isn't yours, or it hasn't been established that it's yours, if they know you have the password for whatever reason they can compel you to give it up. Failure to do so would at least be obstruction, or perhaps as bad as aiding and abetting.

    Catch-22, then, as if you invoke your right against self-incrimination, they know that the drive has something about a crime you committed, while if you merely refuse to provide the key, you are arrested for obstruction, regardless of whether or not you actually have the key.

  76. Re: known data isn't there by TaoPhoenix · · Score: 4, Interesting

    All this is making me start to think of some kind of more clever "panic mode" encryption.

    You'd have to make it really fast, such that it's reg proto-encrypted two ways, one normal, and the panic mode. So say something really fast like shift-control-alt-F11 instantly flips the "panic bit".

    We as geeks could put all kinds of awesome stuff into it, smashed into a kind of digital Klein Bottle with milk for Schrodinger's cat.

    "Do you know how to decrypt it?"
    "No"
    "Why not?"
    "Because it's time-locked with a code that cannot be found until next September."
    "Do you know what documents are on there?"
    "The ones you are looking for are not there because they were broken into component parts that only the computer knows, tied to a code that September code. Meanwhile other documents you did not know were there, are there, because they were created by algorithms the moment I hit the Panic Button and not a moment before. And the base of the September key is an English phrase which may or may not admit a crime. You don't know."
    "So what if the case is dismissed?"
    "I can do other work until September. What's important is that it cannot be broken right now."

    --
    My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
  77. Old way 5th Amendment; New Way I do not recall by EnOne · · Score: 1

    Remember the Oliver North trial where he kept on saying "Upon the advice of counsel I am pleading the Fifth" - that was the 80's way to not incriminate worrisome because if you are pleading the Fifth there is something you can be incriminate for. Now you just follow Alberto Gonzales (US Attorney General) stating "I do not recall" that way you don't have to worry about 5th amendment protection, you just have a bad memory.

    --
    Calvin:Do you believe in the devil? Hobbes:I'm not sure man needs the help.
  78. can he be convicted if he decrypts the hard drive? by Anonymous Coward · · Score: 0

    If the answer is yes, then it violates the fifth. If he can be convicted without it, then why do they need it?

  79. particularity is orthogonal to standard of proof by raymorris · · Score: 1

    Your post talks about two very different concepts in a way that might be unclear. Someone might get the idea that the particularity of the evidence sought has something to do with the burden of proof. It doesn't, of course. Those are two different concepts.

    The police need to show that they have evidence that a particular thing will be found on the hard drive. As an example, "we're looking for the email that Ms. Lerner sent to Mr. Smith on March 3rd" satisfies that condition. That condition would not be satisfied by "we want to look to see if there is anything illegal in there".

    Separately, there is also the question of standard of proof. In most cases, probable cause is the standard for a warrant - the thing sought is PROBABLY in the location to be searched.

  80. New password strategy by Lab+Rat+Jason · · Score: 1

    Randomly pick a device in your house, and use the mac address, serial number, or part number (if it is sufficiently long) as your password. Then you don't have to memorize anything, and you can honestly claim that you do not know the password...

    --
    Which has more power: the hammer, or the anvil?
  81. Re: known data isn't there by dnavid · · Score: 3, Insightful

    All this is making me start to think of some kind of more clever "panic mode" encryption.

    You'd have to make it really fast, such that it's reg proto-encrypted two ways, one normal, and the panic mode. So say something really fast like shift-control-alt-F11 instantly flips the "panic bit".

    We as geeks could put all kinds of awesome stuff into it, smashed into a kind of digital Klein Bottle with milk for Schrodinger's cat.

    "Do you know how to decrypt it?" "No" "Why not?" "Because it's time-locked with a code that cannot be found until next September." "Do you know what documents are on there?" "The ones you are looking for are not there because they were broken into component parts that only the computer knows, tied to a code that September code. Meanwhile other documents you did not know were there, are there, because they were created by algorithms the moment I hit the Panic Button and not a moment before. And the base of the September key is an English phrase which may or may not admit a crime. You don't know." "So what if the case is dismissed?" "I can do other work until September. What's important is that it cannot be broken right now."

    In my opinion, that likely wouldn't work. Contrary to what you might see on TV or in movies, courts are not generally impressed by technicalities or deliberately unproductive cleverness. Consider the recent Supreme Court ruling against Aereo. The Court was entirely unmoved by the technical argument that the way Aereo implements their service is "basically like" individuals using antennas. They ruled that *overall* Aereo was obviously acting as a rebroadcaster, by taking in broadcast signals and sending them live to a large number of customers and charging for that. The notion that they don't charge for the broadcast, just the rent for the antenna was similarly unconvincing to the Court. Courts tend to look at net results, and less the technical path to achieve it. In this case, a court would rule that a) you've just admitted the system contains information related to the government investigation, b) you created the system being used to obfuscate and hide that information, and c) even though you've made it difficult or impossible to produce that information at this time, you can be compelled to do so at the earliest possible moment the system physically allows, and d) the fact that you appear to have deliberately done all of this in a deliberate attempt to thwart law enforcement with full knowledge of the legal consequences can subject you to an obstruction of justice charge.

    Most judges and most courts do not consider the law to be a game that people can attempt to create exploits for. Exploiting loopholes in the law is one thing: doing so with an obvious willful intent to subvert the court tends to be looked upon extremely unfavorably. Judges have significant latitude to deal with people they think are trying to do that.

  82. Re:not taking the stand by Anonymous Coward · · Score: 0

    My recent experience in regard to the defendant not taking the stand is that there was no toeing of any lines. The prosecutor in the case made no hint of any sort as to possible reasons for the defendant's decision not to do so. No sly references, nothing.

  83. Re: Have 2 keys with different uses by amxcoder · · Score: 1

    This kind of thing is where having 2 different keys for an encrypted volume would be good, like a key for personal usage, and another key for usage when under duress.

    The normal key would unencrypt the volume for you to use as normal, and the "duress" key would cause the volume to automatically do a secure data wipe of the volume file. So if you're being forced to hand over the key, whether by force (like torture), or under threat of jail time, you can meet the courts qualifications of surrendering your "passphrase", and when they use it, they destroy the volume that they were forcing you let them have access to.

    There even may be arguments to make as to how well this would satisfy some requirements: first, your complying, so your not in contempt of court. Second, the key was a legit key that was for "use" with that particular encrypted volume, so you didn't lie. Third: You didn't destroy the evidence, as I'm sure you're not the one who types the key in when you turn it over... some computer forensic IT guy is the one who actually typed the passphrase that deleted the volume, so you didn't physically do it and can't be prosecuted for destruction of evidence.

    If you took this a step further, you could even do this how they do in CIA movies with challenge/response pairs after you give a legitmate key for decryption. In other words, you give them your REAL key, but then before the volume can be decrypted with the key, a set of challenge/response words are given, that have to match, with each challenge word having a normal response and a duress response. If any of the challenges are answered with the duress response, then the volume "self destructs". This would possibly be safer to keep you out of trouble, as you would be handing over your actual decryption key phrase, you would just give them a duress response word for one of the challenges. This would be harder to implement, and wouldn't be any more useful than 2 keys for different purposes, except that it might help you from getting in more trouble in court cases like this by following the technicalities of a court ordered demand.

  84. Re:WTF? How is this not self incrimination? by istartedi · · Score: 1

    Still no sale. See various definitions of "witness" which are not bound to a single, narrow definition of "testimony on the stand".

    "The way I see it" is exactly how law works. If enough people see it a particular way, you get new laws. If the person who sees it a particular way is a judge, his ruling is law... until another judge sees it a different way, all the way up to the Justices, who may then be over-ruled by the other branches and/or The People seeing it a different way. Of course the seeing is only part of it. The acting is all important...

    --
    For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
  85. Don't talk to cops... by krups+gusto · · Score: 0

    http://www.youtube.com/watch?v=6wXkI4t7nuc

  86. Re:WTF? How is this not self incrimination? by Svartalf · · Score: 1

    Heh... Actually, that line of bullshit might be at risk with the recent unanimous decision that law enforcement needed a warrant for mucking about on a defendent's phone. Basically, this is the same thing and it's expected to be overturned by the SCOTUS if it gets before them.

    --
    I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
  87. After reading over other posts... by istartedi · · Score: 1

    After reading over other posts, I can sort of see how this ruling doesn't necessarily erode rights, although I still think it stinks.

    If he had been a *good* lawyer and said nothing, then the drive would have had a legal status of "random bits, presumed innocent" and they would have no basis to force his hand.

    What he did was indicate there was some kind of evidence on the drive. Big Ooopsie because either the drive has nothing pertinent to the case and he is deceiving the court, or he is telling the truth and the drive contains something pertinent to the case which may incriminate him.

    So. Maybe no real rights violation at all. Just a stupid lawyer?

    --
    For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
    1. Re:After reading over other posts... by blueg3 · · Score: 1

      The mistake of saying that it contains evidence and that he has the capacity to unlock it is a huge mistake. In general (IANAL), in order to compel you to do something like unlock a safe, the prosecution needs to have a reasonable belief that the safe contains evidence relevant to the case, that you know how to unlock the safe, and that the safe (and/or evidence?) are yours.

      He admitted all three of these. If he hadn't, then at the very least they'd have to work much harder to prove to a judge that all three were true before trying to compel him to decrypt the drive. The latter two are probably easy -- if the drive is in his physical possession and attached to his computer, then it's reasonable to assume (though not always true) that it is both his and that he has the means to access it. But they'd need something more than a hope or a guess that it actually contained evidence to compel decryption.

  88. Re:WTF? How is this not self incrimination? by Svartalf · · Score: 1

    If so, it's not hard to have them get a warrant that specifies this, not a court order to relinquish the password. They're distinctly differing notions- and the Judges there overstepped their authority. If it's legit, they could've issued a warrant for specific information and as a part thereof, compelled the unlock of the secured device for that specific information. Since they didn't...doesn't meet the sniff test in light of current precedent.

    --
    I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
  89. My Password by Anonymous Coward · · Score: 0

    That's why I always set my password to "fuck you pigs, you are not getting my password".

  90. Re:No Question the Drive is His, No 5th Amend. Iss by KevReedUK · · Score: 1

    My understanding of the fifth (although, IANAL) is that whilst invoking it may cause prosecutors/LEOs to suspect, maybe even believe, that the drive contains evidence that you have committed a crime, the constitutional interpretation is that this suspicion/belief does not constitute evidence/proof and, as such, should not sway, or be used to sway, the decision making process of the court/jury.

    --
    Just my $0.03 (At current exchange rates, my £0.02 is worth more than your $0.02)
  91. Re:not taking the stand by Defenestrar · · Score: 1

    I'm glad to hear it.

  92. Re: known data isn't there by Jane+Q.+Public · · Score: 1

    In this case, a court would rule that a) you've just admitted the system contains information related to the government investigation, b) you created the system being used to obfuscate and hide that information, and c) even though you've made it difficult or impossible to produce that information at this time, you can be compelled to do so at the earliest possible moment the system physically allows, and d) the fact that you appear to have deliberately done all of this in a deliberate attempt to thwart law enforcement with full knowledge of the legal consequences can subject you to an obstruction of justice charge.

    a) no b) no c) no d) no

    [a] False because there could be many reasons for your actions, among them political. Encrypting or hiding information is not by itself evidence of wrongdoing. It CAN be, under particular circumstances, when certain other evidence is present. But by itself? No. And even if it DID contain such evidence, if it incriminated you, you could still not be compelled to disclose because of the 5th Amendment. The whole point of this thread.

    [b] False because there is no law preventing you from encrypting anything you damned well please. 1st & 4th Amendments.

    [c] False if by doing so, you could incriminate yourself (again, the whole point of this entire thread).

    [d] False because it would not be possible to show this without having already convicted you on some other charge. It isn't "obstruction of justice" to do something unless it involves an actual crime. You aren't "obstructing justice" unless there is some kind of actual justice that you are actually obstructing.

  93. why admit you can decrypt the files? by Karmashock · · Score: 1

    The courts are inherently biased against defendants and have been for many years contrary to their protestations.

    This is why it is always a mistake to talk to the police. There is no upside.

    If they hear something from you that helps you then it is deemed "hearsay" by the courts but if they hear something damaging then its admissible evidence.

    There is no upside to talking to the police. Ever. Likewise, you do not surrender information to the judge that you don't have to surrender. Including whether or not you can decrypt the files.

    Just plead the fifth every time they ask you any question what so ever.

    Which sounds like an abuse of the fifth, but the reality is that the court system is screwed up and the fifth is actually just protecting you from it.

    --
    I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
  94. Re: Have 2 keys with different uses by muridae · · Score: 1

    This kind of thing is where having 2 different keys for an encrypted volume would be good, like a key for personal usage, and another key for usage when under duress.

    The normal key would unencrypt the volume for you to use as normal, and the "duress" key would cause the volume to automatically do a secure data wipe of the volume file.

    What ever you do, if you think you are under legal duress, DO NOT DO THIS!

    The first thing even the local cops are trained to do is to make an image of a volume. They do this for two reasons. The first is the legal: don't destroy evidence that the defense may call into question, and keep a chain of custody. The second is because people have tried exactly what you suggest. If you gave them a password that destroyed evidence, then even if they still had the original drive you have "attempted to destroy evidence" and interfered with the investigation, and probably a few other things that will add to your sentence and provided the evidence of the crime just by doing it in front of the police!

    The TrueCrypt 'two encrypted areas in a single visible area' is fine if the police can not prove, through digging through windows, that you regularly keep two encrypted drives mounted (say X and Y). If you always mount both as drive X: and don't have other OS signs that it is used for multiple objects (drive UUIDs are unfortunately telling) then you are safer. But if you normally keep X and Y mounted, they'll want proof of what Y is; saying it's a USB stick, letting them plug it in and seeing it automount to G and not having other ids match would be . . . unpleasant.

  95. Re:particularity is orthogonal to standard of proo by Jane+Q.+Public · · Score: 1

    Your post talks about two very different concepts in a way that might be unclear. Someone might get the idea that the particularity of the evidence sought has something to do with the burden of proof. It doesn't, of course. Those are two different concepts.

    Yes, they are different concepts, and it seems you are the one who is getting them confused.

    Probable cause is sufficient standard of proof for a warrant. This, for example:

    As an example, "we're looking for the email that Ms. Lerner sent to Mr. Smith on March 3rd" satisfies that condition.

    ... might qualify as probable cause.

    However, probable cause is NOT a sufficient standard of evidence for an exception to the 5th Amendment self-incrimination rule. I've written it elsewhere in this thread, but I will repeat it. SCOTUS has ruled that the court must have knowledge, "with reasonable particularity", that the specific evidence IS present before they can compel "a product of the mind" like a password or combination. Only under those circumstances can the suspect be said to not be incriminating himself.

    Neither reasonable suspicion or probable cause approach that standard of evidence. It is much higher.

  96. That's a nice tax bracket you have there... by tlambert · · Score: 3, Funny

    That only applies to people who have no authority that could ever possible impact the judge in question.

    "That's a nice tax bracket you have there... it'd be a shame if it got audited for the last seven years, and every year from here on out, into the foreseeable future"

    1. Re:That's a nice tax bracket you have there... by Black+Dragon · · Score: 1

      That only applies to people who have no authority that could ever possible impact the judge in question.

      "That's a nice tax bracket you have there... it'd be a shame if it got audited for the last seven years, and every year from here on out, into the foreseeable future"

      That would be....really inadvisable to say to a judge.

      --

  97. Re:not taking the stand by Hognoxious · · Score: 1

    You mean you don't think typical jurors are smart enough to form their own opinion of what he's saying?

    It's his job to do the best he can to secure a guilty verdict. It's another guy's job to do the opposite, and yet another's to keep things fair.

    --
    Confucius say, "Find worm in apple - bad. Find half a worm - worse."
  98. Re: Have 2 keys with different uses by Anonymous Coward · · Score: 0

    He said the information was on there.
    Open the "duress" part - no info - get "wasting police time" etc and possibly worse added on.

  99. Don't use whole drive encryption by wiredlogic · · Score: 1

    This is why whole drive encryption is bad. Even creating a "hidden volume" for plausible deniability is going to look suspicious if anyone bothers to ask who so much of the physical HD space is unused by a dummy OS with a curiously small amount of activity recorded in the system logs.

    A safer solution is to randomize new drives with GNU shred (faster PRNG than /dev/*random) and store critical info in smaller encrypted containers that hide amongst the noise. Disable swap or use encrypted swap (with random keys) and disable browser disk caching to eliminate saving sensitive transient data to disk. Use an OS that won't record potentially incriminating info in a registry such as USB device serial numbers.

    At that point it's much easier to deny the presence of encrypted data or, if forced to admit its presence, you can use the "I forgot" or "I can't regenerate the password" excuse which can't be done believably with a computer in regular use that has whole disk encryption.

    --
    I am becoming gerund, destroyer of verbs.
  100. How To Judge? by JimSadler · · Score: 1

    I probaly have at least 12 old drives and probably can't recall the password on most of them. So does the judge hang me even though I'm telling the truth?

  101. Anyone who thinks it does not. by Anonymous Coward · · Score: 0

    Should be pulled from the bench by a mob with torches and pitch forks and hung from near by tree and set on fire chard remains pissed on by mob.

  102. Re: known data isn't there by dnavid · · Score: 1

    In this case, a court would rule that a) you've just admitted the system contains information related to the government investigation, b) you created the system being used to obfuscate and hide that information, and c) even though you've made it difficult or impossible to produce that information at this time, you can be compelled to do so at the earliest possible moment the system physically allows, and d) the fact that you appear to have deliberately done all of this in a deliberate attempt to thwart law enforcement with full knowledge of the legal consequences can subject you to an obstruction of justice charge.

    a) no b) no c) no d) no [a] False because there could be many reasons for your actions, among them political. Encrypting or hiding information is not by itself evidence of wrongdoing. It CAN be, under particular circumstances, when certain other evidence is present. But by itself? No. And even if it DID contain such evidence, if it incriminated you, you could still not be compelled to disclose because of the 5th Amendment. The whole point of this thread. [b] False because there is no law preventing you from encrypting anything you damned well please. 1st & 4th Amendments. [c] False if by doing so, you could incriminate yourself (again, the whole point of this entire thread). [d] False because it would not be possible to show this without having already convicted you on some other charge. It isn't "obstruction of justice" to do something unless it involves an actual crime. You aren't "obstructing justice" unless there is some kind of actual justice that you are actually obstructing.

    I am assuming the above was within the context of the same situation the original article articulated, and was offered as a possible defense for such an individual. The case involves a person who has already admitted to having encrypted information that was well known to contain information relevant to a suspected crime. None of this would be applicable to a general request to decrypt information for no reason at all. The Court decision in this case makes it clear the reason for the ruling is the presumption that the disclosure of a password is not testimonially harmful in nature when its already well known that the person did in fact encrypt the data. The post above seemed to be attempting to manufacture a way to truthfully claim the person has no knowledge of a way to decrypt the data and no direct knowledge of the contents of the encrypted files as a technicality. That technicality would not likely help if he already admitted he encrypted relevant information in the first place. If he made no such admission, then prior precedent would likely prevent the authorities from forcing password disclosure as a violation of Fourth Amendment protections against testimonial self-incrimination.

    Note the court highlighted the distinction that being compelled to surrender information or evidence that can be used against you is not automatically a violation of Fourth Amendment right to avoid self-incrimination: the right only prevents testimonial self-incrimination; i.e. the right not to be compelled to testify as to one's own guilt or innocence of a crime. If you're forced to give fingerprints to the police, and they tie you to a crime scene, that is not testimonial self-incrimination and not a violation of one's rights under the Fourth Amendment.

  103. Incriminating Statement As Part of Password by Kalium70 · · Score: 1

    What happens if the password itself purposefully includes a self-incriminating statement? The defendant cannot give away the password without making a self-incriminating statement. Of course, to make that point, the defendant gives partial knowledge about the password, which would make it more feasible to break.

    1. Re:Incriminating Statement As Part of Password by JoelKatz · · Score: 1

      Nothing special. The prosecution just gives you "production immunity", agreeing not to use the contents of the password itself in court.

  104. Re:WTF? How is this not self incrimination? by garyebickford · · Score: 1

    No, he was an idiot and gave them probable cause.

    --
    It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
  105. They can't force you to do that... by frederico.klein · · Score: 1

    "I seemed to have forgotten the password, I am sorry. " Case closed.

  106. My encryption key.. by Anonymous Coward · · Score: 0

    My encryption key is "I forgot my password, I really did". That way, I can successfully meet the demands of the judge while at the same time giving them something that they won't actually try to use as the key.

  107. Re:Face it ... by Bryan+Ischo · · Score: 1

    Yeah I used to think that when I was 20 too. But I've been around the block a few times and I've heard about the sky falling more than once now. After a while you learn to ignore the hysteria.

  108. I've said it before by Will_Malverson · · Score: 1

    Step 1: Acquire fifty one-dollar bills. If you're feeling especially rich, mix fives and tens in with them.

    Step 2: Put them into a random order.

    Step 3: Generate a password by taking the least significant two digits of each bill, in order, for a 100-digit number. Use this password to encrypt your data.

    Step 4: Make sure that the bills never get out of order. Keep them in your desk drawer or another safe place.

    Step 5: The cops raid your place. There is a decent chance that a small stack of cash would never make it into evidence, simply vanishing into an officer's pocket. Even if that doesn't happen, they'll catalog the money, sort it (here's where the fives and tens come in handy), and almost certainly get it out of order in the process.

    Step 6: Your password is now gone. Unless the cops turned in the cash and kept it in order, it is impossible for you to tell them your password. If the bills make it into evidence, there are up to 50! (~200 bits) possible passwords. If not, there are 10^100 (~300 bits) possible passwords.

    Step 7: Don't actually do steps 1-4. Just keep a small stack of cash next to your computer. Your actual password can be your cat's name. Just be willing to testify under oath that you did steps 1-4.

  109. If they weren't provably his files... by Anonymous Coward · · Score: 0

    Then he might be able to claim knowing the password would incriminate him. But if he had sole access and the computers were proven to be his, any incrimination would be redundant.

    But he already incriminated himself in this particular case by stating that he knew the passwords and could decrypt the drives. Oops.

  110. I lost the password by Anonymous Coward · · Score: 0

    This will certainly be appealed, as there is ambiguity with federal rulings covering other jurisdictions:

    http://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_States_Constitution#Computer_passwords

    "However, in February 2012 the Eleventh Circuit ruled otherwise - finding that requiring a defendant to produce an encrypted drive's password would violate the Constitution, becoming the first federal circuit court to rule on the issue.[69][70] In April 2013, a District Court magistrate judge in Wisconsin refused to compel a suspect to provide the encryption password to his hard drive after FBI agents had unsuccessfully spent months trying to decrypt the data.[71][72]"

  111. Why're you running by Anonymous Coward · · Score: 0

    ... from simple questions troll? http://yro.slashdot.org/commen...

  112. Re: Have 2 keys with different uses by david_thornley · · Score: 1

    Nope.

    The forensics people take a copy of the drive to work on. Working on the actual drive more than just copying it with a write blocker on raises questions about tampering with evidence, and police have learned to be very strict about such procedures (not that all practice it). No duress key is going to work when the LEOs are working on a backed-up copy.

    Even if this weren't the case, the courts would reason that you provided something that wasn't the encryption key, and that you destroyed the evidence since everything afterwards was mechanical and predictable. They would also figure that a guy who knew the duress key almost certainly knew the real key.

    --
    "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  113. STFU by Anonymous Coward · · Score: 0

    Do not ever, ever, ever talk with the police without a lawyer when you are being investigated.

  114. Re:WTF? How is this not self incrimination? by david_thornley · · Score: 1

    "The way you see it" doesn't matter in practice unless the court sees it your way (either initially or because you or your lawyer convinced him or her). In this case, there are long-established court rulings on what the Fifth actually means, and those are the interpretations that actually matter in legal affairs. You are, of course, free to think differently and argue differently and try to convince people that you are correct, but that's not going to help you when you're accused of a crime and the judge rules based on the Fifth.

    --
    "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  115. Re:No Question the Drive is His, No 5th Amend. Iss by david_thornley · · Score: 1

    The Fifth does not have a catch-22. Invoking it may not be considered an admission of guilt. In order to be ordered to provide the key, there needs to be evidence that the file does have relevant evidence in it, and very strong reason to believe that you know the key.

    There are two cases I'm aware of when the courts ruled a key had to be provided. In one, a guy was checking out his kiddy porn and observed by two customs agents. The courts figured that they knew there was child pornography on the disk, and that the guy had unlocked the files so it was clear he had had the key. In the other (this one), the guy told the police where the incriminating evidence was and that he could decrypt it.

    --
    "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  116. double encryption methods by DulcetTone · · Score: 1

    There are ways of encrypting data so that the ciphertext contains more than one message. One password might reveal a given plaintext, while a second one produces another, entirely more innocent and unrelated.

    Obviously, such a ciphertext is larger than one would expect for any resultant plain text, but you could popularize use of encryption that mandates such a larger footprint so that any given user could shrug and say (after giving the password that produces nothing but cookie recipes), "sorry it isn't what you expected, officer!"

    --
    tone
  117. Re:No Question the Drive is His, No 5th Amend. Iss by nabsltd · · Score: 1

    The Fifth does not have a catch-22. Invoking it may not be considered an admission of guilt.

    The case in the GP post (LEOs know you have the key, ask you for it, but don't suspect there is evidence on the drive concerning you) does turn into catch-22.

    Your two choices in that instance are to provide the key or not. Providing the key means that obviously there is nothing on the drive concerning you (unless you are really stupid).

    Not providing the key gets you thrown in jail for obstruction unless you invoke your right to avoid self-incrimination. Thus, if you invoke your 5th amendment rights, LEOs know that there has to be something on the drive concerning you, since it has been upheld that "pleading the 5th" when it doesn't actually apply is illegal. So, when you invoke your rights they can throw you in jail for obstruction (claiming you are lying about the contents of the drive incriminating you). OTOH, if you really do have a valid 5th amendment claim, this means that they have certain proof that something on that drive is evidence of a crime you committed...the trick is proving which crime.

    Which is where the catch-22 comes in...in this case, invoking your rights leads to the inescapable conclusion that there is definitely evidence against you of a crime on that drive. The only real question is whether LEOs having a search warrant for the drive concerning somebody else could then use information on the drive as evidence against you in an unrelated crime. If they can't, then of course you happily turn over the key 100% of the time.

    Basically, this boils down to the 5th amendment only really protecting you when you are the target of the investigation. When you aren't the target, have evidence about the target, and have committed crimes yourself, you end up being SOL unless somebody wants to grant you immunity.

  118. Re: known data isn't there by Jane+Q.+Public · · Score: 1

    I am assuming the above was within the context of the same situation the original article articulated, and was offered as a possible defense for such an individual.

    No. Those are principles of law, at least as it was taught to me by my professors. (But I am not a lawyer.) I will qualify [b], however: if you are doing it for the particular purpose of concealing a crime, there might well be a law against it.

    BUT... I think there was a misunderstanding here.

    *IF*, as in this particular case, the incriminating evidence were already known, then yes, you could be subject to obstruction (or likely contempt) charges.

    When I wrote my prior comment, I thought you were saying that the judge could order the decryption in spite of the 5th Amendment because of the obstruction issue. When in fact the 5th Amendment issue trumps the obstruction. In this case, however, it turned out that the 5th Amendment protection did not legitimately apply.

  119. Re: known data isn't there by Jane+Q.+Public · · Score: 1
    However...

    Note the court highlighted the distinction that being compelled to surrender information or evidence that can be used against you is not automatically a violation of Fourth Amendment right to avoid self-incrimination: the right only prevents testimonial self-incrimination; i.e. the right not to be compelled to testify as to one's own guilt or innocence of a crime. If you're forced to give fingerprints to the police, and they tie you to a crime scene, that is not testimonial self-incrimination and not a violation of one's rights under the Fourth Amendment.

    You're getting your amendments confused. The self-incrimination thing is 5th, not 4th. Anyway...

    Yes and no. The court highlighted that being compelled is not automatically a 5th Amendment violation. But the judge did not claim that it automatically isn't, either. Just that it's not a foregone conclusion.

    Fingerprints and other collection of obvious material evidence is one thing, and generally covered by the 4th. But the whole point here -- the WHOLE point in this ruling -- is that the encryption key involved is not material evidence, but "a product of the mind", as the courts have phrased it in prior cases. Personal knowledge. If compelled, it is by definition "testimonial".

    It all boils down to this. It can be stated in relatively few words:

    The 5th Amendment protects against testimonial self-incrimination. But when testimony cannot be said to incriminate, the 5th Amendment does not apply and it can be compelled.

    In this case, since the court already knew what was there, the defendant could not incriminate himself, because he was already "incriminated". This is actually a pretty rare circumstance. I've only seen I think 2 cases like this in the last 5 years or so. (There may have been more, that's just what I've read about.)

  120. He walked into this one by AdamWill · · Score: 1

    Yup. From the start of the ruling:

    "We transferred the case to this court on our own motion. [FN3] We now conclude that the answer to the reported question is, "Yes, where the defendant's compelled decryption would not communicate facts of a testimonial nature to the Commonwealth beyond what the defendant already had admitted to investigators.""

    So: don't admit the disks are yours, don't admit you know they're encrypted, don't admit you can decrypt them. (Of course, "don't say anything at all", the old standby, covers all of those, thus once more proving its value.)

  121. Re: known data isn't there by dnavid · · Score: 1

    You're getting your amendments confused. The self-incrimination thing is 5th, not 4th.

    Yes it, is; I misstated that. However:

    Fingerprints and other collection of obvious material evidence is one thing, and generally covered by the 4th. But the whole point here -- the WHOLE point in this ruling -- is that the encryption key involved is not material evidence, but "a product of the mind", as the courts have phrased it in prior cases. Personal knowledge. If compelled, it is by definition "testimonial".

    In the legal sense, that's not true. The specific passage relevant in the decision is:

    Here, the defendant's act of entering an encryption key in the computers seized by the Commonwealth would appear, at first blush, to be a testimonial communication that triggers Fifth Amendment protection. By such action, the defendant implicitly would be acknowledging that he has ownership and control of the computers and their contents. [FN13] This is not simply the production of real or physical evidence like a blood sample or a handwriting exemplar. Rather, the defendant's act of entering the encryption key would be a communication of his knowledge about particular facts that would be relevant to the Commonwealth's case. Our analysis, however, does not end here. We must further determine whether the defendant's act of production loses its testimonial character because the information that would be disclosed by the defendant is a "foregone conclusion." The "foregone conclusion" exception to the Fifth Amendment privilege against self-incrimination provides that an act of production does not involve testimonial communication where the facts conveyed already are known to the government, such that the individual "adds little or nothing to the sum total of the Government's information." Fisher, 425 U.S. at 411.

    The court cites FIsher, which states:

    It is doubtful that implicitly admitting the existence and possession of the papers rises to the level of testimony within the protection of the Fifth Amendment. The papers belong to the accountant, were prepared by him, and are the kind usually prepared by an accountant working on the tax returns of his client. Surely the Government is in no way relying on the "truthtelling" of the taxpayer to prove the existence of or his access to the documents. 8 Wigmore 2264, p. 380. The existence and location of the papers are a foregone conclusion, and the taxpayer adds little or nothing to the sum total of the Government's information by conceding that he, in fact, has the papers. Under these circumstances, by enforcement of the summons, "no constitutional rights are touched. The question is not of testimony, but of surrender."

    In this case, the court ruled that statements that disclose no more information than the government already possesses is not "testimony" wiithin the context of Fifth Amendment protections. Not all communicated "products of the mind" are testimony as a matter of law. That's the general test for evidence, but these cases imply that rule does not apply when the communication is not "evidence" in the legal sense. You are correct that the issue centers on self-incrimination, but the case law suggests that when self-incrimination is not an issue, information compelled from a defendant is not really "testimonial in nature" because, I am paraphrasing, no one is testifying to anything in particular.

    There's one more important legal catch at work in this case. The defendant was not asked to disclose his encryption keys. He was asked to use them to decrypt his hard drives. So he wasn't being asked to explicitly testify what those passwords were. He was asked to use them to unlock data. The defense argument is that using those passwords *implicitly* testifies to his knowledge of them. But since he already claimed to have the passwords, asking him to use them discloses no more information than he alrea

  122. Re: known data isn't there by excelsior_gr · · Score: 1

    So when a multinational company is pulling a Double Irish with a Dutch Sandwich the court judge will look upon them extremely unfavorably? Let's face it: it all boils down to the depth of your pockets and the impudence of your lawyers.

  123. "Daisy Fluff" is a PARTICULAR unicorn, not evidenc by raymorris · · Score: 1

    You're reversing the two terms. "We're looking for the unicorn named Daisy Fluff" names a PARTICULAR unicorn. That's particularity.

    A completely separate issue is whether there is any evidence that Daisy is iprobably in your house.

    Two separate questions:
    Did the cops specify which particular thing they are looking for?
    Did they show evidence that it is probably there?

    Particularity isn't "more" than "probable cause" any more than "four" is more than "water" - they are two, separate, unrelated concepts. Particularity doesn't have anything at all to do with burden of proof. It simply means they have to know what they're looking for, they can't search for "anything illegal".

  124. You are a trolling douchebag though by Anonymous Coward · · Score: 0

    Why're you running from simple questions troll? http://yro.slashdot.org/commen...

  125. Re: known data isn't there by dnavid · · Score: 1

    So when a multinational company is pulling a Double Irish with a Dutch Sandwich the court judge will look upon them extremely unfavorably? Let's face it: it all boils down to the depth of your pockets and the impudence of your lawyers.

    As a matter of fact, when Microsoft attempted to use both unproductive technicalities and obfuscationg cleverness in its anti-trust case they so annoyed the presiding judge that they came within a hairs-breadth of being disassembled by the Federal court, and all of their deep-pocket funded lawyers didn't help matters at all. The only thing that ironically helped Microsoft was that they so annoyed the presiding judge that he stated so publicly, and that gave Microsoft an opening to appeal the judgment as prejudicial. Its still worth noting that even with the appeal on the penalty, Microsoft was still found guilty of violating the Sherman act as a matter of law as the original findings of fact were not overturned.

    The use of tax loopholes such as so-called "double Irish" transfers are not attempts to actually defraud or impede the court system itself. They are irrelevant to the post you're replying to.

  126. Paul Revere by Zeio · · Score: 1

    Would consider the Massachusetts supreme court a kangaroo court of traitors.

    The governments in the USSA are police state loser governments. Broke, debased currency, terrible schools, jackbooted military and LEO thugs getting pay and pension to do the dirty work of a corrupt government, they cant even provide proper roads or water supply anymore.

    --
    Legalize the constitution. Think for yourself question authority.
  127. Simple, Refuse to Comply! by Anonymous Coward · · Score: 0

    So the defendant should simply tell the Mass Supreme Court which anatomically impossible act to commit on its way out the door and continue to refuse to comply. Either they have a case without something from the hard drives or they do not. If they don't, they better hope someone figures out a way to crack the encryption or give up and move on. It's time these clowns in black robes are shown the limits of their stupidity.

  128. Parallel Construction by Anonymous Coward · · Score: 0

    I think they already know what's in the documents (because they have them from elsewhere), but they want to be able to whitewash where they got them and how their investigation began by lying under oath.