Slashdot Mirror
Mass. Supreme Court Says Defendant Can Be Compelled To Decrypt Data
Trailrunner7 (1100399) writes ... Security experts have been pounding the drum about the importance of encrypting not just data in transit, but information stored on laptops, phones, and portable drives. But the Massachusetts Supreme Judicial Court put a dent in that armor on Wednesday, ruling that a criminal defendant could be compelled to decrypt the contents of his laptops. The case centers on a lawyer who was arrested in 2009 for allegedly participating in a mortgage fraud scheme. The defendant, Leon I. Gelfgatt, admitted to Massachusetts state police that he had done work with a company called Baylor Holdings and that he encrypted his communications and the hard drives of all of his computers. He said that he could decrypt the computers seized from his home, but refused to do so. The MJSC, the highest court in Massachusetts, was considering the question of whether the act of entering the password to decrypt the contents of a computer was an act of self-incrimination, thereby violating Gelfgatt's Fifth Amendment rights.
The ruling.
I lost the password in a hard drive crash.
I mean, all you have to say is that you lost the actual key and cannot comply.
Take the 5th and say your computer crashed. That works for the IRS.
If you read the ruling, the court admits that the only reason they said the defendant could be compelled to decrypt his data was because he had already admitted to the police that he was involved in the case, and that the details of his involvement were on the hard drive. I'm sure if he had kept silent the entire time and told them nothing, it would've been a different story.
Exactly - another key sentence in there is:
"In the Commonwealth's view, the defendant's act of decryption would not communicate facts of a testimonial nature to the government beyond what the defendant already has admitted to investigators. As such, the Commonwealth continues, the defendant's act of decryption does not trigger Fifth Amendment protection."
So if he had not admitted anything already and had refused to decrypt, the ruling may have been different.
if it's good enough for the IRS....
A key is a physical object and as such can be compelled. You aren't participating in your testimony by providing the physical item; you have to provide LOTS of other information during disclosure so it's not like you can't be compelled to provide something that physically exists.
The difference here is that the key is theoretically in his mind and so he would have to participate in providing that; hence why it's generally been found that keys can be compelled but combinations on locks can't and similarly passwords can't be.
BR Of course the amendments have been eroding for some time now...
People in cars cause accidents....accidents in cars cause people
It's not self-incrimination in the same way that the intersate commerce clause gives the Federal government the power to regulate absolutlely anything that might have any impact on interstate commerce even if it never leaves your house.
That is, it's clearly a blatant violation of the Constitution, to everyone but lawyers.
Haven't read the entire ruling, only scanned it, but there is an important caveat in it:
We now conclude that the answer to the reported question is, "Yes, where the defendant's compelled decryption would not communicate facts of a testimonial nature to the Commonwealth beyond what the defendant already had admitted to investigators."
Seems like this guy has said "I did this, this, and this, and these files show that, but I don't want to let you see them", and the Court has ruled that he has to, because he's already admitted to those things, and therefore he would not be incriminating himself in doing so.
Of course, the reality may be that there's evidence of further illegal activities that he hasn't admitted to in the encrypted files. That might make the case for self-incrimination. I'd have to read the full ruling to see what, if anything, they said about that possibility.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
This is why you don't talk to the cops, especially if you find yourself in the fortunate situation of having illegally acquired 13 million dollars and encrypted all of the evidence. If you say nothing to the cops, you win. The only way you lose is if you brag to them about how awesome a job you did at getting away with the crime.
The people up here who are saying "tell them you lost the key" "tell them it was scrambled not encrypted, etc" are all idiots. Lying to the cops is a crime. Telling them nothing is the superior response.
Cop executing search warrant: "it's asking for a password"
Def: "I want a lawyer, I'm not talking to you"
Cop: "You encrypted it, didn't you?"
Def: "lawyer lawyer lawyer"
Cop: "We'll just get a warrant anyway and you'll go to jail. Help us help you."
Def: "did't you hear me? I want a lawyer"
That being said, I'm in FL so I'm covered by the 11th circuit ruling. Either way, silence is golden. I'd say that at least 30 percent of my cases would have turned out much better if clients hadn't consented to searches, admitted to elements of crimes or just generally blabbed when they should have remained silent.
Would it be possible to have a system where you have a second key that "decrypts" to an empty drive? I don't see how they could prove that you used your primary or fake key.
So what they're saying is that since the decryption key isn't "testimony" it doesn't count under the 5th Amendment. (IANAL)
Guess I'm safe then. My decryption key is "testimony". Lowercase, no special characters or digits.
So if he had not admitted anything already and had refused to decrypt, the ruling may have been different.
That is irrelevant. The question at hand is whether or not the Government can force you to provide evidence against yourself in a criminal case. Now I'm just a stupid immigrant, but my understanding from the 5th Amendment is that nobody "hall be compelled in any criminal case to be a witness against himself". I don't care how much the police think they know. If they need his harddrive, their case is not solid and the suspect should not be required to provide incriminating evidence.
Being forced to provide evidence against yourself pretty makes it the Soviet Republic of Massachusetts.
I'm not a complete idiot... Some parts are missing.
I get the legalese argument the guy as trying to make and the narrow line they tried to draw with the ruling, but Im not sure why it even got past the original judge.
If it had been the exact same situation, just a combination lock on on physical file cabinet in his office, once a proper court subpena was issued Law Enforcement might have asked for the combination as a courtesy but would have been perfectly within their rights to simply cut the thing open. And if they found evidence of some unrelated crime, that is long been fair game just like a drug bust during a traffic stop.
Maybe it's different by State, I dont know
Common Sense isn't as Common as people think...
I think the correct response here would be to say that you can plead the 5th on the question of whether you can decrypt it or not, and if you claim the 5th compulsion is illegal. However, once you make an affirmative statement you waive the right to not be compelled. In terms of a key, it would be like if you had an almost impenetrable door that used a single key. The police ask you if you are in possession of said key while they have a valid warrant. You say yes, which means they have a right to compel you to hand over the key per the valid warrant. However if you shrug and plead the 5th it should not be on you at that point.
You can not be forced to testify against yourself, but you can be forced to hand over evidence that exists.
The ruling appears flawed, I sympathize with the dissent, but yeah. This guy screwed himself, in typical lawyer fashion, with excess arrogance.
He did not have to tell the police anything here, he has probably lectured his clients many times on exactly why they should never talk to the police, does not matter if you have nothing to hide, does not matter if you think you have done nothing wrong, and if you have done something but think you can talk your way out of it you are a fool. Ask for your lawyer then shut your mouth, and do not answer any questions, I dont care if they ask you about the weather, the reply is 'ask my lawyer.'
From the language used in the opinion, if he had simply shut his mouth and not started bragging/volunteering information, he would be in a very different situation today.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Not quite, but you are making a good point. According to The Ruling the only reason the motion was filed and this issue came at all up was because the guy happened to have used a particularly effective encryption software that the State was unable to circumvent. But they tried and would have been perfectly allowed to use any of the information found had they succeeded. Which is like saying that the 5th amendment would protect the contents of my safe, but only if I can afford a top-of-the-line one.
Common Sense isn't as Common as people think...
from what I've read, the interpretation is that you may not be forced to _create_ evidence that may be used to convict you at the request of a government entity. Answering a question from a government employee is creating statements that didn't already exist. Filling out a form is creating documents that didn't exist. Evidence that they already have can be followed up. Evidence that is known to already exist can be demanded (blood samples, DNA samples, papers in a safe), and the fifth won't help because you're not creating anything.
Following this interpretation, data on the drive already exists. Taking the fifth when asked if you know the password may be allowable, but once knowledge of the password has been admitted, it's down to the "demanding evidence that exists" category and the fifth doesn't help.
I'm not saying that's the ideal answer, but there is a certain logic to the position.
A better analog might be, suppose someone said in testimony
Could they then be compelled to provide the location if police searches turned up a blank? Seems like they could.
Of course, if you are willing to go to jail and wait it out, the "compulsion" is never forever, Seems like that might depend on just what's in those documents.
Judge thinks you are lying. You're a geek, who presumably knows how to secure information on a computer. You saying "I lost the data" is equivalent to saying "My whole life is a lie and I don't actually know how to do any of the things I always talk about." Bullshit. You didn't lose the data. Your RAID6 didn't have a three-drive failure, and your backups weren't untested.
Same judge can think Lerner is telling truth. Lerner is an administrator, and she uses an iPhone and thinks the "e" on her desktop is the Internet, Her saying "I lost the data" is equivalent to her saying "I think the car's oil might be low, but I haven't looked. but the problem really could be oil, because I read a story in Readers Digest about a couple who saw some smoke coming out their hood, and when they finally got to town for someone to check it out, it turned out they were low on oil!" Her act is consistently dumb enough that no dumbness could be out of character.
When Lerner is asked the airspeed of an unladen swallow, she smiles helplessly, shrugs, and says "I don't know. What did you swallow?" When you're asked, you smugly immediately instinctively counter with "African or European?" and when the judge says "European," your eyes suddenly dart around and you say, unconvincingly, "Uh... I don't know anything about swallows."
And how so? He waved his ability to execute their search in their faces and then suddenly is surprised when his failure to STFU per the 5th was held against him.
If an ordinary person believes they can give a cop legally valuable information about a case against them and not expect to have that used against them, their intelligence doesn't even rise to the level of pop culture references (you have the right to remain silent, anything you say...)
And let's be clear here. This was a lawyer, not an ordinary person. Odds are higher an ordinary person would have been smart enough to just shut up whereas this guy probably thought he'd use some fancy legal maneuvering he learned along the way to win on a technical point.
If the government serves you with a search warranty for your paper files you do not go and collect them into a box and hand them over. You step out of the way and they gather them. The government issues a search warrant for your combination safe, you stand out of the way while they open it. If the government issues a search warranty for your encrypted documents, you are now expected to supply them? Um no. You stand out of the way and allow them to go get them.
All this is making me start to think of some kind of more clever "panic mode" encryption.
You'd have to make it really fast, such that it's reg proto-encrypted two ways, one normal, and the panic mode. So say something really fast like shift-control-alt-F11 instantly flips the "panic bit".
We as geeks could put all kinds of awesome stuff into it, smashed into a kind of digital Klein Bottle with milk for Schrodinger's cat.
"Do you know how to decrypt it?"
"No"
"Why not?"
"Because it's time-locked with a code that cannot be found until next September."
"Do you know what documents are on there?"
"The ones you are looking for are not there because they were broken into component parts that only the computer knows, tied to a code that September code. Meanwhile other documents you did not know were there, are there, because they were created by algorithms the moment I hit the Panic Button and not a moment before. And the base of the September key is an English phrase which may or may not admit a crime. You don't know."
"So what if the case is dismissed?"
"I can do other work until September. What's important is that it cannot be broken right now."
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
All this is making me start to think of some kind of more clever "panic mode" encryption.
You'd have to make it really fast, such that it's reg proto-encrypted two ways, one normal, and the panic mode. So say something really fast like shift-control-alt-F11 instantly flips the "panic bit".
We as geeks could put all kinds of awesome stuff into it, smashed into a kind of digital Klein Bottle with milk for Schrodinger's cat.
"Do you know how to decrypt it?" "No" "Why not?" "Because it's time-locked with a code that cannot be found until next September." "Do you know what documents are on there?" "The ones you are looking for are not there because they were broken into component parts that only the computer knows, tied to a code that September code. Meanwhile other documents you did not know were there, are there, because they were created by algorithms the moment I hit the Panic Button and not a moment before. And the base of the September key is an English phrase which may or may not admit a crime. You don't know." "So what if the case is dismissed?" "I can do other work until September. What's important is that it cannot be broken right now."
In my opinion, that likely wouldn't work. Contrary to what you might see on TV or in movies, courts are not generally impressed by technicalities or deliberately unproductive cleverness. Consider the recent Supreme Court ruling against Aereo. The Court was entirely unmoved by the technical argument that the way Aereo implements their service is "basically like" individuals using antennas. They ruled that *overall* Aereo was obviously acting as a rebroadcaster, by taking in broadcast signals and sending them live to a large number of customers and charging for that. The notion that they don't charge for the broadcast, just the rent for the antenna was similarly unconvincing to the Court. Courts tend to look at net results, and less the technical path to achieve it. In this case, a court would rule that a) you've just admitted the system contains information related to the government investigation, b) you created the system being used to obfuscate and hide that information, and c) even though you've made it difficult or impossible to produce that information at this time, you can be compelled to do so at the earliest possible moment the system physically allows, and d) the fact that you appear to have deliberately done all of this in a deliberate attempt to thwart law enforcement with full knowledge of the legal consequences can subject you to an obstruction of justice charge.
Most judges and most courts do not consider the law to be a game that people can attempt to create exploits for. Exploiting loopholes in the law is one thing: doing so with an obvious willful intent to subvert the court tends to be looked upon extremely unfavorably. Judges have significant latitude to deal with people they think are trying to do that.
That only applies to people who have no authority that could ever possible impact the judge in question.
"That's a nice tax bracket you have there... it'd be a shame if it got audited for the last seven years, and every year from here on out, into the foreseeable future"