Slashdot Mirror


Phone Passwords Protected By 5th Amendment, Says Federal Court

Ars Technica reports that a Federal court in Pennsylvania ruled Wednesday that the Fifth Amendment protects from compelled disclosure the passwords that two insider-trading suspects used on their mobile phones. In this case, the SEC is investigating two former Capital One data analysts who allegedly used insider information associated with their jobs to trade stocks—in this case, a $150,000 investment allegedly turned into $2.8 million. Regulators suspect the mobile devices are holding evidence of insider trading and demanded that the two turn over their passcodes. However, the court ruled, "Since the passcodes to Defendants' work-issued smartphones are not corporate records, the act of producing their personal passcodes is testimonial in nature and Defendants properly invoke their fifth Amendment privilege."

29 of 178 comments (clear)

  1. A sudden breakout by fishscene · · Score: 5, Insightful

    ...of common sense no doubt! I love hearing stories of correct implementations.

    1. Re:A sudden breakout by CaptainLard · · Score: 3, Insightful

      Well of course. All we needed was for data privacy to impact a bank employee.

      In other news, of all the financial improprieties why did the SEC end up being so good (apparently) at catching insider trading? Is it the crime that least rocks the boat?

  2. Finally by Teun · · Score: 4, Insightful

    Tough for the prosecutors but this is a flash of some sense.

    --
    "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
    1. Re:Finally by Anonymous Coward · · Score: 4, Insightful

      It is more like being obliged to tell where you hid the key to the door that couldn't be forced. Your 5th amendment right obviously protects you.

    2. Re:Finally by ArmoredDragon · · Score: 5, Informative

      No, not at all.

      Anybody who is even slightly versed in proper IT security terminology knows the difference between "who you are", "what you have" and "what you know" authentication factors. (Along with the difference between authentication, authorization, and accountability, and the concepts of integrity and nonrepudiation. If you don't know any one of these, then you haven't been properly trained in information security.)

      A key is "what you have", whereas a fingerprint is "who you are". You can't claim the 5th on either of those. You can however claim the 5th on "what you know" which is what a password is. However if you, for example, write down the password somewhere, that can be considered a "what you have" and wouldn't be protected by the 5th.

    3. Re:Finally by Wrath0fb0b · · Score: 2

      Tough for the prosecutors but this is a flash of some sense.

      Be careful what you wish for. Because if it becomes precedent that technologically-protected documents can't be subpoenaed than the first people to take advantage of this will be large corporations trying to cover their own asses. You know, something like "Oh, we can't give you the emails between the VW ECU engineers and their managers, they are PGP-encrypted (with a key that each employee spins on their first day) and we can't make them turn over the passwords for their key". Or, like in this case, insider traders.

      I think there needs to be the right balance between the right not to self incriminate and the obligation to turn over material documents (including electronic) when properly subpoenaed and in a process designed to minimize disclosure of non-responsive documents. There has never been protection for non-testimonial disclosure of documents, samples and the like.

    4. Re:Finally by msauve · · Score: 2

      A key is "what you have", whereas a fingerprint is "who you are".

      Unless you're the Chinese government, and you've just stolen the fingerprint records of 5 million US Government employees.

      --
      "National Security is the chief cause of national insecurity." - Celine's First Law
    5. Re:Finally by TsuruchiBrian · · Score: 2

      I think the balance should be that you have no obligation to turn over any documents, but law enforcement can, with a court issued warrant can seize whatever is appropriate. It seems silly to me to expect corporations to cooperate anyway (e.g. turning over documents when ordered to).

      The way I see it, we have 2 options. We can give the government the power to compel people to produce information (i.e. punish people for not producing information), and hope that this power is not abused, or we can not give the government this power, forcing them to exert a lot of energy in order to get the information they really want (e.g. brute force decryption), and hope they actually go to the trouble in only those cases where it is justified.

      In a more perfect world (e.g. Denmark) I think the 1st option is good, but for the United States I think we need the second option to keep us honest, even if it is less efficient.

    6. Re:Finally by NicBenjamin · · Score: 2

      I think it's interesting how slashdotters reacted.

      When presented as an example of the Feds not being able to force a defendant to turn over info, it's universally lauded as correct Constitutional practice. If it had been presented as an example of rich bankers evading prosecution for their crimes by using their ill-gotten $2.65 million in stock profits to pay really good lawyers, it would be very controversial. And both readings of the situation are perfectly accurate. It would be unconstitutional to force them to say what the pass-codes are, and it's virtually certain some poor schmuck with a public defender would have to do it anyway because his lawyer didn't have a full day-and-a-half to devote to arguing rules of evidence.

      One of the ironies of US Constitutional law is that, since the Constitution assumes everybody has a decent lawyer devoted to his case full-time, and those cost a LOT these days; it's ability to protect the rights of people who don't make enough to just drop $5k-$10k on an evidentiary hearing is limited.

    7. Re:Finally by ArmoredDragon · · Score: 3, Interesting

      A somewhat opposing argument is that the documents (email, text messages, photographs, etc.) fall under "what you have", and that a court can compel you to produce those documents.

      They can't compel you to turn over documents that they merely suspect to exist. They'd need not only proof of their existence, but also that they're relevant to the case. That's kind of hard to do without being able to decrypt them. I.e. simply saying "turn over all of your emails" isn't good enough if they can't A) prove that those emails exist to begin with, B) prove that those emails are relevant, assuming they exist, and pointing to blobs of an unreadable encrypted blob of data doesn't meet that standard.

  3. But your finger prints is not protected by Anonymous Coward · · Score: 5, Interesting

    by the fifth Amendment.
    http://time.com/3558936/fingerprint-password-fifth-amendment/

    1. Re:But your finger prints is not protected by pauljlucas · · Score: 2

      Which is why, if you're ever pulled over or believe you're about to be taken into custody, you power off your phone. At least an iPhone requires the pass code be used the first time before it allows your fingerprint to be used.

      --
      If you reply, do so only to what I explicitly wrote. If I didn't write it, don't assume or infer it.
    2. Re:But your finger prints is not protected by macs4all · · Score: 4, Informative

      On iOS, after 24 hours or less than 10 failed fingerprint attempts, you are required to enter your password to gain access to the phone (fingerprint doesn't work at that point). I would assume that it would take longer than 24 hours for the police to convince a judge to force you to use your fingerprint, and a emergency stays by appeals courts do happen as well. I also believe that the knowledge of which finger unlocks your phone would be protected by the fifth amendment, so that you would not have to inform law enforcement which fingerprint opens the phone and as a result the phone requires a password after many failed attempts.

      UNFORTUNATELY, There was an a decision a about a year ago that ruled that you COULD be forced to unlock your phone with your fingerprint, even if you could not be forced to do so with your passcode.

      FORTUNATELY, it was only a STATE Court; so, unless you happen to be caught in Virginia, you could still fight it, and with this decision as (non-controlling, but persuasive) precedent, maybe even score a win for all of us!

    3. Re:But your finger prints is not protected by cdrudge · · Score: 2

      Come on. You know that's not going to happen. The cop is going to shoot you regardless if he sees you fiddling with something or not. He only will say he saw you fiddling after the fact to justify it.

  4. Work Issued by The+Raven · · Score: 5, Funny

    While I agree with the ruling, I must say that any idiot who uses a work issued phone to conduct illegal business is a special kind of idiot. There is no bus short enough.

    --
    "I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
    1. Re:Work Issued by Moof123 · · Score: 2

      It is that aspect that gives me a little pause. Everything on a work issued phone belongs to the company, it should be the companies decision as to whether to unlock the phone. Perhaps we will see secondary access by an admin become a condition of use?

      Will this get extended to divulging passwords in general like in the Terry Childs case? Couldn't someone in his position plead the 5th on similar grounds?

  5. testimonial privilege is not immunity though by supernova87a · · Score: 2

    Good to understand though, that not having to be compelled to produce something that could be used against you, doesn't mean that you are protected from that thing being produced... by others. So if somehow their phones were brute force unlocked or decrypted, that evidence could definitely be used against them.

  6. Re:Isn't pleading the fifth roughly... by Locke2005 · · Score: 4, Interesting

    The Fifth Amendment means that when they torture you into confessing, it's not admissible in court? As an American, I find the concept of throwing out evidence somewhat questionable is well, as in, if someone is guilty, they are guilty, no matter how the evidence was obtained. There should be more direct consequences for unlawfully obtaining evidence, because supressing evidence obtained by violating rights only protects the guilty, as you said. What we really need is a way of punishing law enforcement for violating the rights of INNOCENT people, as it is, they don't even say "I'm sorry". The best we can hope for is to actually get reimbursed for the property they destroy.

    --
    I've abandoned my search for truth; now I'm just looking for some useful delusions.
  7. Re:Hoorah! by serviscope_minor · · Score: 3

    The price of living free is that sometimes paedophiles will go free.

    No system is perfect. In order to guarantee every pedo is locked up, 1000 innocents will have to be locked up for every pedo. Sane people realise that's not worth the tradeoff.

    --
    SJW n. One who posts facts.
  8. Re:Isn't pleading the fifth roughly... by jafiwam · · Score: 3, Interesting

    ... equivalent to admitting that one is guilty of at least one thing that is just as bad as whatever it is they are being charged with, or that what one is being charged with is actually entirely accurate?

    Granted, they don't know exactly what that something one is evidently guilty of might be, but still...

    Maybe I'm being just a goofy non-American here, but I honestly don't understand the point. In the general case, would someone explain to me how this constitutional amendment protects genuinely innocent people?

    Yes.

    And. So what?

    Not having the 5th amendment opens the door to what would basically be torture. I think you want the government doing that less than you want the government to win this case.

    Anyway, they can go ASK THE FUCKING NSA about what was transferred between the phones. Oh, right, that wasn't a legal search either. Sometimes the parallel construction doesn't work I guess.

  9. Re:Isn't pleading the fifth roughly... by Anonymous Coward · · Score: 2, Informative

    Well, first let us look at the text of the 5th amendment:

    "No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a grand jury, except in cases arising in the land or naval forces, or in the militia, when in actual service in time of war or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation."

    As you can see, the 5th amendment is not just about being forced to testify against oneself. It encompasses much of what we in the States consider the 'innocent until proven guilty' principle and the idea of 'due process.' This means that not only do you have no obligation to prove yourself innocent, but also that you are under no obligation to help the courts prove your guilt. The 5th amendment (along with a few others) tries to make it more difficult to wrongly convict the innocent at the cost of occasionally not convicting the guilty.

    While not convicting a guilty person is seen as an injustice, I would like to think that most people would see the wrongful conviction of an innocent person as a significantly greater injustice.

  10. Re:Isn't pleading the fifth roughly... by TWX · · Score: 4, Insightful

    Part of the point is that confessing under pressure or torture doesn't mean that the confession is real. If one is being tortured, one may say anything that one believes will end the torture, if the torturer has stated that saying that thing will cause the torture to stop.

    Also, don't forget, everyone is innocent until they're convicted in a court of law. Right now, in the eyes of the law, Bill Cosby is completely innocent of any and all accusations that have been made against him. Individuals may choose whether or not to believe that he has or has not done the things that he has been accused of, but he has not been indicted or convicted of anything, and given that it doesn't sound like any evidence exists to substantiate these claims of acts a long time ago, it's very likely that he will not see criminal charges based on the accusations. That doesn't mean that people will trust him like they did before, but in the eyes of the law he is an innocent man.

    --
    Do not look into laser with remaining eye.
  11. Re:Work phone, easy by TheReaperD · · Score: 2

    Typically, police cannot get a warrant to get a 3rd party to do what the police are not allowed to do. Example: A private citizen can hire a PI to spy on someone to gain evidence the police cannot obtain via warrant and turn that evidence over to the police and it is often legal (and even if a crime was committed the police can normally still use the evidence) but, the police cannot hire the PI to do the same thing or coerce the private citizen to do it on their behalf. In this case, if the cops leaned on the employer to coerce the password from the employee, the police are still violating his 5th amendment rights and the evidence will likely be tossed and all data on the phone will be inadmissible even if they find another way to obtain it. Nothing involving law and the courts are 100% certain thus, all the qualifying phrases.

    --
    "Be particularly skeptical when presented with evidence confirming what you already believe." -
  12. Re:Isn't pleading the fifth roughly... by Lakitu · · Score: 4, Insightful

    As an American, I find the concept of throwing out evidence somewhat questionable is well, as in, if someone is guilty, they are guilty, no matter how the evidence was obtained.

    This should be "despite being American, ...". Guilt is determined by the courts and it is done so using evidence gathered. If a person of questionable guilt is found guilty in a court of law, then ALL evidence that was used against them to do so is suddenly retroactively converted into having no requirements for its gathering. The person is guilty because of the evidence, and the evidence is admissable because they will be found guilty. This might be a nice system if we could pause the universe and question God as to whether we're correct or not, but we cannot, and if we could, we would probably not need arcane concepts like legal systems in the first place.

    How could you possibly hold someone accountable for destroying your property if it's perfectly acceptable for them to destroy your property if you will eventually be convicted? It's just an incentive for everyone involved to convict you regardless of whether you did anything or not.

    Both you and the non-American OP are viewing this in a simplistic manner as if a trial exists of questions such as "did you do it?" with a yes or no response. They are not. A skilled prosecutor can make it seem like your 8:59 quick trip to a convenience store reeks of guilt when it was information you happily provided to police. If "evidence" were always as evident as a bloody knife, then the criminals would just clean up after themselves without fail.

    It's fucking crazy that a place like /., where people so greatly appreciate the overreaching of the NSA, some people can so quickly do a 180 and justify the same behavior so long as they come up guilty in the end! The 4th and 5th amendments, protecting searches without warrant and protecting you from having to testify against yourself, are intricately and irrevocably linked together. How can you justify not consenting to a search if you can be forced to consent to provide evidence incriminating yourself?

  13. No brainer by schwit1 · · Score: 2

    No one should be compelled to assist in their own prosecution.

  14. Re:Isn't pleading the fifth roughly... by Lakitu · · Score: 2

    One of the major use-cases of the 5th amendment is avoiding having to take the stand during a criminal trial. It's not like the prosecutor can call you to the stand and ask you a bunch of innocuous questions like your name, birthdate, job, hometown, etc., which you must answer and then ask "did you commit the murder?" Because it is unconstitutional to force someone to testify against themselves, and because a prosecutor questioning a defendant in front of a jury could imply guilt like this, a defendant's lawyer will often object to them even being called to the stand to testify in front of a jury. In this sense it's axiomatic.

    This doesn't prevent evidence from being gathered against you before the trial, and it often doesn't prevent you from giving up information against yourself (ie, it's not like you can refuse a warrant just because they might find something inside your home). The police can still hold it against you during their investigations, like you suggest, so while you can refuse to answer their questions ("you have the right to remain silent"), if you just sit there and completely refuse to talk the police will most likely more aggressively investigate what it is that you're hiding.

  15. Re:It's about time by viperidaenz · · Score: 2

    They didn't really leech money from society.
    If anything, they didn't play fair with other traders, so they missed out on the opportunities.

    Unless you're a stock trader, you're not impacted.

  16. Re:Isn't pleading the fifth roughly... by Lakitu · · Score: 2

    You may be an American by birth or by other processes legally, but you have zero concept of what it means to actually be an American, or of why the US was even founded then.

    My post says nothing about police behavior other than condemning those who would wish for greater police powers as some kind of wishful thinking about simultaneously convicting more guilty people while reducing executive misbehavior. If you can believe that kind of wishful thinking, backing it up only with your "no true American.." logic, then you should move to Syria, where similar feelings are actually being implemented. Tell me how it turns out!

  17. Re:Will be reversed on appeal by Aaden42 · · Score: 2

    If you're in a situation where your phone might be confiscated, power it off completely. At least for iOS, TouchID will not unlock the device at power on. The full passcode must be entered. Using more than the 4 (or now 6) digit minimum would be a GoodIdea(TM).

    If you're compelled to provide your finger under duress, do the best you can to "smear" the print or else provide fingers that aren't enrolled for TouchID. You only get five attempts. After that, the phone will require your passphrase and even the correct finger print will no longer unlock the device.

    If you're in a time-sensitive situation or can touch but can't look at the phone, hold Home & Power down for five seconds or more to force a hard power off.

    In any case, powered off is safer than locked as the Secure Enclave processor holds several session keys that are derived from your passcode. Powered on but locked, the keys are technically still "there" and vulnerabilities could conceivably expose them. Powered off, they're gone completely.