Child Porn Suspect Jailed Indefinitely For Refusing To Decrypt Hard Drives (arstechnica.com)

An anonymous reader quotes a report from Ars Technica: A Philadelphia man suspected of possessing child pornography has been in jail for seven months and counting after being found in contempt of a court order demanding that he decrypt two password-protected hard drives. The suspect, a former Philadelphia Police Department sergeant, has not been charged with any child porn crimes. Instead, he remains indefinitely imprisoned in Philadelphia's Federal Detention Center for refusing to unlock two drives encrypted with Apple's FileVault software in a case that once again highlights the extent to which the authorities are going to crack encrypted devices. The man is to remain jailed "until such time that he fully complies" with the decryption order. The government successfully cited a 1789 law known as the All Writs Act to compel (PDF) the suspect to decrypt two hard drives it believes contain child pornography. The All Writs Act was the same law the Justice Department asserted in its legal battle with Apple.

Comments

So forgetting a password

[allo]

May keep you in jail. Forever.

Re:So forgetting a password

[Anonymous Coward]

The sad thing is that they don't have enough evidence to convict him.

The authorities have called two witnesses. One was the suspect's sister who claimed she looked at child pornography with her brother at his house. The other was a forensic examiner who testified that it was his "best guess" that child pornography was on the drives

Meaning that the only thing they have on this guy is an accusation from the sister. The other witness have essentially only said that "Well, it's encrypted, what else could it be?"

This means that if you want to put someone in jail forever all you need to do is to hide an encrypted drive (Or fill it with random noise) in their home and accuse them of keeping child porn on it.
Without being able to produce a decryption key the poor bastard will be kept in custody indefinitely, probably with less access to exercise and books than a convicted pedophile would.

Re:So forgetting a password

[Anonymous Coward]

I totally agree. Without EVIDENCE there is no case here. Just because somebody in power 'thinks' he has committed a crime, without any evidence, there is no reason to keep him in prison, and just as you say, you just have to hide an encrypted drive in somebody's house and accuse them of owning child pornography, and they can be kept in prison indefinitely, for having done nothing!

Re:So forgetting a password

[ShanghaiBill]

I totally agree. Without EVIDENCE there is no case here.

There is evidence. Certainly not enough to convict, but enough to get a warrant to search for additional evidence. The key question is whether he can be compelled to assist in that search. The Supreme Court has ruled that a suspect cannot be compelled to provide the combination to a lock, so I don't see how this is significantly different.

Re:So forgetting a password

[Maritz]

It's different because terrrrristchildrens.

Re:So forgetting a password

[TFAFalcon]

Well that solves the whole problem of 'lack of evidence'. The court can just order each defendant to produce the evidence to convict them. If they don't, then jail them until they do.

Re:So forgetting a password

[Harlequin80]

Who knows. Maybe there is a full on conspiracy here and there isn't child porn on there but state secrets of his true employer, Mossad. Or it could be KFC's secret herbs and spices recipe. Or it could be child porn. Or he could be an officer of the law who is standing on principle and saying fuck off you're not allowed to do this.

Frankly we don't know.

Re:So forgetting a password

[fey000]

Or we can throw them in the ocean to see if they float or drown.

Re:So forgetting a password

[wbr1]

So having authorities request a password you never had or knew, because you pissed them off, can keep you in jail forever.

Just pointing out how this can be used as a weapon against anyone, anytime.

Re:So forgetting a password

[ole_timer]

under the 5th amendment he can't be compelled to "utter" the passphrase, but he can be compelled to provide the unencrypted contents in most jurisdictions.

Re:So forgetting a password

[gweihir]

And in other news, if the judge just says "screw him" then the person is screwed. And nothing is ever going to happen to the judge for that evil act.

Re:So forgetting a password

[gweihir]

This interpretation is just fundamentally evil as it negates the intended protection for the accused. But what do you expect in a police-state.

Re: So forgetting a password

[Anonymous Coward]

Alleged...

As someone who had to assist in a NCIS hunt for child porn on a subordinates computer who of course had none but all it takes is an accusation, I dont trust searches like this.

Not to mention that information would fall directly into the Fifth Amendment as that information would be providing witness against yourself.

If they need that one HD in order to nail this guy then they don't have enough evidence... Should have tried harder. They didn't build a solid enough case with enough evidence before pulling the trigger.

Re:So forgetting a password

[phishybongwaters]

You don't think this is actually about child porn, do you? You can't be that thick, can you? You must understand, even at a very basic level, that kiddie porn has been, and always will be, a lynch pin in the restrictions of your rights and freedoms. We must outlaw encryption because.... TERRORISM! But... the terrorists didn't use encryption. KIDDIE PORN! EVERYONE HATES THAT! I've called this so many times. In fact, if you go through my post history you should find some posts on the Apple case with the FBI, where I literally said this exact this is going to happen (unless I posted as AC, depends on the computer i'm at). They've used this to fight piracy and boost copyright laws. They've used it to completely destroy usenet. And they are using it now to destroy encryption. And the best part of all of this? The NSA and any law enforcement agency that bothers to ask, already likely has access to the network these images came from. This isn't about stopping child porn, and it's not about protecting kids and putting pedophiles in jail. It's about outlawing, or neutering, encryption because it takes slightly more effort to spy on you if you use encryption. It has never been about child porn. Ever

Re: So forgetting a password

[Ihlosi]

They then seized his computer and forensically analyzed it.

Well, maybe they should have anticipated encryption and devised a way to obtain the encryption keys (surveillance, keylogger, whatever).

Re:So forgetting a password

[Ihlosi]

This is significantly different because a lock can be cut open,

You can devise a locking mechanism that cannot be opened by force without destroying whatever the lock is supposed to protect.

What would you suppose the court should do if it has seized documents as evidence, but they're all written in a fantasy language that only the defendant uses? "Please Mr. Defendant, translate this for the court."?

Re:So forgetting a password

[Mr D from 63]

Child porn has been aggressively prosecuted long before online trafficking and encryption became and issue. But hey, never miss a chance to deflect. There is a battle over encryption, but that does not mean everything it touches becomes ONLY about the encryption.

Re: So forgetting a password

[ooloorie]

Now, what we don't know is what that analysis found. They 'may' have seen that those disks were used at the same time as the accessed the child porn site, and 'may' had other evidence on his computer that showed he likely downloaded. If so, that would all be pretty compelling evidence as a whole.

Then they don't need to force him to decrypt his hard drives, do they?

And make no mistake: while this sort of thing starts with the lest likable characters, it will eventually be used against anybody from Snowden to your grandmother to go on legal fishing expeditions against anybody that police, prosecutors, or the executive branch doesn't like.

Re:So forgetting a password

[Immerman]

What makes you think they have too? He's not being detained as punishment for a crime - that would require proof. He's being detained for contempt of court, in order to attempt to coerce him to do something they assume he can. This is the kinder, gentler version of "rubber hose decryption", and there's far more leeway for that.

Besides, being able to access encrypted files on your computer is a pretty safe bet, especially if the timestamp indicates they've been accessed recently. Unless someone else put them there, the only really plausible way to claim otherwise is if it requires a keyfile that you were able to destroy in the presumably brief window between having the cops show up and being detained.

Re:So forgetting a password

[ooloorie]

no, it's narrower than that. under our system you can't utter or sign. but you have to give the other side (in this case the gov't) the unencrypted data.

Your idea that this is a settled question only shows that you are utterly ignorant of how "our system" works.

In our system, the meaning of the Constitution is interpreted by the courts, and their interpretation has changed significantly over the years. Whether anybody is obligated to decrypt their own data for the government or not still is an open question, to be decided probably by lots of court cases and legislation.

Re:So forgetting a password

[Agripa]

and if he is actually innocent of possession of child porn, he can get full exoneration by cooperating.

You're kidding, right?

Nothing will ever exonerate him even though he has not even been charged yet.

Re: So forgetting a password

[ComputerGeek01]

Well, maybe they should have anticipated encryption and devised a way to obtain the encryption keys (surveillance, keylogger, whatever).

That would require a warrant (because this isn't a three letter agency prosecuting the defendant). At the point that you have enough evidence for a warrant, you would have enough for a conviction so the only reason for going through that much trouble would be if the case was part of a larger operation which it doesn't appear to be. You're right though, one way or another they didn't have enough evidence to move on an arrest and they should have put more work into it. This case is a perfect example of what I've been saying about the American judicial system for years; our system works fairly well for its size, the trouble is that the people in charge of it right now are complete screw ups who think that they can half ass a case like this and get away with it. You can't be in contempt of court unless you're already in court to begin with, and the article says that the defendant (or victim at this point) was never formally charged with anything. So the most they could hit this guy with would be interfering with a judicial proceedings (even that would be a stretch) which doesn't carry the same potentially indefinite penalty. They clearly went this route so that they could circumvent the need for a jury and should be prosecuted for that.

Re:So forgetting a password

[Mattcelt]

That's actually precisely what the fifth amendment is about - that the courts do not (and should not!) have the power to compel the accused to produce evidence that would be incriminating or harmful to themselves or their case.

This is fairly clearly an abuse of judicial power. Abstracting the incrimination one level does not suddenly make it acceptable.

Re:So forgetting a password

[mysidia]

Which happens to be impossible to prove due to fundamental restrictions of how reality works. Hence the government just assumes they are capable

The government is not allowed to assume that you are guilty. It does not matter how inconvenient this requirement becomes due to how reality works.

The law requires the government to show you are guilty beyond a reasonable doubt, otherwise the legal principles at the basis of our rule of law say that you must be presumed innocent, in that case you should be released.

If the suspect has forgotten the password, and reports to have forgotten or never knew the password and has no access to the password, then I do not believe there is any legal basis for holding them in contempt beyond that point.

Only way they could is they have definitive proof that someone has access to the password, and it's being withheld under the control of the suspect.

Re:So forgetting a password

[jbmartin6]

The SC has never RULED this. It was mentioned in a different case. However, there is clear precedent in the US in the case law regarding combination safes. The defendant can be compelled to open/unlock in cases where there is clear evidence that relevant items are held by the lock. e.g. if the guy wrote in an email "I keep all that illegal porn on this encrypted volume". One cannot be compelled for a fishing expedition or under the rubric of a more general search warrant. I would guess from the invocation of All Writs that this isn't what happened in the case at hand. Or perhaps as others say it is an attempt to leverage All Writs for a wider precedent. I didn't read the case details, though.

Re: So forgetting a password

[Cederic]

the end result of this is the same, a pervert sits behind bars

Fuck you and your evidence free condemnation of someone.

If he's committed a crime, prove it, provide the evidence, and a court will convict him and apply appropriate measures in response.

In the meantime an innocent person - pervert or otherwise - is in prison. Since you're also a pervert*, perhaps we should ask for you to be locked up indefinitely too?

*based on the simple refrain: I'm kinky, you're a pervert

Re:So forgetting a password

[msauve]

" If the evidence already exists (as encrypted data on the hard drive)"

Ah, but it's NOT known to exist. The prosecution only suspects there's evidence on the hard drive, and they're fishing.

Re:So forgetting a password

[JustAnotherOldGuy]

As an analogy, the court cannot compel you to write a confession. If you already wrote one and put it in a safe, they can compel you to give them the combination to the safe.

Yes, but not if they only suspect that there might be a confession in the safe. Otherwise it's a fishing expedition and that's not allowed.

If this was permitted then cops would be able to pick any house at random and search it for whatever they suspect might be in there.

Re:So forgetting a password

[russotto]

If you already wrote one and put it in a safe, they can compel you to give them the combination to the safe.

No, they can't, if the combination is only in your mind. They can compel you to give them the safe and they can crack it, but they can't force you to give them the combination.

Re: So forgetting a password

[Cederic]

If this guy is innocent then he can work with them to show he is innocent. Let the Project see the evidence.

Ok, so lets lock you up. I'll draw up a list of crimes you may or may not have done and we'll keep you in prison until you've worked with the Innocent Project to prove your innocence on all of them.

Shouldn't take too long, I'll keep the list down to a couple of thousand different offences.

That said, if YOU were accused of having child porn I tend to think you would do everything in your power to show that wasn't the case. If you don't want child porn, think murder, rape or embezzlement.

That has nothing to do with whether I'm innocent though, and certainly nothing to do with whether it's appropriate to imprison me with no evidence.

Re: So forgetting a password

[ultranova]

Defending encryption doesn't mean having to defend every disgusting pervert or criminal that uses it.

Yes, it does: if I don't defend a criminal's fundamental rights, I weaken mine. After all, I have accepted them being merely conditional, rather than truly fundamental, and signaled this acceptance through my lack of action. Cultural consensus has shifted, eroding said rights ever so slightly.

And, quite frankly, the end result of this is the same, a pervert sits behind bars.

Some accused of being a pervert sits behind bars. This is used by authoritarians to cause an emotional response, which can then be used against you later. Don't go into the trap.

Re: So forgetting a password

[SumDog]

5th amendment protects against self incrimination. He's compiled with the warrant. They have possession of the items. You are not required to incriminate yourself.

This goes well beyond what lawmakers anticipated. We are talking about unbreakable safes.

Despite what you may believe about this man and his alleged crimes, encryption is the key technology in promoting free speech and preventing though crime. Let me as you this: what if it had been gay porn and we still lived in a system where that was illegal (which wasn't that long ago)?

Re: So forgetting a password

[lgw]

If this guy is innocent then he can work with them to show he is innocent. Let the Project see the evidence.

Yes, yes, "guilty until proven innocent" is so much easier for the state. A liquor store was robbed? Just arrest the nearest black person - he probably can't afford a lawyer, so the charges will stick. Kiddie porn downloaded? Arrest the first person you find with encrypted files - if they provide a password, demand they produce the other password, for the hidden partition.

Re:So forgetting a password

[gurps_npc]

I hate and despises "magic word tests" put into law. He has a right to not incriminate himself - including a right not to be forced to make a specific statement.

Well...

[Anonymous Coward]

The following comes to mind:
https://xkcd.com/538/

Sure it's not a hammer, but incarceration sounds like a reasonably persuasive wrench...

Re:Well...

[zazzel]

Of course, this shouldn't be legal behaviour for the jurisdiction. He DID turn over all documents, so doesn't that constitute compliance with the All Writs Act? Handing over a password (even if it's not forgotten - and that happened to me twice (!) with encrypted volumes) could mean testifying against yourself - and you don't have to do THAT outside of countries supporting The Inquisition's mode of justice.

Re: Surely a fundamental human rights breach?

[Anonymous Coward]

so just plant a hd full of rando bits and finger someone. of course its a violation of the justice principles.

Re: Surely a fundamental human rights breach?

[bug1]

Nothing to hide == nothing to fear

"Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say," - Edward Snowden

https://www.reddit.com/r/IAmA/...

Re:5th ammendment

[Anonymous Coward]

Modded you up, god knows how many comments before it took an AC to point out what is the heart of this.

You can't be forced to bear witness against yourself

"nor shall be compelled in any criminal case to be a witness against himself,"

There it is in plain English. The judge holding this man till he complies needs to be tarred feathered then set on fire.

Re: Is it even child porn?

[loufoque]

The right solution to this problem is to get rid of all the laws preventing possesion of data. The whole concept is stupid, and it is easily abused.
Want to prevent child porn? Make distribution illegal, not possesion.

Re:5th ammendment

[Ihlosi]

You don't have to be a witness against yourself, but you do have to provide physical evidence.

No. You just have to refrain from resisting the authorities (lawful) attempts of obtaining such evidence.

For example, if a fingerprint or blood was found at the crime scene, you can be compelled to give your fingerprint or blood to test for a match.

No, you can't be compelled to give blood. You can be compelled to refrain from resisting the authorities' attempts to draw blood (or rather: If you resist, you'll be properly restrained first, then your blood will be taken, and then you'll be jailed for resisting). Same thing for fingerprints. If you don't want to get ink on your fingers yourself, the authorities will perform the necessary movements for you.

In the case of an encrypted hard drive, there may be no other way to get the evidence other than the owner decrypting it.

A (written) confession is also physical evidence. Sometimes, there may be no other way to get this evidence than jailing the suspect indefinitely until he produces it. Think about it.

Re:IANAL, but...

[Ihlosi]

wouldt this apply?

If the "obstruction" was already in place before the warrant was served or executed, the person in question had no knowledge of the warrant and cannot obstruct it knowingly. Otherwise, it would be illegal to lock your door when you leave the house (the police may arrive at any time with a search warrant and find you absent and your house locked).

Boogeymen

[fnj]

Whom you would destroy, first dehumanize him by labeling him. It's OK to do anything to him, deny him any rights, if he's not human.

First they come for the suspected terrorists and suspected child pornographers. But it won't stop there.

Re:Boogeymen

[MrKaos]

Whom you would destroy, first dehumanize him by labeling him. It's OK to do anything to him, deny him any rights, if he's not human.

First they come for the suspected terrorists and suspected child pornographers. But it won't stop there.

You judge a society by how it treats it's most despised.

Tell us where the bodies are buried

[crioca]

So what exactly is to stop a court from ordering someone accused of murder to "tell us where the bodies are buried" and when the suspect says "I don't know" locking them up indefinitely?

Re: Surely a fundamental human rights breach?

[BlacKSacrificE]

This counterargument is bad. You need to stop repeating this quote.

The framing of this counterargument accepts the basic premise that the only people who have something to hide are "bad people", and that if you're not a bad person then you won't have anything to hide.

You need to engage with and defeat this presumption that the only people who have something to encrypt are pedophiles.

The best free speech analogy is not this "hurr I have nothing to say" retarded horse shit, but a defense of hate speech on the basis that the sword that defends good free speech (political dissent, etc...) must necessarily defend objectionable speech. This context means that, yeah, pedophiles use encryption, and we object to that, but we can't defend our need to encrypt things we all agree need to be encrypted without also defending pedophiles. And that's a shitty trade-off and we all feel bad about it, but it's not ambiguous or up for debate; there's no way we can evaluate this ethical dilemma and end up putting the prosecution of pedophiles and terrorists ahead of our own encryption needs.

Re:*sigh*

[Anonymous Coward]

I'm sure the prosecution will happily agree to a deal where you give them the password and they agree not to use any evidence found on your drive in copyright-related lawsuits. Your turn.

Scary implications for Cryptolocker victims

[slacklinejoe]

It goes without saying that this would be a truly scary precedent if applied widely. Victims of cryptolocker for instance would have encrypted hard drives and literally have no way of providing the key or passphrase necessary to comply with a court order. Smart bad guys could just as easily borrow malware engines to do this to disguise their behavior, so it would not be easily apparent. My personal opinion is that passwords are firmly 5th amendment protected, I just wish it came up under a more defendable case. The investigators should have done more surveillance or traditional investigations (with warrant) before pulling the trigger on the arrest and could have easily removed the ambiguity from the situation.

Re:Surely a fundamental human rights breach?

[gweihir]

They get around that by claiming this is not punishment. This is just incentive to comply with the court's wishes. Of course, to any sane person, that argument is pure evil in itself and cannot hold water at all.

Re:5th ammendment

[Anonymous Coward]

Personally I don't care about the child pornography pictures and movies. More precisely, to me they're evidence of wrongdoing [...] but they in and of themselves shouldn't be criminal to possess.

The problem with this argument, and the reason it's been deemed illegal, is that if it's legal to possess something, someone will be happy to sell it to you. If there's money to be made with something, people are more likely to do it, even if it's illegal. Legalizing child pornography leads to a greater incentive to create child pornography.

It's basically the same reason it's illegal to hire a hit man.

There is also a secondary reason, and that's that any child in such a situation cannot have legally given consent to be involved. If it's legal to own, then there is no legal recourse someone would have to remove pornographic pictures of themselves from somewhere. For example, how about seeing something like this on store shelves at the local video store with a nice big sign saying "local talent's first film"?

Yeah, they say that.... but then they hold that animated depictions of children in erotic situations are child pornography and are illegal. So even when there is no child involved at all, it is still a crime. This knocks that "for the children" argument off the table, even though pedophiles do some evil and demented stuff to children in order to produce real kiddie porn.

It is illegal primarily because it is icky. And very few people are willing to go to the mat over something as sick as getting off to images of little kids. Heck, I hesitate to even bring up the point because some idiot is bound to think that I'm arguing in favor of kiddie porn. In fact, I'm gonna post anonymous because folks tend to be incapable of actually comprehending a nuanced argument when "for the children" is involved, and I don't need the drama.

We see the same impulse with vaping. Even though e-cigarettes are orders of magnitude more safe than real cigarettes, the anti-tobacco folks are out for blood on vaping - because it reminds them of smoking cigarettes. Even though all evidence suggests that having e-cigarettes available as an alternative to cigarettes will save lives, our governments are moving to eliminate them as an option.

Similarly, from what I've read psychologists think that looking at kiddie porn can be an outlet for pedophiles and might reduce the impulse to actually act out on their fantasy. So if they are right, then animated kiddie porn might be a way to prevent harm to children. Which makes the finding that animated kiddie porn counts as illegal kiddie porn kinda ironic.

Re:Child Porn.... varieties

[phishybongwaters]

I didn't realize this was about the different levels of perversity. I guess I got confused by the fact that it's actually about the court jailing a guy until he de-crypts his harddrive because he MAY have child porn on it. It's not about child porn. It's about building a case against encryption. Terrorism didn't pan out, so they now (as I fully anticipated) fall back to child porn, because who the hell isn't disgusted with that? It's not about the content, it's about convincing Joe Blow and Joe SixPack that encryption is bad because..... kiddie porn.

Re:5th ammendment

[organgtool]

As much as I lack all sympathy for people in possession of child pornography

You might want to be careful about saying that. With all of the vulnerabilities in software these days, it would be relatively easy to have someone take advantage of one of those vulnerabilities to upload some reprehensible images to your computer and leave you with one hot potato on your lap. That's my main problem with any laws of possession: the burden of proof that you willfully obtained the contraband is so low that you're effectively presumed guilty until you prove otherwise.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Reasonable

[s.petry]

I have no idea why people insist on forgetting that part. Lets try an analogy. I invent a cypher and print a code on a paper. The court can grant a warrant to get the paper, but that does not mean they can grant a warrant to get the cypher key from my head. The 4th and 5th amendment are very clear on that. Even though our founding fathers are claimed to have never thought about things, they actually knew damn well about encryption and the need for personal secrecy. What if my encrypted paper contained plans to overthrow the tyrannical King. What if my paper was a personal confession for deeds the Church would frown on, but deeds that are not illegal (like Lust).

People always try to press the system for more, and again this is something the founders KNEW. This is why we have a Constitution which states "reasonable search and seizure", leaving no room to think it's everything someone can possibly conceive of.