Child Porn Suspect Jailed Indefinitely For Refusing To Decrypt Hard Drives (arstechnica.com)

An anonymous reader quotes a report from Ars Technica: A Philadelphia man suspected of possessing child pornography has been in jail for seven months and counting after being found in contempt of a court order demanding that he decrypt two password-protected hard drives. The suspect, a former Philadelphia Police Department sergeant, has not been charged with any child porn crimes. Instead, he remains indefinitely imprisoned in Philadelphia's Federal Detention Center for refusing to unlock two drives encrypted with Apple's FileVault software in a case that once again highlights the extent to which the authorities are going to crack encrypted devices. The man is to remain jailed "until such time that he fully complies" with the decryption order. The government successfully cited a 1789 law known as the All Writs Act to compel (PDF) the suspect to decrypt two hard drives it believes contain child pornography. The All Writs Act was the same law the Justice Department asserted in its legal battle with Apple.

Comments

So forgetting a password

[allo]

May keep you in jail. Forever.

Re:So forgetting a password

[Tukz]

Wasn't there a similar case, albeit with less sinister crimes, a few years ago where they held a guy in contempt for not unlocking something encrypted.

IANAL and all that, but can't they hold someone in contempt indefinitely?

Re:So forgetting a password

[Anonymous Coward]

The sad thing is that they don't have enough evidence to convict him.

The authorities have called two witnesses. One was the suspect's sister who claimed she looked at child pornography with her brother at his house. The other was a forensic examiner who testified that it was his "best guess" that child pornography was on the drives

Meaning that the only thing they have on this guy is an accusation from the sister. The other witness have essentially only said that "Well, it's encrypted, what else could it be?"

This means that if you want to put someone in jail forever all you need to do is to hide an encrypted drive (Or fill it with random noise) in their home and accuse them of keeping child porn on it.
Without being able to produce a decryption key the poor bastard will be kept in custody indefinitely, probably with less access to exercise and books than a convicted pedophile would.

Re:So forgetting a password

[Anonymous Coward]

I totally agree. Without EVIDENCE there is no case here. Just because somebody in power 'thinks' he has committed a crime, without any evidence, there is no reason to keep him in prison, and just as you say, you just have to hide an encrypted drive in somebody's house and accuse them of owning child pornography, and they can be kept in prison indefinitely, for having done nothing!

Re:So forgetting a password

[jordanjay29]

Then you could probably be charged with obstruction of justice.

Re:So forgetting a password

[terminal.dk]

No. If he has forgotten the password, then he does whatever is possible for him to help execute the search warrant - when he comes up with wrong guesses he is no longer in contempt and can walk freely.

The only defense here is to claim the password is forgotten, and give some wrong guesses to th police, then he can walk free. For many people, the password is not remembered, I certainly do not remember all my passwords. But they are remembered in the fingers. I can type them even if I can not write them down or tell them to others. After some time, this finger memory weakens. The court should accept that.

Re:So forgetting a password

[ShanghaiBill]

I totally agree. Without EVIDENCE there is no case here.

There is evidence. Certainly not enough to convict, but enough to get a warrant to search for additional evidence. The key question is whether he can be compelled to assist in that search. The Supreme Court has ruled that a suspect cannot be compelled to provide the combination to a lock, so I don't see how this is significantly different.

Re:So forgetting a password

[jordanjay29]

Take the Enron scandal. The man in charge of the firm responsible for the accounting knew investigators were coming and that documents he had would incriminate him. He had them destroyed. There were witnesses that could attest to the destruction of documents that would have otherwise incriminated him. He was charged with obstruction of justice.

Same idea here. The only way your idea could work is if you, without witnesses, managed to destroy the documents entirely (magnetic wipe the drives, perhaps?) before investigators came to take possession of them. If no one can prove you had the documents through other means (your network activity, logs on your computer, etc) then you stand a better chance of prosecutors lacking evidence to convict.

Re:So forgetting a password

[newbie_fantod]

there is incontrovertible evidence that he is refusing to comply with a court order, that is why he is being held.

Re:So forgetting a password

[Maritz]

It's different because terrrrristchildrens.

Re:So forgetting a password

[Maritz]

Take the Enron scandal. The man in charge of the firm responsible for the accounting knew investigators were coming and that documents he had would incriminate him.

Sounds different to something that destroys itself after X time unless rearmed. If it's going to destroy itself irrespective of anyone investigating, then it's not specifically to thwart any specific investigation, is it?

Re:So forgetting a password

[TFAFalcon]

Well that solves the whole problem of 'lack of evidence'. The court can just order each defendant to produce the evidence to convict them. If they don't, then jail them until they do.

Re:So forgetting a password

[Harlequin80]

Who knows. Maybe there is a full on conspiracy here and there isn't child porn on there but state secrets of his true employer, Mossad. Or it could be KFC's secret herbs and spices recipe. Or it could be child porn. Or he could be an officer of the law who is standing on principle and saying fuck off you're not allowed to do this.

Frankly we don't know.

Re:So forgetting a password

[viperidaenz]

If a device in the possession of the investigators destroys itself because something was not done to prevent it, who's fault is it?

You're expected to not destroy evidence, but since when are you expected to preserve it?

Re:So forgetting a password

[fey000]

Or we can throw them in the ocean to see if they float or drown.

Re:So forgetting a password

[mysidia]

IANAL and all that, but can't they hold someone in contempt indefinitely?

It is only legal to hold them in contempt if they ARE capable of complying with the order.

At such time as the person is physically or mentally incapable of complying with the order, for example, they don't have the information required, or it is not possible for them to perform as requested, they cannot be held in contempt.

Re:So forgetting a password

[AK Marc]

It's called a subpoena, and it's done all the time.

Re:So forgetting a password

[AK Marc]

The investigators know that trick. It's older than you.

Re:So forgetting a password

[Richard_at_work]

A judge is also required to take into account the probability that further incarceration is likely to be conducive to the goal - holding someone in contempt of court is not a punitive measure, its a conducive measure, so if its unlikely to achieve the goal required then a judge is not supposed to continue holding someone in contempt.

Re:So forgetting a password

[wbr1]

So having authorities request a password you never had or knew, because you pissed them off, can keep you in jail forever.

Just pointing out how this can be used as a weapon against anyone, anytime.

Re:So forgetting a password

[NotInHere]

If they drown we know they were innocent. How sad they drowned!

Re:So forgetting a password

[Anonymous Coward]

There is a pretty wide array of information that is legal to have that you might not want authorities to look at.
I don't know about the laws in Philadelphia but where I live there are political information (Like political party member lists.) that the court can't look at. In fact, it is illegal for law enforcement to look at it. It is also illegal for law enforcement to ask a journalist who their sources are. (To protect whistle-blowers.)
Those laws were put in place to protect the democratic system and make sure that if a corrupt/fascist political party gets power there will be some inertia that makes it possible to fight them without having to resort to violence directly.

Philadelphia probably doesn't have this kind of protection but if they had the man could just claim that the drives contains political information. Then the court would need some more evidence than just "the drive is encrypted, therefore it has to be something illegal on it".

Re:So forgetting a password

[houghi]

Throw them in the water. If they are innocent, they will sink. If they are guilty, they will float.
Worked in the past, so I see no reason why it won't work here.

Re:So forgetting a password

[ole_timer]

under the 5th amendment he can't be compelled to "utter" the passphrase, but he can be compelled to provide the unencrypted contents in most jurisdictions.

Re:So forgetting a password

[msauve]

I find that court contemptible, and won't change my mind.

Re:So forgetting a password

[AmiMoJo]

So did this guy just neglect to say that he forgot? How would they prove he hadn't?

Re:So forgetting a password

[JoeMerchant]

How do you determine if someone actually remembers a password or not?

I certainly have forgotten passwords to systems I left on the shelf for 7 months or more.

Re:So forgetting a password

[cdrudge]

It's what God wanted.

Re:So forgetting a password

[wisnoskij]

So basically they can only hold him until he forgets the password

Re:So forgetting a password

[gweihir]

It is only legal to hold them in contempt if they ARE capable of complying with the order.

Which happens to be impossible to prove due to fundamental restrictions of how reality works. Hence the government just assumes they are capable and you need to prove they are incapable. Which you cannot do, due to fundamental restrictions of how reality works.

And there your argument goes out the window completely.

Re:So forgetting a password

[gweihir]

And in other news, if the judge just says "screw him" then the person is screwed. And nothing is ever going to happen to the judge for that evil act.

Re:So forgetting a password

[gweihir]

This interpretation is just fundamentally evil as it negates the intended protection for the accused. But what do you expect in a police-state.

Re:So forgetting a password

[gweihir]

No, there is not. There cannot be. It is impossible to prove he is able to decrypt those drives unless he demonstrates that he can. Anything else is called "speculation", not "incontrovertible evidence". Get your terminology straight.

Re: So forgetting a password

[Anonymous Coward]

Alleged...

As someone who had to assist in a NCIS hunt for child porn on a subordinates computer who of course had none but all it takes is an accusation, I dont trust searches like this.

Not to mention that information would fall directly into the Fifth Amendment as that information would be providing witness against yourself.

If they need that one HD in order to nail this guy then they don't have enough evidence... Should have tried harder. They didn't build a solid enough case with enough evidence before pulling the trigger.

Re:So forgetting a password

[phishybongwaters]

You don't think this is actually about child porn, do you? You can't be that thick, can you? You must understand, even at a very basic level, that kiddie porn has been, and always will be, a lynch pin in the restrictions of your rights and freedoms. We must outlaw encryption because.... TERRORISM! But... the terrorists didn't use encryption. KIDDIE PORN! EVERYONE HATES THAT! I've called this so many times. In fact, if you go through my post history you should find some posts on the Apple case with the FBI, where I literally said this exact this is going to happen (unless I posted as AC, depends on the computer i'm at). They've used this to fight piracy and boost copyright laws. They've used it to completely destroy usenet. And they are using it now to destroy encryption. And the best part of all of this? The NSA and any law enforcement agency that bothers to ask, already likely has access to the network these images came from. This isn't about stopping child porn, and it's not about protecting kids and putting pedophiles in jail. It's about outlawing, or neutering, encryption because it takes slightly more effort to spy on you if you use encryption. It has never been about child porn. Ever

Re:So forgetting a password

[Mr D from 63]

There is other evidence from the investigation which started from his on-line activity. That, combined with testimony from a witness, combined with a forensic analysis of the use of the computer and disks seems pretty convincing, albeit circumstantial aside from the testimony. There certainly is evidence. I don't think they can hold this guy forever on that evidence, but probably for a good long while.

Re:So forgetting a password

[Anonymous Coward]

If there is kiddie porn on those drives, then he's actually making the smart move. Either way, he's fucked. But at least this way, the state has to pay for his room and board. If he turned over his passwords, conversely, he would get several years in prison anyway but then also be thrown out at the end on the sex offender registry, pretty much guaranteeing that he will never be able to get a job or place to live ever again. As long as they hold him in jail, he at least has food and a place to live and there remains a chance that he may make it out of this without being on the sex offender registry.

If he takes the kiddie porn charge, it's almost as bad as a death sentence. His life will be destroyed and there will be no options to even survive.

Re:So forgetting a password

[Harlequin80]

But that doesn't make it ok to lock him up indefinitely. They can't prove their case. That is the end of it. Charge him with refusing to obey a court order, and find him guilty of that. If that means he goes away for 2 years, then fine. But you can't imprison someone without a conviction. That is wrong.

Re: So forgetting a password

[Mr D from 63]

But it was more than just an accusation. The way I read it, they were monitoring a known child porn site online and seeing who was accessing it. They traced one of the accesses to this guy. They talked to people and his sister confirmed she'd seen child porn. They then seized his computer and forensically analyzed it.

Now, what we don't know is what that analysis found. They 'may' have seen that those disks were used at the same time as the accessed the child porn site, and 'may' had other evidence on his computer that showed he likely downloaded. If so, that would all be pretty compelling evidence as a whole.

Re:So forgetting a password

[houstonbofh]

You don't think this is actually about child porn, do you? You can't be that thick, can you? You must understand, even at a very basic level, that kiddie porn has been, and always will be, a lynch pin in the restrictions of your rights and freedoms. We must outlaw encryption because.... TERRORISM! But... the terrorists didn't use encryption. KIDDIE PORN! EVERYONE HATES THAT! I've called this so many times. In fact, if you go through my post history you should find some posts on the Apple case with the FBI, where I literally said this exact this is going to happen (unless I posted as AC, depends on the computer i'm at). They've used this to fight piracy and boost copyright laws. They've used it to completely destroy usenet. And they are using it now to destroy encryption. And the best part of all of this? The NSA and any law enforcement agency that bothers to ask, already likely has access to the network these images came from. This isn't about stopping child porn, and it's not about protecting kids and putting pedophiles in jail. It's about outlawing, or neutering, encryption because it takes slightly more effort to spy on you if you use encryption. It has never been about child porn. Ever

And not moderated +5 Insightful or Informative yet? Must be early...

Re: So forgetting a password

[Ihlosi]

They then seized his computer and forensically analyzed it.

Well, maybe they should have anticipated encryption and devised a way to obtain the encryption keys (surveillance, keylogger, whatever).

Re:So forgetting a password

[Ihlosi]

This is significantly different because a lock can be cut open,

You can devise a locking mechanism that cannot be opened by force without destroying whatever the lock is supposed to protect.

What would you suppose the court should do if it has seized documents as evidence, but they're all written in a fantasy language that only the defendant uses? "Please Mr. Defendant, translate this for the court."?

Re:So forgetting a password

[Mr D from 63]

Child porn has been aggressively prosecuted long before online trafficking and encryption became and issue. But hey, never miss a chance to deflect. There is a battle over encryption, but that does not mean everything it touches becomes ONLY about the encryption.

Re:So forgetting a password

[SecurityGuy]

Agreed, this is appalling. I have two encrypted databases on my phone. Why two? Because I forgot the password to the first one and had to start over. No power in the world can compel me to unlock that first one. Believe me, I tried.

The notion that I could be put in jail forever because I legitimately don't remember a password is insane.

Re: So forgetting a password

[Anonymous Coward]

Well, were I live, the police gets that warrant for any flimsy reason they can dream up.

Re: So forgetting a password

[ooloorie]

Now, what we don't know is what that analysis found. They 'may' have seen that those disks were used at the same time as the accessed the child porn site, and 'may' had other evidence on his computer that showed he likely downloaded. If so, that would all be pretty compelling evidence as a whole.

Then they don't need to force him to decrypt his hard drives, do they?

And make no mistake: while this sort of thing starts with the lest likable characters, it will eventually be used against anybody from Snowden to your grandmother to go on legal fishing expeditions against anybody that police, prosecutors, or the executive branch doesn't like.

Re:So forgetting a password

[organgtool]

Oh, so he'll only be in jail until he develops Alzheimer's.

Re: So forgetting a password

[Applehu Akbar]

"Not to mention that information would fall directly into the Fifth Amendment as that information would be providing witness against yourself."

Would any of our lawyers care to explain how the All Write Act takes precedence over the Fifth Amendment in this case?

Re:So forgetting a password

[nospam007]

"This is significantly different because a lock can be cut open, while the encryption can't."

Sure they can beat the encryption, they just might need a couple of hundred years to do it.

Re:So forgetting a password

[Immerman]

What makes you think they have too? He's not being detained as punishment for a crime - that would require proof. He's being detained for contempt of court, in order to attempt to coerce him to do something they assume he can. This is the kinder, gentler version of "rubber hose decryption", and there's far more leeway for that.

Besides, being able to access encrypted files on your computer is a pretty safe bet, especially if the timestamp indicates they've been accessed recently. Unless someone else put them there, the only really plausible way to claim otherwise is if it requires a keyfile that you were able to destroy in the presumably brief window between having the cops show up and being detained.

Re:So forgetting a password

[ole_timer]

nonetheless it is what it is.

Re:So forgetting a password

[ooloorie]

So what you're saying is:

"You can't incriminate yourself. But please sign this confession now, or be held in contempt of court! After all, signing something isn't technically self incrimination."

Re:So forgetting a password

[BonThomme]

...and yet Hastert only gets 15 months.

Re:So forgetting a password

[Agripa]

Generate and store your encryption key using the serial numbers from a set of ordered bills. It is not your fault that the police stole the 100s.

Alternatively use a multi-volume set of books. What do you mean volume 6 is missing?

Re:So forgetting a password

[Roger W Moore]

Which happens to be impossible to prove due to fundamental restrictions of how reality works.

Since when has being consistent with reality ever concerned the law?

Re:So forgetting a password

[MightyMartian]

The judge believes (and there's no reason not to agree with the reasoning that I can see) that the accused is quite capable of decrypting the data, and the man is thus defying a court order, and is in contempt. That's how the system is supposed to work. Are you saying courts shouldn't have the power to compel the production of evidence?

Re:So forgetting a password

[Jason Levine]

And meanwhile not only is he being stuck in jail until he incriminates himself but any leak of his name (it looks like he hasn't been named yet) will lead to him being tarred and feathered even without a trial. All because one person says they saw bad stuff on his computer.

Yes, this stuff is bad but we can't let it become a root password to bypass our rights.

Re:So forgetting a password

[ole_timer]

no, it's narrower than that. under our system you can't utter or sign. but you have to give the other side (in this case the gov't) the unencrypted data.

Re:So forgetting a password

[Jason Levine]

Along those lines - and since I don't know everything about encryption - I wonder if it's possible to have an encrypted area that decrypts to your data if you enter one password and decrypts to an innocent looking set of data if you enter a second password. So the police arrest you and tell you to decrypt your drive. You type in "12345" and show them an innocent looking web browsing history and a boring set of family photos. You get home, type in your real password, and all your actual data gets displayed.

Would such a system be possible? Would it give any indications of having a second hidden layer?

Re:So forgetting a password

[NatasRevol]

Per the 5th amendment, yes?

Re: So forgetting a password

[Mr D from 63]

Yes, if the actual files are on the hard drive, they are the core evidence.

Re:So forgetting a password

[kilfarsnar]

This is significantly different because a lock can be cut open, while the encryption can't. Next stupid rhetorical device please.

So, we only have rights if the authorities can get what they want without violating them?

Re:So forgetting a password

[hairyfeet]

Except that means exactly jack and shit thanks to trolls, there is even an article on Wikileaks called "confessions of a child pornographer" where he brags about using viruses to infect random guys that go to one of his legit porn sites and filling their PCs with CP and having them connect to known FBI honeypots because he thinks its funny to have the cops chasing their tails and figures the more time they waste going after his fakes the less time they have to go after his legitimate customers.

According to my buddy at the state crime lab the whole charade is just that, a bullshit waste of time, which is why he is trying to get transferred out. He says he can't even remember the last time they actually caught a predator online (those they catch when someone the scumbag molests comes forward) but instead all they ever catch is porn addicts which could easily be treated with a little therapy but instead they have to pretend they are dangerous because...well the prosecutor wants to get a shot at congress or the governors chair in a couple years.

So hundreds of millions are spent, the actual predators get to sit back and laugh about it because they keep their stash on an encrypted server in bumfuckistan and just access it via VPN, and you get to pay millions to keep some losers that haven't left their basements in years in solitary because they couldn't get it up anymore after watching a billion hours of porn without watching the sickest shit they could find, but hey, the prosecutor can say he's "tough on crime" and will get that shot at the big chair where he can clean up off the backroom deals....welcome to reality where its ALL politics..and then folks wonder why guys who take the job spend all of 6 months and then start looking for the exit.

Re:So forgetting a password

[ooloorie]

no, it's narrower than that. under our system you can't utter or sign. but you have to give the other side (in this case the gov't) the unencrypted data.

Your idea that this is a settled question only shows that you are utterly ignorant of how "our system" works.

In our system, the meaning of the Constitution is interpreted by the courts, and their interpretation has changed significantly over the years. Whether anybody is obligated to decrypt their own data for the government or not still is an open question, to be decided probably by lots of court cases and legislation.

Re:So forgetting a password

[adamstew]

If he's using a proper True Crypt volume, encrypted with AES-256, you're off by about 50 orders of magnitude. AES-256 will survive brute-force attacks until pretty much the heat death of the universe.

Re:So forgetting a password

[Agripa]

and if he is actually innocent of possession of child porn, he can get full exoneration by cooperating.

You're kidding, right?

Nothing will ever exonerate him even though he has not even been charged yet.

Re:So forgetting a password

[Mr D from 63]

That is a perfectly good point regarding the problematic nature of the pursuit, and I don't necessarily disagree, but it is not relevant in legal terms regarding sufficient evidence.

Re:So forgetting a password

[rossdee]

Or just weigh him. If he weighs the same as a duck he's made of wood, and therefore a witch

Re:So forgetting a password

[fustakrakich]

It's not about child or encryption. It's about compelling the assistance in one's own prosecution. Unfortunately I'm one of those in the tiny minority that believes it should never be allowed. I'm hoping the guy holds out for what it's worth. Maybe it's better for him to remain a suspected 'child porn suspect'.

I'm half way expecting a constitutional convention to come up within a couple of years. We can kiss the bill of rights and other civil rights goodbye when it happens. The general attitude has turned against them.

Re:So forgetting a password

[sjames]

Or he said he forgot and since they don't choose to believe that, they interpret it as refusal.

Re:So forgetting a password

[ole_timer]

you misunderstand me completely. I did not say I agreed with that, only that was how it was today. that's why he's in jail. instead of arguing with me you should vote for members who will change the laws. I likely have way more court experience then you'll ever have.

Re: So forgetting a password

[ComputerGeek01]

Well, maybe they should have anticipated encryption and devised a way to obtain the encryption keys (surveillance, keylogger, whatever).

That would require a warrant (because this isn't a three letter agency prosecuting the defendant). At the point that you have enough evidence for a warrant, you would have enough for a conviction so the only reason for going through that much trouble would be if the case was part of a larger operation which it doesn't appear to be. You're right though, one way or another they didn't have enough evidence to move on an arrest and they should have put more work into it. This case is a perfect example of what I've been saying about the American judicial system for years; our system works fairly well for its size, the trouble is that the people in charge of it right now are complete screw ups who think that they can half ass a case like this and get away with it. You can't be in contempt of court unless you're already in court to begin with, and the article says that the defendant (or victim at this point) was never formally charged with anything. So the most they could hit this guy with would be interfering with a judicial proceedings (even that would be a stretch) which doesn't carry the same potentially indefinite penalty. They clearly went this route so that they could circumvent the need for a jury and should be prosecuted for that.

Re:So forgetting a password

[NatasRevol]

Except that subpoenas don't apply to defendants.

https://www.avvo.com/legal-ans...

Only to third party/witnesses

Re:So forgetting a password

[Mattcelt]

That's actually precisely what the fifth amendment is about - that the courts do not (and should not!) have the power to compel the accused to produce evidence that would be incriminating or harmful to themselves or their case.

This is fairly clearly an abuse of judicial power. Abstracting the incrimination one level does not suddenly make it acceptable.

Re:So forgetting a password

[mysidia]

Which happens to be impossible to prove due to fundamental restrictions of how reality works. Hence the government just assumes they are capable

The government is not allowed to assume that you are guilty. It does not matter how inconvenient this requirement becomes due to how reality works.

The law requires the government to show you are guilty beyond a reasonable doubt, otherwise the legal principles at the basis of our rule of law say that you must be presumed innocent, in that case you should be released.

If the suspect has forgotten the password, and reports to have forgotten or never knew the password and has no access to the password, then I do not believe there is any legal basis for holding them in contempt beyond that point.

Only way they could is they have definitive proof that someone has access to the password, and it's being withheld under the control of the suspect.

Re:So forgetting a password

[jbmartin6]

The SC has never RULED this. It was mentioned in a different case. However, there is clear precedent in the US in the case law regarding combination safes. The defendant can be compelled to open/unlock in cases where there is clear evidence that relevant items are held by the lock. e.g. if the guy wrote in an email "I keep all that illegal porn on this encrypted volume". One cannot be compelled for a fishing expedition or under the rubric of a more general search warrant. I would guess from the invocation of All Writs that this isn't what happened in the case at hand. Or perhaps as others say it is an attempt to leverage All Writs for a wider precedent. I didn't read the case details, though.

Re: So forgetting a password

[Anonymous Coward]

At the point that you have enough evidence for a warrant, you would have enough for a conviction

You fucking retarded? You need probably cause for a warrant. You need proof beyond a reasonable doubt for a conviction.

I want two of whatever you're on.

Re:So forgetting a password

[Anonymous Coward]

Posting anon as I've already modded, but this is the idea behind the TrueCrypt (and now VeraCrypt, CipherShed, and other forks) hidden-container feature. You create nested containers, as many levels deep as you want, and the passphrase to each one opens only it and those outside it. Everything deeper is undetectable, to the point where it is possible to destroy/corrupt the data if you're not careful (operating on the premise that you'd rather permanently lose whatever is stored in the deeper containers than have it revealed to an adversary).

Re:So forgetting a password

[sjames]

If you simply forgot the key, the prosecution would be hard pressed to find a telepath that could see that you still remember.

The fundamental problem they're having is that they really have only suspicion, not evidence.

Re:So forgetting a password

[gurps_npc]

We are saying that the power to compel to produce requires proof that the evidence exists.

Say you are a prosecutor. You have a picture of the defendant holding a bloody knife. You ask for and get a court order requiring the defendant to produce that knife.

Should that defendant be jailed for producing a slab of melted steel that they claim is the knife?

Of course not. He produced what he could. They demanded he produce the hard drive. He did. He can't be required to produce the password, as he can easily claim that he has forgotten it.

The only way the judge can charge or hold him if the judge can prove that he has not forgotten the password. Not "thinks he hasn't forgotten it', prove he hasn't forgotten it. Yes, that's impossible to do. Which is why the Judge should not be able to give this order.

Re:So forgetting a password

[Cytotoxic]

...and yet Hastert only gets 15 months.

This is actually very relevant to this case.

Hastert got 15 months. For withdrawing less than $10k from his bank account several times. Literally. That is the crime he was convicted of. It is illegal to move less than the reportable amount of money ($10k) in order to avoid having it reported. It is called structuring. Could be the most ridiculous, made-up crime of all time. And for this made-up crime the prosecutor said he should get 0-6 months.

But because he was also a dirty molester and they couldn't convict him on that, they said they should make an example of him to deter other molesters so they would know that they couldn't get away with it. Literally. This is what both the prosecutor and the judge said.

So not that he doesn't deserve worse - but there is something fundamentally wrong with the notion of punishing people for crimes they have not been convicted of or even charged with. "Everybody" knows this cop is a dirty child-porn watching creep. So let him rot in jail. Hastert admitted that he did something wrong with some high school boys, but we can't get him because of the statute of limitations. So find something else and push his punishment beyond the guidelines. (they also tacked on a $250k payment to a victim reimbursement fund and mandatory sex-abuse counseling - things he was not charged with)

In the immortal words of Clint Eastwood, "Deserve's got nothin' to do with it." Either we are a nation of laws, or we aren't. And letting the gross and creepy edge cases define our law is not the way to be a nation of laws.

Re: So forgetting a password

[Cederic]

the end result of this is the same, a pervert sits behind bars

Fuck you and your evidence free condemnation of someone.

If he's committed a crime, prove it, provide the evidence, and a court will convict him and apply appropriate measures in response.

In the meantime an innocent person - pervert or otherwise - is in prison. Since you're also a pervert*, perhaps we should ask for you to be locked up indefinitely too?

*based on the simple refrain: I'm kinky, you're a pervert

Re:So forgetting a password

[whoever57]

Let's assume that a man is accused of killing someone and hiding the body. Can he be held indefinitely until he reveals the location of the body?

Re:So forgetting a password

[Kjella]

The investigators know that trick. It's older than you.

Still in this case it would be perfectly sufficient. If he had a device that would wipe the key after X days of not logging in, which would prominently declare that the contents have been wiped, he could no longer be held indefinitly in contempt. They'd have to either let him go or charge him with obstruction of justice.

Re:So forgetting a password

[bigpat]

under the 5th amendment he can't be compelled to "utter" the passphrase, but he can be compelled to provide the unencrypted contents in most jurisdictions.

Right, so he shouldn't be forced to provide a password, but can be forced to provide the entirety of contents of the computer by logging into the computer himself and allowing the police access. I think it depends on how the warrant is worded, but that is the law. He clearly can't be compelled to provide the password because that is knowledge stored in his brain.

If they are worried about him entering the wrong password on purpose or otherwise pressing some combination of keys that would destroy evidence, then that would elicit a different charge based on the evidence collected when he logged into the computer.

Seems pretty clear situation in that they can hold him for some reasonable period of time, but at some point they will have to let him go if it becomes clear that he isn't going to provide them access to the computer.

Re: So forgetting a password

[drinkypoo]

And, quite frankly, the end result of this is the same, a pervert sits behind bars.

Careful with that 'pervert' brush. It is frequently applied to everything from pedophiles to people who have a fetish... which is damned near everyone. The most common fetishes in America (last I checked) were stockings, pantyhose, and feet, approximately in that order. I don't see many stockings any more, so pantyhose are probably creeping up. Heh.

The point of this story is that even if you like it being done to this guy, it can happen to you next.

Re:So forgetting a password

[Cederic]

Not in the UK. Here the police merely have to believe that a file is encrypted to demand the ability to access it.

If it's an unencrypted binary file format, random noise on the hard disk or evidence of a nuclear terror plot targeting the pope is completely irrelevant. Under the law you could be imprisoned for failing to decrypt your Linux swap file.

I'm not defending this. I wrote to my MP decrying the stupidity of the law when it was being proposed, but he's a fuckwit and the fascist Home Secretary was quite blase about being able to lock up innocent people with no evidence. Such is the sad state of the UK these days.

Re:So forgetting a password

[EricTDuckman1414]

I totally agree. Without EVIDENCE there is no case here.

There is evidence. Certainly not enough to convict, but enough to get a warrant to search for additional evidence. The key question is whether he can be compelled to assist in that search. The Supreme Court has ruled that a suspect cannot be compelled to provide the combination to a lock, so I don't see how this is significantly different.

If you are talking about this case, I believe that it is considered to be a "dicta" and is not considered to be binding law. http://blogs.denverpost.com/cr...

Re: So forgetting a password

[operagost]

Where did you get that data? Rule34.com?

Disclaimer: I declined to punch that address into my browser. Browse at your own risk.

Re:So forgetting a password

[operagost]

What a nonsensical claim. The point of the 5th amendment is to not testify against oneself. The evidence, whether locked in a safe or an encrypted drive, is the "utterance" being protected-- not some disposable tool like a key, combination, or password.

I don't see how this is any different from being the accused in a murder case, and being thrown in a cell until you lead them to where the murder weapon or body is hidden. After all, they didn't make you "utter" the location.

Re:So forgetting a password

[EricTDuckman1414]

Refusing to answer a question can't be used as evidence of guilt if you have been Mirandized and choose to remain silent.

Re: So forgetting a password

[drinkypoo]

Where did you get that data? Rule34.com?

Nah, the oft-quoted Kinsey report. Somewhat outdated, oft-debated, but still the best source around.

Re:So forgetting a password

[ole_timer]

in the same way the accuser (in this case the gov't) has to give the accused all that they have against him. that's the way our system works. two-way. in some jurisdictions an officer has to see the offending material that is subsequently encrypted in order to show probable cause. I did not read the whole case to see what they are using as probable cause.

Re: So forgetting a password

[ooloorie]

Unless you are an omniscient deity, the disk is indistinguishable from one with random bits. So there are no "actual files" on the disk until it gets decrypted. Furthermore, there is a pretty clear line between searching someone's possessions (legal with a court order) and forcing them to assist in their own conviction by producing evidence (unconstitutional). This falls under the latter category.

Re:So forgetting a password

[ole_timer]

a judge said that, not me. I had a lawyer student do the survey of cases. it varies by jurisdiction. it's unsettled law at best. liberal judges who don't know about yes and no, only shades of gray when it comes to technology.

Re:So forgetting a password

[Sarten-X]

No.

The definition of the word "produce" is important. If the evidence already exists (as encrypted data on the hard drive), then the court can compel someone to produce (deliver) it to the investigators.

The 5th Amendment protection is to intended to prevent the court from forcing confessions. To that effect, the court is not allowed to compel a defendant to produce (create) evidence against themselves that did not already exist.

As an analogy, the court cannot compel you to write a confession. If you already wrote one and put it in a safe, they can compel you to give them the combination to the safe.

Re:So forgetting a password

[alexgieg]

TrueCrypt and its descendants work like that. You can have a main encrypted OS for your usual stuff, and a second encrypted OS for your actually secure stuff. And it's impossible to tell whether a hard drive has one or two OSes installed. In fact, they overlap, so if you want to avoid accidentally overriding one or the other you must provide the system both password so that it know which parts of the hard disk to avoid. Therefore, by providing only the main password you also help the possibility of the other one being overridden by anyone carelessly using it (won't work with forensics though -- they only access a drive in read-only mode).

Additionally, TrueCrypt etc. allow one to have containers, virtual hard disks files one can mount at will and store content within. The files within a container have time stamps and such, but TrueCrypt avoids updating the time stamps of the container itself, therefore no one can know when you last opened or modified it. Also, it's impossible to know whether a file is a container or not, there's no identifying anything in them, it just appears to be random noise.

"A 2.5 GB file in C:\Lost+Found called "$0001.DAT" dated February 15th, 2013? No idea what it might be, sir. Maybe a left over from when I sent my computer to the repair shop back then?"

Re:So forgetting a password

[magical liopleurodon]

How convenient. The meaning of the law is inconvenient -- oh hey, I know! -- lets "interpret" it to mean something else. Yeah, that's not tyrannical or anything

Re:So forgetting a password

[msauve]

Courts do not have the power to compel a person to provide evidence against themselves,which is not specifically known to exist. Read the 5th Amendment, then read United States v. Hubbell. The prosecution is fishing.

Re:So forgetting a password

[msauve]

" If the evidence already exists (as encrypted data on the hard drive)"

Ah, but it's NOT known to exist. The prosecution only suspects there's evidence on the hard drive, and they're fishing.

Re:So forgetting a password

[mattventura]

I think the best way to make that work would be to have the device only store data in volatile RAM, and have it powered by a (low-leak) capacitor. A code could be entered every so often that would recharge the capacitor from a battery. It could implement a temperature sensor to prevent freezing, and some kind of tamper-proofing for the casing like the Harvey's bomb.

Re: So forgetting a password

[Holi]

Well, they obviously have a warrant which he is refusing to comply with, which is why he is being held in contempt.

Re: So forgetting a password

[Holi]

Hardly, they have strong evidence that his computer contains evidence (testimony from suspects sister). The 4th amendment protects you from illegal searches, but the authorities have a warrant so there is nothing illegal about this search. The suspect is actually committing a crime called obstruction of justice by not complying.

Re: So forgetting a password

[INT_QRK]

While hard to be sympathetic given the nature of the accusation, we do need to seriously guard against a slippery slope of presuming guilt based on the mere existence of encrypted storage, or worse yet, allowing precedent for encrypted data itself evoking "probable cause" for legal search.

Re:So forgetting a password

[JustAnotherOldGuy]

It is only legal to hold them in contempt if they ARE capable of complying with the order.

This is the perfect way for the government to incarcerate anyone they want for as long as they want. Drop a hard drive in your home, and voila, instant incarceration.

Prosecutor: "Oh my, we suspect you of having child porn on this hard drive. Unlock it or go to jail."
You: "That's not my hard drive."
Prosecutor: "What part of, 'go to jail' seemed unclear?"
You: "I can't unlock it, that's not my hard drive."
Prosecutor: "See you in 5 or 10 years."

Re:So forgetting a password

[JustAnotherOldGuy]

As an analogy, the court cannot compel you to write a confession. If you already wrote one and put it in a safe, they can compel you to give them the combination to the safe.

Yes, but not if they only suspect that there might be a confession in the safe. Otherwise it's a fishing expedition and that's not allowed.

If this was permitted then cops would be able to pick any house at random and search it for whatever they suspect might be in there.

Re:So forgetting a password

[JustAnotherOldGuy]

Let's assume that a man is accused of killing someone and hiding the body. Can he be held indefinitely until he reveals the location of the body?

In a word, "No".

(Although the police and prosecutors would love a law that allowed them to do that.)

Re:So forgetting a password

[russotto]

If you already wrote one and put it in a safe, they can compel you to give them the combination to the safe.

No, they can't, if the combination is only in your mind. They can compel you to give them the safe and they can crack it, but they can't force you to give them the combination.

Re:So forgetting a password

[Solandri]

No, the intended purpose of the 5th Amendment is to prohibit use of a refusal to testify as evidence of guilt. In the bad old days, a ruler or government would put you on trial and tell you to confess. And if you refused, your refusal was accepted as evidence of your guilt, thus creating a catch-22. The 5th Amendment's protection against being forced to testify against yourself put a cold stop to that.

If the court has reason to believe someone is hiding evidence, the State compelling him to give it up is not prohibited by the 5th Amendment. e.g. If the State is reasonably sure a guy killed his wife (blood all over the house, bloody knife with his fingerprints all over it, bloody drag marks to the garage, and blood in the trunk), they can press him to reveal where he dumped the body. The 5th Amendment does not protect him from that. All it does is prohibit using his refusal to cooperate as evidence of his guilt.

If there's a transgression here, it would be the 6th Amendment - right to a speedy trial. This is actually a hole in our legal system. While you cannot be held indefinitely if the police (executive branch) does not press charges, you can be held indefinitely if the court (judicial branch) gives you an order and you refuse to obey it (contempt of court - no trial needed). About a decade ago there was some journalist who spent 2 years in jail because a court ordered him to reveal his source for a story, and he refused.

Re: So forgetting a password

[suutar]

If they have enough evidence to seize the computer they have enough evidence to get a warrant to subvert the computer.

Re:So forgetting a password

[ultranova]

If this was permitted then cops would be able to pick any house at random and search it for whatever they suspect might be in there.

Isn't that the whole premise behind SWATting?

Re: So forgetting a password

[JustAnotherOldGuy]

And, quite frankly, the end result of this is the same, a pervert sits behind bars.

This would be funny if it weren't so blindingly stupid.

So you know for a fact that this guy is guilty? Why not share your insight with us or the prosecutor?

What will your excuse be should you ever get caught between the gears of this kind of legal abuse? Something along the lines of, "but nothing's been proved, you can't lock me up for suspicion"?

Re: So forgetting a password

[Cederic]

If this guy is innocent then he can work with them to show he is innocent. Let the Project see the evidence.

Ok, so lets lock you up. I'll draw up a list of crimes you may or may not have done and we'll keep you in prison until you've worked with the Innocent Project to prove your innocence on all of them.

Shouldn't take too long, I'll keep the list down to a couple of thousand different offences.

That said, if YOU were accused of having child porn I tend to think you would do everything in your power to show that wasn't the case. If you don't want child porn, think murder, rape or embezzlement.

That has nothing to do with whether I'm innocent though, and certainly nothing to do with whether it's appropriate to imprison me with no evidence.

Re:So forgetting a password

[Anonymous Coward]

“The state must declare the child to be the most precious treasure of the people. As long as the government is perceived as working for the benefit of the children, the people will happily endure almost any curtailment of liberty and almost any deprivation.”

--Adolf Hitler, Mein Kampf

Re:So forgetting a password

[ooloorie]

How convenient. The meaning of the law is inconvenient

Under an original reading of the Constitution, it's questionable whether there would even be a case, since the Constitution does not grant the necessary powers to the federal government.

I'm simply pointing out that even under the malleable reading of the Constitution that we have these days, it is far from a settled matter whether courts can compel you to give up a password.

oh hey, I know! -- lets "interpret" it to mean something else. Yeah, that's not tyrannical or anything

Historically, the widespread use of case law and an independent judiciary have actually been forces counteracting tyranny. So, indeed, it's decidedly "not tyrannical or anything".

Re:So forgetting a password

[TheGratefulNet]

so, people are supposed to do anything the state says, even when it comes to incriminating themselves? isn't there supposed to be a right to NOT incriminate yourself, directly?

the state can do all it wants to get its data; but they never have the right to FORCE the defendant to provide data that will hang himself.

I don't understand this, I guess.

but I do understand the state being LIKE a child in that it WANTS and knows it WANTS and will cry cry cry until it gets what it WANTS.

does not matter if it runs roughshod over laws; it has needs and it WANTS. just like a baby.

Re: So forgetting a password

[ooloorie]

The 4th amendment protects you from illegal searches, but the authorities have a warrant so there is nothing illegal about this search.

And the government is free to search to its heart's content. It should not be free to compel action on the part of the defendant that would result in self-incrimination.

The suspect is actually committing a crime called obstruction of justice by not complying.

That's your view, not settled law. I and many other Americans find that view of "obstruction of justice" to be dangerous and unacceptable.

Re: So forgetting a password

[ultranova]

Defending encryption doesn't mean having to defend every disgusting pervert or criminal that uses it.

Yes, it does: if I don't defend a criminal's fundamental rights, I weaken mine. After all, I have accepted them being merely conditional, rather than truly fundamental, and signaled this acceptance through my lack of action. Cultural consensus has shifted, eroding said rights ever so slightly.

And, quite frankly, the end result of this is the same, a pervert sits behind bars.

Some accused of being a pervert sits behind bars. This is used by authoritarians to cause an emotional response, which can then be used against you later. Don't go into the trap.

Re:So forgetting a password

[TheGratefulNet]

saw an insightful sigfile that is related to your comment.

goes something like:

"we once had a bill of rights. now, the rights are almost all gone and all that we have left is the bill."

sad to say, this pretty much nails the US 'justice' system's motives over the last few decades.

Re:So forgetting a password

[gweihir]

Never. But the person I responded to seems to indicate it was.

Re:So forgetting a password

[gweihir]

That sounds very constructed. Do you have any evidence something like that is happening here?

Re:So forgetting a password

[TangoMargarine]

The idea behind SWATing is people being assholes on the Internet to terrorize people IRL they don't like, not to get them arrested.

Unless you're using "SWATing" to mean something else.

Re: So forgetting a password

[TangoMargarine]

Well, they obviously have a warrant

Definitely not an assumption I ever make anymore.

Re:So forgetting a password

[Ghostworks]

May keep you in jail. Forever.

Yes and no. The issue here is that a judge issued a lawful order, and for failing to abide by that order, he is held in contempt of court. This is bad for him because at this point you fall through the cracks of the system all the way down to basic common law where judges wield ridiculous amounts of power. He's not being held for suspicion or on charges of a crime by the state; he's being held because he fell afoul of the medieval powers of an angry judge. He's essentially directly in the fist of an avatar of the notion of common law. Not a great place to be.

Now, as to whether that is fair or not, there are two schools of thought for something like this:
* One is that an encrypted hard drive is essentially no different than a locked shed. If the cops have a warrant to search your shed, and it's locked, they can make you unlock it. You can argue that you lost the key, but that is a generally unsatisfying answer when the key in this particular is something you memorized.
* The other line of thought is that a password is a form of speech, and that releasing the password to a system containing illegal files is equivalent to a statement of guilt. In other words, they contend that being compelled to release it s not so much like being forced to give up a key as it is like being forced to testify against yourself: the former is legal, the latter is illegal.

I don't believe that there has yet been anything definitive on this, but IANAL, so take this with a grain of salt.

Re: So forgetting a password

[tnk1]

A court can require you to turn over evidence that you have in your possession. The fact that it happens to be the defendant is actually not the point.

You are protected against self-incrimination, but if you were in a car accident and you ran away, you wouldn't be protected from not producing your vehicle, even if you had locked it and hidden it in your garage. That is because the very car itself is not incriminating. It's the evidence that could be derived from the car that would be incriminating, perhaps, but you're not self-incriminating by producing it, as the existence of the car does not prove anything and it isn't necessarily tied to you (someone else might have been driving, etc.).

In this case, the court does not "know" that he has committed a crime, but has seen evidence that there may be contraband in the encrypted filestore. Those files themselves are not immediately incriminating for the defendant, because even if they were contraband, they would have to be tied to the defendant for the defendant to be found guilty of a crime. For all we know, the files were added to the filestore by the sister who supposedly saw the images.

Granted, the process of tying him to the images would be relatively straightforward, but producing the decrypted files is not an admission of guilt.

The one thing that I think the defense rests on is that the self-incrimination is not that there is contraband, but that his very knowledge of how to decrypt a filestore with that material on it is linking the defendant to the contraband. In other words, simply finding those files, unencrypted on his hard drive might have a defense of "someone put them there", but his ability to decrypt the files would mean that not only did he have the files, but he processed the files. It's sort of like a crime is known to have been committed with the gun in the conservatory, and you admitting that you had the combination to the rather solid and undamaged gun safe where the murder weapon was known to be stored.

Re: So forgetting a password

[SumDog]

> our system works fairly well for its size

With 1% of Americans in jail, on probation or in some other way processed through the justice system (more than any other high income country in the world), no .. no it doesn't work at all. It's a clusterfuck.

Re: So forgetting a password

[lgw]

Sound like you believe the police. Never do that. If they had found evidence that would convince a jury, they wouldn't bother with his hard drive, they'd just go to court. Clearly the evidence thus far isn't very compelling.

Re:So forgetting a password

[tnk1]

I read the article for some hint that he said he didn't know it, but it reads to me like he is simply refusing to comply and providing reasons. That doesn't mean he can't say he forgot it later, but nothing implies that he says he has forgotten it.

And honestly, if they have seen that the file was accessed relatively recently, it would probably be relatively easy to prove that he must have known it and is holding out on them. Indeed, the sister may have testified that he was looking at the files only just the other day.

Re: So forgetting a password

[SumDog]

5th amendment protects against self incrimination. He's compiled with the warrant. They have possession of the items. You are not required to incriminate yourself.

This goes well beyond what lawmakers anticipated. We are talking about unbreakable safes.

Despite what you may believe about this man and his alleged crimes, encryption is the key technology in promoting free speech and preventing though crime. Let me as you this: what if it had been gay porn and we still lived in a system where that was illegal (which wasn't that long ago)?

Re: So forgetting a password

[Mr D from 63]

Sounds like you believe the author. Never do that. I didn't say they had evidence to convince a jury, you just made that part up. Not me, not the police. I am not judging how 'compelling' the know information is since I don't know what it is. You can assume as you like.

Re:So forgetting a password

[tnk1]

You can't, but unless you sustained a head trauma, if there is testimony or evidence that you were looking at the contents just the other day, the court will have some reason to believe that you remembered it the next day or even the next week.

Presumably, if they did a good job, the police hopefully got some evidence that the encrypted store had been decrypted recently so he can't use that excuse as readily. And since they had his sister involved, it is possible she can corroborate that to the point that forgetting the password is considered unlikely.

Re:So forgetting a password

[ultranova]

The definition of the word "produce" is important. If the evidence already exists (as encrypted data on the hard drive), then the court can compel someone to produce (deliver) it to the investigators.

The alleged evidence has been delivered. What the investigators want is the suspect's help in interpreting it by providing the missing piece of information: the password. Which, frankly, seems dangerously close to being forced to testify against yourself.

Re: So forgetting a password

[lgw]

You cannot be compelled to assist in producing/inventing evidence against yourself. Perhaps you read about the inquisition in history class? It was a bad thing. As soon as you go down the road of allowing the state to torture suspects until they confess, all hope is lost, and throwing someone in jail until they confess is more than one step down that road.

Re:So forgetting a password

[tnk1]

Actually, it would go something like this.

Prosecutor: "Oh my, we suspect you of having child porn on this hard drive. Unlock it or go to jail."
You: "That's not my hard drive."
Prosecutor: "We have testimony from your sister and other people who state that you own the computer that this hard drive was taken from. We also found unencrypted files on the machine which indicate that you have used that computer in recent memory. We also have evidence from your event logs that the drives were checked by the OS on a number of occasions into the past. So, how would you explain how these hard drives ended up in your enclosure, without your knowledge and attached to your operating system? Bear bear in mind that we have testimony that you personally accessed those drives in the recent past."
You: "I can't unlock it, that's not my hard drive."
Prosecutor: "Right. Your honor, we move that the respondent be held in contempt of court for failing to produce evidence in his possession as ordered by the warrant."

Re: So forgetting a password

[lgw]

If this guy is innocent then he can work with them to show he is innocent. Let the Project see the evidence.

Yes, yes, "guilty until proven innocent" is so much easier for the state. A liquor store was robbed? Just arrest the nearest black person - he probably can't afford a lawyer, so the charges will stick. Kiddie porn downloaded? Arrest the first person you find with encrypted files - if they provide a password, demand they produce the other password, for the hidden partition.

Re:So forgetting a password

[allo]

Now prove, that you forgot your password.

I still have a container here, waiting for my mind to remember the password. I kind of lost the hope, but who knows.
(When i finally open it, i will notice that i will need none of the files in there anymore :D)

Re: So forgetting a password

[torkus]

No, the warrant was served and they seized the drives. He's being held because of non-compliance with a court order based on the all writs act...which is being increasingly relied upon because it's an effective catch-all that gives courts virtually unlimited power.

Re:So forgetting a password

[mlts]

One big issue with hidden containers is leakage. For example, say one uses a hidden container for a VM. If the tier 2 hypervisor program (VirtualBox, VMWare Workstation, etc.) keeps a history of what machines are in use, then a forensics person will start to wonder why there is a pointer to a VM, but no VM present, and depending on country, either tell the judge to get a search warrant and a contempt of court order started, or ask Bruno to do his warmup stretches for a session with his $5 wrench and rubber hose.

Similar with tossing Word documents into the container. Word keeps a recently used history, that can easily blow plausible deniability threads.

Of course, the answer would be hidden operating systems, but that functionality (AFAIK) has been dead and gone since the move from BIOS to UEFI.

Re: So forgetting a password

[IcyWolfy]

"Innocent until proven guilty"?

There should be no presumption of guilt by default, until it has proven.

Re: So forgetting a password

[allo]

Another point against the cause. If the files are the only real evidence, then there cannot be that much harm. If he molested a child, there is other evidence than encrypted files. The whole possession of childporn, pirated music, warez ... are kind of thought crimes. Yeah, it's forbidden and they can prevent you, but going so far to jail you because there may be hidden files is too much.
When there is a real crime, there is for example a victim, there are money flows to follow (banking fraud, or even sale of these immaterial goods they are looking for). The rest is 1 and 0 and trying to regulate it is like trying to keep the AACS key out of the net ... pretty pointless.

Re:So forgetting a password

[lgw]

No, the 5th amendment was explicitly about preventing the state from torturing confessions out of suspects. A practice that had recently been in fashion in the 1700s, and which seems to be coming back into fashion again. Won't confess? To jail with you until you do!

Re:So forgetting a password

[russotto]

Prosecutor: "Oh my, we suspect you of having child porn on this hard drive. Unlock it or go to jail."

You: "I ain't saying or doing shit until I talk to my lawyer".

Lawyer: "My client isn't doing shit to assist in his own prosecution. WTF is this, a goddamn star chamber?" (of course the lawyer says this in legalese).

Re: So forgetting a password

[Mr D from 63]

If the files are the only real evidence, then there cannot be that much harm.

Harm doesn't matter. Its still illegal. Harm would make it worse, definitely. You are making a case against child pornography laws as written, not about the validity of the evidence.

Re:So forgetting a password

[allo]

So, when does it exist? I can produce some file, which gives any content i want, when i xor it with the crypto container. Its all about 0 and 1 and what you want is to feed additional data into an algorithm to produce something from existing data. The algorithm is AES and what you want is a password. But that's only one interpretation of the data. Another may be to display it as an image, taking the bytes as pixel data. So you always use the file to produce something, if you use it on your computer.

Re: So forgetting a password

[torkus]

IANAL ... but he's not obstructing. Obstruction requires active participation to interrupt or hinder an investigation. He's simply declining to be forced to actively participate in gathering evidence against himself...which is typically a 5th amendment right.

I'll include the proviso that divulging passwords has not been explicitly stated as a 5th amendment right (or denied as one) by the supreme court. The SC will have enormous pressure to exclude it but from a practical standpoint it very closely aligns with the intent of the 5th amendment.

Re:So forgetting a password

[somenickname]

Worse, using something like "shred" on a disk might make it look encrypted. It's not possible to "decrypt" the disk because the disk doesn't contain any data. So, if you decide to securely dispose of your old disks by running "shred" on them and someone merely accuses you of having child porn, be prepared to spend the rest of your life in jail.

Re: So forgetting a password

[allo]

> They would not have been able to get a warrant without having probable cause search his home. Most likely there is evidence on those hard drives.
Ouch!
If this would be enough reason to say "there is something on the drive", you could sentence him on the spot. Never never never assume someone is guilty, just because he's accused of something.

Re: So forgetting a password

[MattskEE]

But it was more than just an accusation.

In what way is it more than an accusation? Yes, there is some evidence against him. And at some point he may be charged and convicted of a crime. But unless and until this person is charged and convicted, they have merely been accused of committing a crime.

That's the way our legal system works, and although the distinction is very fine, it is also critical. Otherwise you would have the situation where police can say that they have evidence against anybody and people then think that this person is automatically guilty and its okay to deprive them of rights or due process. But police make mistakes, either willfully or by accident, and the accused needs their day in court so that they have the ability to defend themselves.

I don't know about the particulars of this case - but I see a lot of people who think its okay to give police worrying amounts of power over the lives of people who have only been accused of a crime, as though suspicion of a crime is the same as conviction of a crime. Innocent until proven guilty.

Re:So forgetting a password

[lgw]

TrueCrypt has this - the "hidden partition" feature. Of course, that just means that with any encrypted file they can jail you until you produce the password that shows what the state wants you to show.

Re: So forgetting a password

[allo]

Your point of view is strange.

When i am innocent and accused of anything, nothing should happen when i stay silent all the way. If anything happens without any evidence (which cannot be there, because i am innocent) and they require me to prove my innocence, we've lost our liberty.

Re: So forgetting a password

[CaptainDork]

There's other considerations, as well:

"Collateral privacy" issues may apply. The guy may not be unwilling to comply because of child pornography. There may be other privacy concerns. There could even be other documents that support violations of other crimes. Hell, the guy might be gay or stuff, or he may have a mistress or involved in embezzlement.

The order is too general in nature and covers way more than probable cause.

Re:So forgetting a password

[allo]

IIRC there is a paper about choosing passwords (or other means by authentication? Would need to search it) you cannot disclose. They introduce some scheme, which you cannot reproduce when you feel pressed to do it.

Re:So forgetting a password

[allo]

being paranoid this isn't required to be true. Change your password to something new hard to remember, write it down. Police knocks? Destroy the piece of paper.

Re: So forgetting a password

[macs4all]

But it was more than just an accusation. The way I read it, they were monitoring a known child porn site online and seeing who was accessing it. They traced one of the accesses to this guy. They talked to people and his sister confirmed she'd seen child porn. They then seized his computer and forensically analyzed it.

If they have all that other evidence, then any evidence on the laptop is simply "cumulative", and is not necessary to obtaining a guilty verdict.

This is just the latest in the government's war on encryption. Nothing more, nothing less.

Re:So forgetting a password

[Gryle]

I think you're describing something akin to a steganographic partition. According to Wikipedia "FreeOTFE and TrueCrypt allow a second encrypted file system to be hidden within another encrypted file system. The goal of this filesystem-within-a-filesystem is to allow the users to have a “decoy” file system with data that is interesting but not overtly sensitive. A person who is arrested or captured with a laptop encrypted using this software could then give up the first file system’s password, with the hope that the decoy would be sufficient to satisfy the person’s interrogators." It's not precisely what you're describing, but close.

Re: So forgetting a password

[macs4all]

They then seized his computer and forensically analyzed it.

Well, maybe they should have anticipated encryption and devised a way to obtain the encryption keys (surveillance, keylogger, whatever).

I agree; but being that this was OS X, there is very little chance that something like a keylogger could have been installed without the user's express consent.

Re:So forgetting a password

[Hognoxious]

DeVry's latest J.D. shares his opinion.

Re: So forgetting a password

[Mr D from 63]

Sorry, I chose the wrong words. I was speaking about the evidence, that its more than just the word of the sister. That was what I meant by accusation, with should have been clear from the context of the response, but I guess it wasn't.

Re:So forgetting a password

[allo]

If it's a dead man switch you set up in advance, you cannot. Using such a thing isn't illegal and when it's too late to use it when you're for some time in jail ... not your fault.

Re: So forgetting a password

[Mr D from 63]

If they have all that other evidence, then any evidence on the laptop is simply "cumulative", and is not necessary to obtaining a guilty verdict.

No. Evidence enough to serve a warrant is not the same as evidence enough to convict. Not even close.

Re:So forgetting a password

[rickb928]

"Then you could probably be charged with obstruction of justice.
"I cannot be compelled to incriminate myself"
"You have to give us the evidence you possess"
"I'm innocent, what evidence?"
"You have to let us look at everything you have"
"You have a warrant for that?"
"Yes, we do"
"You can't make me incriminate myself"
"So you admit you're guilty?"
"I admit to nothing"
"So show us everything you have"
"No"
"Then you're guilty of not helping us prove you're guilty"
"I have a right to do that"

Not so much, perhaps. So much for the Fifth Amendment, among others.

Re:So forgetting a password

[Tjp($)pjT]

I suggest that a higher court does not release him, but rather orders the lower court judge to withdraw the contempt charge as inappropriate. Then if the lower court judge fails to comply, that judge will be in contempt and they can share a cell. Interesting test of the lower court judge's conviction.

Re:So forgetting a password

[pr100]

But the (more) fundamental question here is not whether a court can order him to provide the key, but whether it can effectively jail him for ever if he fails to comply. Here (in England) the maximum jail term for contempt of court is 2 years.

Re: So forgetting a password

[Tjp($)pjT]

The privilege of not testifying against a family member is only extended to the spouse. The feeling is that because of the intimate relationship they are likely to share all aspects of their life, so are for this purpose the same entity. They may however voluntarily testify against their spouse, unlike lawyers and doctors whose privilege is based on professional ethics. But, say, someone's brother is called to testify, they can be compelled to do so.

Re:So forgetting a password

[BlueCoder]

Yep, as stated an easy way frame anyone you don't like. For the police or federal it's even easier since they can get one of their professional "friends" to do it.

Skills:
Step 1. Crawl in a window.
Step 2. Plug in an external USB drive.
Step 3. Boot a program from the USB drive.
Step 4. Leave house unseen.

10 Minutes if he has trouble finding the computer.

A downright corrupt cop could get leverage on the computer forensics guy to run "the program" such that the drive could fall out of the cops pocket. But using a B&E guy would be easier since if his friend gets caught it's just a burglary. And if the guy rats on the cop no one will believe him.

Re:So forgetting a password

[mysidia]

Now prove, that you forgot your password.

You missed the point..... you don't have to prove that you have forgotten it.

You just need to testify that you are not able to recall a password for any hard drive or system of that description.

You would also avoid explicitly asserting that it's your hard drive in the first place and/or you ever had a password for it.

If the prosecution believes you can recall it, then to pursue criminal charges for contempt of court, the burden of proof is upon the prosecution: They must be able to prove you had and have access to that specific particular piece of hardware, that you still remember or are in control of the password at that very moment (You have an Agent working on your behalf who is withholding a physical copy of the password at your direction), or you're otherwise capable of providing it.

Also, even if the offender is ruled in contempt, at any point in the future they could later claim they are no longer capable of providing the password, and challenge the contempt order.

Re: So forgetting a password

[macs4all]

If they have all that other evidence, then any evidence on the laptop is simply "cumulative", and is not necessary to obtaining a guilty verdict.

No. Evidence enough to serve a warrant is not the same as evidence enough to convict. Not even close.

True enough. But THIS is likely enough for a jury (especially considering the nature of the alleged crime), and especially if they can get his sister to testify:

"The way I read it, they were monitoring a known child porn site online and seeing who was accessing it. They traced one of the accesses to this guy. They talked to people and his sister confirmed she'd seen child porn."

Re:So forgetting a password

[alex67500]

surely you could plead the 5th here no?

Re:So forgetting a password

[mysidia]

That sounds very constructed. Do you have any evidence something like that is happening here?

I don't know what's happening in the case of the article. Possibly this former PD seargent decided he would like to challenge the order legally in court on 5th amendment grounds; Possibly he knew the password and admitted that fact, Or couldn't testify under oath that he was no longer able to recall the password.

And for some reason the court decided since he wanted to challenge/appeal the order, he would still be penalized for violating the order, for the time until his appeal can be considered.

I would suspect that because the former PD seargent admitted that hard drive belonged to him, or worse, even admitted to being capable of unlocking it but refusing to comply, Possibly b/c he was only being ordered to hand over information and not being charged with a crime.

That possibly the guy might have delayed retaining a lawyer, Or did not refuse to have any discussion of the order or the hard drive with police until after consulting with said legal counsel: to ensure said lawyer would be present for any discussions.

Just because "Forgetting" the password is an out does NOT mean the guy in the article was able to make the claim that he forgot it, without perjuring himself.

Re:So forgetting a password

[Sarten-X]

If they suspect enough to get a valid warrant, that's "known to exist" enough for the court order.

A warrant doesn't say the cops know they will find anything, but it says they have the right to look.

Re: So forgetting a password

[Mr D from 63]

I'm not so sure it is enough, but I'm no expert.

Re:So forgetting a password

[JustAnotherOldGuy]

Isn't that the whole premise behind SWATting?

No. This has nothing in common with swatting.

Swatting is the act of tricking an emergency service or the police into dispatching an emergency response based on the false report of an ongoing critical incident.

Re: So forgetting a password

[macs4all]

I'm not so sure it is enough, but I'm no expert.

Well, me neither; but I would find what they have so far pretty damning.

Would it be convenient for LEOs to have this extra information? Yeah, probably. Is it enough to wad-up and throw-away the Constitution over? Definitely NOT.

Re:So forgetting a password

[JustAnotherOldGuy]

Yep, as stated an easy way frame anyone you don't like. For the police or federal it's even easier since they can get one of their professional "friends" to do it.

They don't even have to go to that much trouble. All they need is any bogus claim so they can get a warrant, and then they'll 'find' the USB sick or removable drive containing child porn as they 'search' the house.

Hell, they could mail it to you and then bust you the instant you carried it into the house. Good luck defending against that.

Re:So forgetting a password

[aaronb1138]

Except presumption or guilt / innocence along with a misuse of deliver versus create. That legal interpretation is logically flawed. The evidence, if a person is guilty in the first place, already exists in their memory as well as any physical evidence. The same logic would be to jail someone indefinitely for failing to tell the state where they ditched the knife / gun / big stick they used to kill someone.

Re:So forgetting a password

[Megol]

Not really. In this case it isn't relevant at all though - as the suspect doesn't claim to have forgotten the password, just that he will not provide it.

Re:So forgetting a password

[gweihir]

In other words, you have exactly nothing. Thanks for confirming that.

Re: So forgetting a password

[Grishnakh]

This is pretty scary actually.

If someone who's more computer-savvy wanted to frame someone else who isn't, and they have access to the latter person's computer, they could download some CP, then encrypt the computer's drive, then call the po-po. Heck, they don't even need to download the CP, they just have to claim they saw it. Now, the victim can't decrypt the hard drive because he didn't encrypt it in the first place, so he'll claim he doesn't know the password (and he's telling the truth), while the court has "evidence" that there's contraband (the false testimony of the framer), and since the defendant is refusing to supply the password he doesn't know, he gets held in contempt and jailed indefinitely.

Re: So forgetting a password

[macs4all]

Hahahahahahahahaha funniest comment I've read all week

Really? SIXTEEN years of OS X being virus-free says otherwise.

Trojans don't count.

Prove me wrong.

Re:So forgetting a password

[guruevi]

A warrant doesn't compel the victim of government overreach to participate in the search, 5th amendment applies during searches. You are expected to allow them to execute the search but you're not expected to point out where you hid the evidence.

Re:So forgetting a password

[Megol]

No it isn't! This is the same thing as not opening a locked room, safe etc. when a court have issued a search warrant that includes the content of those things, something that can (if the room etc. can't be opened by a 3rd party) result in contempt of court.

He isn't forced to _produce_ evidence against himself - he is forced to provide _access_ to the potential evidence already existing _under_a_search_warrant_.

Hypothetical example: a person A shows a person B that the content of a safe consists of a bag of cocaine and some explosives. Person B tells the police, the police attains a search warrant for the safe _but_ it isn't considered safe to try to force entry into the safe (due to the explosives). Person A can but will not open up the safe even though he is legally required to (due to the warrant). A court rules that he must open it up and when person A still refuses he is in contempt of court.

Observe that person A never is forced to testify against himself. This is an important distinction. The court doesn't lock person A because he doesn't produce evidence against himself, it does as person A doesn't comply with a legally binding (based on a reliable witness testimony) warrant to provide access to something. No, the 5th doesn't protect against this, claiming to not being able to do it (like by forgetting the lock code/password) can _IF_ the court believes that is the case.

Re:So forgetting a password

[msauve]

A warrant is completely different. The cops can search all they want, but that's completely different than compelling someone to testify against themselves. It's the difference between searching for suspected evidence, and compelling a suspect to produce knowledge.

Even with a search warrant, the suspect cannot be compelled to provide the combination to a safe because it is the "expression of the contents of an individual's mind" (Doe v. U.S)

[A]ny compulsory discovery by ... compelling the production of his private books and papers, to convict him of crime, or to forfeit his property, is contrary to the principles of a free government. It is abhorrent to the instincts of an Englishman; it is abhorrent to the instincts of an American. It may suit the purposes of despotic power, but it cannot abide the pure atmosphere of political liberty and personal freedom... we are further of opinion that a compulsory production of the private books and papers of the owner of goods sought to be forfeited in such a suit is compelling him to be a witness against himself, within the meaning of the fifth amendment to the constitution, and is the equivalent of a search and seizureâ"and an unreasonable search and seizureâ"within the meaning of the fourth amendment.

-Boyd v US

Re:So forgetting a password

[Megol]

You are assuming the suspect claim to not remember the password. That's not true, he just refuses to provide it.

Re:So forgetting a password

[Dread_ed]

He shouldn't say a thing. He shouldn't have to. Do not talk to the police. Do not self incriminate before a judge or jury.

If they don't have a case by now he should be let go.

This creates a dangerous precedent where the mere accusation of a certain crime can land you in jail indefinitely. That's a wonderful superpower that would be impossible for governments to abuse, even on a relatively short timeline. It's a short step from there to let the other prisoners know your mark is in for child porn, have the grapevine/telephone-game-effect make it into child rape. A single dose of jailhouse justice from someone with nothing to lose and that guy is dead. No government should have that power. No set of circumstances we create as a set of self governing free people should lead to that result, or even make it possible.

Re: So forgetting a password

[Dread_ed]

Exceptionally well put. Thank you; if I had mod points... etc.

Re:So forgetting a password

[Darinbob]

It's a very shady legal process. The 5th amendment prohibits compelling people from testifying against themselves. So to get around that prohibition they attack from the sides, turn it into a contempt of court ruling instead to compel you to testify. Of course law enforcement will claim it's not testimony, but it really is. People are thrown into jail without due process and without even being charged with any crime, this is obviously a perversion of the constitutional protections that any moron could see.

This sort of thing needs to get to the supreme court instead of being mired down with lower level judges who rubber stamp anything the feds ask for. It should not matter if this person really is guilty of crimes or not, there are procedures and laws that must be followed by law enforcement. Once they get their way that they can compel evidence from one person they'll be able to compel it from anyone. But because the magic words "child pornography" are used most of the public opinion sides with law enforcement in their crusade to remove civic rights.

Re:So forgetting a password

[davester666]

Yes, they just get an "All Writs" thingamabob, and you are required to assist them in searching your home...

Re:So forgetting a password

[Darinbob]

But what if the order itself is not valid? That's what I think the problem here is. The judges are too quick to kowtow to the feds whenever they say "All Writs Act", and if one of them refuses the order on the grounds of the 5th Amendment then the feds just go shopping for a more pliable judge.

Re:So forgetting a password

[davester666]

enhanced interrogation techniques...if it's good enough for al-qaeda, it's good enough for suspected child pornographers...

Re:So forgetting a password

[BitterOak]

The Supreme Court has ruled that a suspect cannot be compelled to provide the combination to a lock, so I don't see how this is significantly different.

Do you have a citation for that? I'm not saying you're wrong, I've just never heard of this case and I would be very interested in looking it up and reading the decision.

Re: So forgetting a password

[Darinbob]

Nevertheless, the 5th amendment prohibits forcing someone to testify against him or herself. And providing a password is the same as providing evidence, which courts have said is the same as testifying. It does not matter if the accused is a pedophile, a murderer, a terrorist, or even a dirty commie, the constitution prohibits the courts and law enforcement from forcing the testimony out of the accused.

Re:So forgetting a password

[Cinnamon Beige]

IANAL--but I have been caught by people who have been admitted to the SCOTUS bar, and not the merely honorary one.

This case probably will need to be kicked along until it hits the SCOTUS, but a good, strong case could be made that decryption would be self-incrimination and thus a violation of the 5th Amendment protections under the Act of Production Doctrine--check into United States v. Hubbell, 530 U.S. 27 (2000), where it was ruled that Mr Hubbell's response to the subpoena and producing the papers counted as testimony. The implications for it with encryption are explored here by somebody who probably is a lawyer given it was published originally in a law journal.

This only directly applies to evidence obtained via keys given in return for immunity, but in keeping somebody locked up without trial indefinitely for refusing to produce the key or combination, due process rights are most definitely violated no matter what. (It would be different if a third party was being asked for the key, but it isn't.)

Re:So forgetting a password

[Dread_ed]

Apropos of how complicated this is, there is a story currently circulating about a San Fransisco police officer who had his phone searched due to a sexual assault accusation. He was not charged with sexual assault, just investigated. However in the process of the investigation, numerous racist sounding texts were noticed on his phone. These texts were then released to the public. Yep. That's right. Information from his private text messages, completely unrelated to the investigation, was released to the public.

Check out the article here: http://www.cnn.com/2016/04/26/...

So, what if there are things on that drive that are not CP, but that would be damaging to him if known? All the prosecutor needs to do is say its CP. The judge then incarcerates him until he gives in or is beaten to death by any of the double-Y chromosome inmates that learn what he is charged with. If he gives in and there's no CP, but possibly something else, he's still screwed.

That is too simple a solution for our criminal justice system to not abuse it.

Re:So forgetting a password

[rahvin112]

There is supreme court precedent tying encryption to providing the combination to a safe and making it legal to hold a defendant in contempt for refusing to provide the decryption key. Regardless of your feeling on it the Judge in this case is well within the national precedent.

The Defendant's out on this is to simply tell the court he no longer remembers the decryption key. That was his out all along, not to refuse to decrypt but to say he doesn't know the decryption key anymore.

Re:So forgetting a password

[rahvin112]

There is prior precedent on encryption keys. It's old, from the early 80's when encryption was very new. It equated encryption as a key to the lock and there is a long precedent of allowing the courts to compel someone to turn over a key.

Re:So forgetting a password

[Megol]

There is a witness that claimed to have seen things that are criminal to possess and the court considered it so reliable a search warrant was created. There is no provision of evidence expected from the suspect - just that he provides access so that the items in question can be searched. Again: he isn't forced to provide evidence, just to give access to something that can contain evidence. If you shoot somebody and then when provided with a search warrant you don't provide the police access to your gun (for ballistic testing) then the 5th doesn't matter - and this is the same thing.

Re:So forgetting a password

[alexgieg]

A potential solution: you LOVE testing Linux Live CDs in VirtualBox, you have a big collection of those. And for some reason you also love accessing a TC container in the local filesystem using any of them...

Re:So forgetting a password

[HiThere]

No, but it means that I don't believe their assertions, because they lie so often. And so I *expect* this is actually about encryption no matter what kind of story they fob off as a justifier. I don't *know* that that's true, but all I have to say that it's about something else is their word, and they lie more often than they tell the truth.

Re:So forgetting a password

[JoeMerchant]

Jeez, that's assuming a much higher level of cognitive functioning that a significant portion (like >10%) of the population operates at on a daily basis.

How often do people use the automated password reset services? Now, assume you're running a secure drive on your home system, if there's nothing of particular value or interest inside - maybe that's an easy password to forget. Even more so: if you're actively concerned about hiding something and you change your password every week "for extra security" - then suffer the emotional trauma of being arrested and dragged to court, that's enough to rattle lots of people into forgetfulness.

Me, personally, I recently changed jobs - set the old system aside for 6 months, when I went back to it I tried every password I could think of on it and nothing worked. Luckily, it was Slackware based - so working around it and resetting the password was about a 10 minute exercise on Google - same goes for CentOS, forgot one of those not too long ago too.

Re:So forgetting a password

[msauve]

They already have access, the hard drive is in their possession. It's no different than if he wrote papers in his own secret shorthand, he couldn't be forced to translate.

Re:So forgetting a password

[mlts]

Another item that can hang someone is browser fingerprinting. VM 1 from a Linux CD has a certain fingerprint, while the same machine hosts another VM with a different OS or web browser. It wouldn't be too hard to connect the dots, find VM1, find where VM 2 should be, then use a rubber hose to decrypt VM 2.

Re: So forgetting a password

[Hylandr]

They traced one of the accesses to this guy.

Ever been rick-rolled?

They talked to people and his sister confirmed she'd seen child porn.

Sis could have been pissed off, went to a few sites, downloaded a few things, then called the cops

Also, 5th Amendment. He has a RIGHT not to incriminate himself. In the scenario detailed above, he could well be innocent, but giving up the contents of the drive won't prove it. They really have no case.

Re:So forgetting a password

[luis_a_espinal]

" If the evidence already exists (as encrypted data on the hard drive)" Ah, but it's NOT known to exist. The prosecution only suspects there's evidence on the hard drive, and they're fishing.

I sympathize with the judge's intentions, but I have to agree with this. Evidence does not exist until it is decrypted. If authorities knew what the encrypted content was, then the evidence would be known to exist a-priori and there would not be a need to compel the pedo to hand over the key.

Morally and ethically, I have no problem keeping the bastard locked till he pukes the key. But legally, I have a problem. My guts instinct regarding the perp cannot override the mechanisms of our legal system. If they could, we should abandon all pretense of civilization and start wearing leather jackets, horned helmets, football shoulder pads while riding our wheels through the wastelands... or some shit like that.

Re: So forgetting a password

[luis_a_espinal]

Well, maybe they should have anticipated encryption and devised a way to obtain the encryption keys (surveillance, keylogger, whatever).

That would require a warrant (because this isn't a three letter agency prosecuting the defendant).

As per the details of the story, authorities had enough evidence to get a warrant from a judge to install a keylogger or some shit like that. I do not like this one bit, but we have to admit the authorities screwed up the case.

Re: So forgetting a password

[luis_a_espinal]

At the point that you have enough evidence for a warrant, you would have enough for a conviction

You fucking retarded? You need probably cause for a warrant. You need proof beyond a reasonable doubt for a conviction.

I want two of whatever you're on.

As per the story, authorities had enough evidence to get a warrant (considering they had enough evidence to.... tada! get a warrant to seize his computer.)

Re:So forgetting a password

[Mattcelt]

I was not aware of the combination precedent. I'll have to read up on it, though at least on the surface, I take issue with the entire concept... how is it all right to force someone to do something that would incriminate themselves in any way? I don't understand the reasoning.

Re: So forgetting a password

[tattood]

At the point that you have enough evidence for a warrant, you would have enough for a conviction so the only reason for going through that much trouble would be if the case was part of a larger operation which it doesn't appear to be

I don't think that's how it works at all. The whole point of a warrant, is so that you can look for more evidence in order to help your case so you can get a conviction.

Haven't you ever watched Dateline?

Re: So forgetting a password

[tattood]

In other words, simply finding those files, unencrypted on his hard drive might have a defense of "someone put them there", but his ability to decrypt the files would mean that not only did he have the files, but he processed the files.

Not necessarily. These are not "encrypted files", but an encrypted hard drive, so anyone could have put the files there while it was un-encrypted. He could have decrypted the hard drive, and then walked out of the room, and someone else put the files there. Or there could have been a malware that copied the files. Just because someone can decrypt the hard drive does not mean they are solely responsible for all of the contents on the drive.

Re:So forgetting a password

[gurps_npc]

I hate and despises "magic word tests" put into law. He has a right to not incriminate himself - including a right not to be forced to make a specific statement.

Re:So forgetting a password

[T.E.D.]

under the 5th amendment he can't be compelled to "utter" the passphrase, but he can be compelled to provide the unencrypted contents in most jurisdictions.

So he could get himself out of prison tomorrow by getting another inmate to cut off his hands. Then he couldn't type it, and would have to "utter" the passphrase, which they can't force him to do.

Re:So forgetting a password

[iCEBaLM]

> but he can be compelled to provide the unencrypted contents in most jurisdictions.

This is not settled, in fact, the only US Federal court (11th Circuit) to rule on this type of matter held in Minesen Co. v. McHugh that compelled production of unencrypted files violates the fifth amendment. back in 2012.

Re: So forgetting a password

[Mr D from 63]

I didn't say anything about his rights as far as giving up the PW. I just clarified the information presented, as some were talking like the whole case was based simply on someone's word. I'm not defending either side, simply observing the information.

Re:So forgetting a password

[Calydor]

No, that is called 'reasonable suspicion' or something to that effect. In other words, they have evidence that suggests more evidence - and in cases of SWATting, there is a time-sensitive aspect to consider as well.

In this case it seems they only have "Well, someone said there once was something on his computer so this one encrypted drive is definitely the smoking gun!"

Re:So forgetting a password

[zugmeister]

IANAL, but when you say "they can press him to reveal where he dumped the body", would the word "press" reasonably equate to applying the same penalty he could expect as a convict, even though he has not been found guilty of a crime? Because that's what appears to be happening in this situation.

Re:So forgetting a password

[ooloorie]

It's 18 months maximum in US federal courts. State courts vary by jurisdiction.

Re: So forgetting a password

[Time_Ngler]

So, tl;dr is it's ok to presume him guilty without a conviction because he probably did it anyway. And you don't see a problem with this?

Re:So forgetting a password

[AutodidactLabrat]

Wait. The accused will lose far more than time in jail if he gives up the password
It follows then that this conduct by the Judge can never benefit the accused, who will thus never comply
That makes contempt into punishment, rather than inducement.
Without trial.
In violation of Amendment 4, it it not?

Re: So forgetting a password

[s.petry]

Hardly, they have strong evidence that his computer contains evidence (testimony from suspects sister). The 4th amendment protects you from illegal searches, but the authorities have a warrant so there is nothing illegal about this search. The suspect is actually committing a crime called obstruction of justice by not complying.

And we all know that testimony is always true and infallible right? Especially because of [insert appeal to authority/emotion] right? Good grief! Some people are simply not capable of critical thought.

Re: So forgetting a password

[Mr D from 63]

Did I say that? Or did I simply describe things without injecting such an opinion?

Re: So forgetting a password

[TheGratefulNet]

a flaw in your argument. custody of evidence, sort of.

lets say he has an encrypted hard drive. isn't that session-based; you unlock it, you do stuff and you have to actively lock it again. is it POSSIBLE that a person who wants to see another person falsely accused, could plant files on his system while the drive was unlocked.

"hey, mr so and so is on the phone for you downstairs. sounds important."

he goes to the phone in another room. she plants files.

who is to say?

so much is at stake. mere presence of files should not be enough to end a person's life. and that's really the end result of such a witchhunt.

his sister said so and so. yeah, well, people say things. is that enough to force someone to unlock their drive?

again, this can look a lot like swatting. someone may be pissed off at you, make wild claims and if you happen to have an encrypted filesystem, is it justice to make you share your files when there is only a person's say-so? to me that does not seem strong enough.

Re:So forgetting a password

[WarlockD]

" If the evidence already exists (as encrypted data on the hard drive)" Ah, but it's NOT known to exist. The prosecution only suspects there's evidence on the hard drive, and they're fishing.

Thats the catch. In this case they have evidence from his sister that she saw child porn on his monitor. Its how they got the warrant. Its been stated better elsewhere in comments, but the police is in the good here. They tracked this guy for weeks, they KNOW he was using his computer this time at a child porn site. So yea, he was boned way before they got the hands on the drives. They raided the house specifically for these drives.

It be different if he was arrested for another charge and the procureruter wanted the hard drives decrypted to "find possable child porn" I honestly don't know why everyone is up and arms over this non issue:P

Re: So forgetting a password

[cfalcon]

I am NAL, but it does not.

https://www.eff.org/press/rele...

Re:So forgetting a password

[cfalcon]

Sure, if you ignore:
https://www.eff.org/press/rele...

Re: So forgetting a password

[radarskiy]

" if YOU were accused of having child porn I tend to think you would do everything in your power to show that wasn't the case."

How can I prove that I never had a password that you are asking for?

Re:So forgetting a password

[Dashiva Dan]

It's not about child or encryption. It's about compelling the assistance in one's own prosecution. Unfortunately I'm one of those in the tiny minority that believes it should never be allowed. I'm hoping the guy holds out for what it's worth. Maybe it's better for him to remain a suspected 'child porn suspect'.

I'm half way expecting a constitutional convention to come up within a couple of years. We can kiss the bill of rights and other civil rights goodbye when it happens. The general attitude has turned against them.

Actually, my dearest hope is that the judgment is made against him.
He's forced to decrypt his HDDs
There's nothing illegal on them.

(By wich I mean, yeah, it's retarded, but I hope he's really innocent and just helping shine a spotlight on these kind of (legal?) efforts to circumvent encryption)

Re:So forgetting a password

[allo]

The point is, you do not need to claim you have forgotten it. You can keep silent and it should not speak against you. Then having forgotten the password needs to be considered as an option as well. You do not need to possibly incriminate yourself and this has nothing to do with being guilty or not. Just think about it, you are in court, nervous and axieous and really cannot remember the password exactly. You state this under oath and when you finally get your hardware back and start using it and remember the password again, they sentence you for perjury, because they assume you lied before.

Re: So forgetting a password

[Time_Ngler]

Well, you basically regurgitated part of the article, which amounts to just what the prosecution said. What importance is this, especially considering he wasn't even charged with anything? If you don't have an opinion, then why point out such one-sided information?

Re: So forgetting a password

[easyTree]

'Kiddie porn' would be a great crime to 'suspect someone of" if you'd like the public behind you as you imprison someone without evidence.

Re: So forgetting a password

[easyTree]

This is almost almist certainly the point here - the nipping in the bud of the uptake of encryption by the masses. 'Only paedophiles use encryption'.

Re: So forgetting a password

[easyTree]

I presume you know what justice is. Yes? So please stop calling it the justice system.

Re: So forgetting a password

[easyTree]

At the point you successfully prosecute someone it's another fee-paying customer for Hotel Penitentiary 79 (of which you ate a board member), free labour and an increased chance of future patronage by said customer. Woohoo! Capitalism for the win!

Re: So forgetting a password

[easyTree]

One can only imagine the future crimes which Snowden will 'commit' after returning to the US - if there's ever a promise by your president to not have him killed for exposing entrenched corruption and hypocrisy.

Re: So forgetting a password

[easyTree]

Otherwise you would have the situation where police can say that they have evidence against anybody and people then think that this person is automatically guilty and its okay to deprive them of rights or due process.

Uhh, as in this situation ?

Re: So forgetting a password

[easyTree]

A good reason to coerce people into plea-bargins before their case reaches court.

Re: So forgetting a password

[ooloorie]

You know, the amusing thing about people like you is how much you obsess about US politics and how blind you are to the power structures, corruption, and lack of political freedom in your own country.

As for Chomsky, he's a hypocrite himself; the only thing he regrets is that he hasn't managed to become even more part of the "power elite" than he already is. God knows he has been trying.

Re: So forgetting a password

[easyTree]

Try to maintain a sense of focus. It's us vs them not them directing us against each other.

Re:So forgetting a password

[ole_timer]

he could put a pencil in his mouth and type one character at a time...

Re:So forgetting a password

[ole_timer]

right, it's unsettled, just what I said.

Re:So forgetting a password

[ole_timer]

right, it's unsettled law. a judge can follow this or not.

Re: So forgetting a password

[Mr D from 63]

I pointed it out because some folks here were not considering it and seemed to thing the sister was the ONLY evidence they had. You just interpreted it as a defense because you are viewing it through an opinionated lens.

Re: So forgetting a password

[monkeyzoo]

Time to start using plausible deniability encryption!

This case seems a farce against the 5th amendment.
I wonder if the claim, I *just* changed my password and now can't remember it after the shock of being arrested would work?

Re:So forgetting a password

[iCEBaLM]

No idea where you said that, certainly wasn't in the post I replied to.

Re: So forgetting a password

[easyTree]

I'm glad we're on the same page.

Re: So forgetting a password

[Time_Ngler]

The only reason that would matter is if you are, as I stated, presuming him guilty before a being convicted in a court of law. If not, then it would be irrevelant, and hence not valuable to the discussion. Right or wrong?

Re: So forgetting a password

[Mr D from 63]

The only reason that would matter is if you are, as I stated, presuming him guilty before a being convicted in a court of law. If not, then it would be irrevelant, and hence not valuable to the discussion. Right or wrong?

Wrong. I like to see completeness and accuracy when people are discussing topics. There were misconceptions posted regarding what evidence was in play, I simply tried to fill that gap. If that information is irrelevant to whatever point you would like to make, then ignore it, yet for some reason you seem to react defensively. Why would simple information need such a reaction? I can't answer that and frankly I don't care.

Re: So forgetting a password

[Time_Ngler]

You're being passive aggressive. You didn't just scribble that "evidence" randomly on a wall. You responded to a thread about whether it was justified to throw a man in jail indefinitely without a trial, and heck without even being charged! You even stated the evidence was "compelling"... Compelling in deciding, if not guilt, than what?

Re: So forgetting a password

[Mr D from 63]

Yes, I think "if true" the evidence is compelling that there may be porn on those HDDs. If it is true, don't you agree? That does not reflect an opinion regarding the attempts to get the person to give up his password. What is or is not on the HDD is irrelevant to that, don't you agree?

Re: So forgetting a password

[ooloorie]

Try to maintain a sense of focus. It's us vs them not them directing us against each other.

Where do you think your excessive concern with American political issues comes from? Your own political leaders are trying to distract you from your domestic issues. So take your own advice to heart.

Re: So forgetting a password

[macs4all]

Slashdot has had several articles about osx viruses. Prove you're right.

And yet not ONE of the "Several Slashdot Articles" referenced? Cat got your tongue?

Way to make a convincing argument.

Is that because, in EVERY SINGLE CASE, those Articles ACTUALLY referenced a TROJAN, not a VIRUS???

Since proving a negative is an impossibility (and an "illegal" debate tactic), you SHOULD already know that I can't PROVE there have been no VIRUSES (I didn't say TROJANS) for OS X.

So the onus is STILL on you to prove otherwise, COWARD.

Re:So forgetting a password

[Triklyn]

https://en.wikipedia.org/wiki/...

Re:So forgetting a password

[Triklyn]

i can also claim to have lost 2.5 million dollars. and get thrown in jail for 14 years to prove that even if i have it, you won't get it from me.

https://en.wikipedia.org/wiki/...

Re:So forgetting a password

[Triklyn]

eh, throw him away for 15 years.
https://en.wikipedia.org/wiki/...

until it's clear that he either forgot or you're convinced even if he was lying, further incarceration isn't getting you anywhere.

Re: So forgetting a password

[easyTree]

To be clear; there is no benefit to the ordinary citizen in defending the horrors perpetrated by their governments; no sense in attempting to state "your leaders are worse than ours therefore all is well or you are prevented from observing our problems"; no sense in trying to pick a squabble on the Internet.

What does make sense is organising against tyranny. Any force which leads to division is benefiting the minority that are screwing us over and have been screwing us over since people stood upright.

What is your interest in maintaining the status quo?

You may choose to reply in a confrontational manner; if so, please state for the record, your reasons for choosing such a course.

Re: So forgetting a password

[Triklyn]

i don't personally make a distinction between producing a physical key and a non-physical key. self-incrimination is a qualitatively different thing in my mind.

https://en.wikipedia.org/wiki/...

if he should be compelled to pay money in alimony, which you know, he should be. then that is no different than trying to compel a password out of someone. essentially.

Re:So forgetting a password

[fustakrakich]

And this is one more reason the law deserves no respect. It is torture and it merits all the resistance a person can muster. Happily for the sadists, there is hardly any. The appeal to authority just overwhelms all humane reason.

Re: So forgetting a password

[beastofburdon]

And don't forget to mention that police lie constantly. Believing anything said by a police officer is complete folly.

Re: So forgetting a password

[ooloorie]

What does make sense is organising against tyranny.

Organizing against tyranny is simply organizing to replace one kind of tyranny with another.

You may choose to reply in a confrontational manner; if so, please state for the record, your reasons for choosing such a course.

"The fault, dear Brutus, is not in our stars but in ourselves, that we are underlings."

People with your attitudes are the reason our liberties are limited and threatened in the first place. You are part of the problem, not part of the solution.

Re:So forgetting a password

[beastofburdon]

You are absolutely right. The mere accusation will ruin your life, even if it is proven that the accusation was false.

Re: So forgetting a password

[alexandru_preoteasa]

> stupid politicians. PAID politicians, my friend. Paid, or threatened... Never attribute to stupidity what can be explained by money or fear. Stupidity tends to get isolated, politicians are anything but.

Re: So forgetting a password

[easyTree]

How much do they pay you per troll?

Re: So forgetting a password

[alexandru_preoteasa]

OF the people! FOR the people! YAYYYYYY HANCOCK!

Re: So forgetting a password

[umroh]

the laws in each country is different and sometimes if we do not know clearly the law of a country can be at risk when we traveled like Umroh Ramadhan to a country and do something that may be legal in our country, whereas for criminals all would agree they should be punished

Re: So forgetting a password

[easyTree]

A seamless karma-preserving transition to AC. I applaud you.

Re:So forgetting a password

[KGIII]

That's not how courts in America work. You don't have to prove you've forgotten. The burden of proof is on the State to prove that you remember.

Re:So forgetting a password

[shutdown -p now]

What is inside the hard drive doesn't matter for this purpose. What matters is whether there is a legitimate warrant to access it. And there is one, because they have reasonable suspicion that evidence is there, so warrant could be issued.

Re:So forgetting a password

[shutdown -p now]

Yes, so they must have a reasonable suspicion that there is evidence related to the crime. Which they did (witness accounts that he showed them things off that laptop).

And then they must go to the judge, and get a warrant to search the drive. Which they did.

And now this guy is basically refusing to comply with said legitimate warrant, for which he is held in contempt by the judge.

This is not at all similar to "pick any house at random and search it for whatever they suspect might be in there".

Re:So forgetting a password

[shutdown -p now]

No, they still require a warrant (although they can - and too often do - get a no-knock warrant, which is a whole different problem).

Re:So forgetting a password

[shutdown -p now]

Per the All Writs Act, they can compel cooperation with the investigation in general. The Fifth says specifically:

"nor shall be compelled in any criminal case to be a witness against himself"

And he is not asked to be a witness against himself (i.e. he is not asked to confess). He is asked to provide a piece of information that, in and of itself, does not testify to his guilt. He's asked to provide information that can then be used to access other information, which may provide evidence of his guilt - but at the point that information is retrieved, he's no longer in the picture, and so it does not involve him witnessing against himself.

Re:So forgetting a password

[shutdown -p now]

He's not incriminating himself by making a statement that he knows the password.

Re:So forgetting a password

[shutdown -p now]

The problem is that "contempt" is a separate thing. Being held in contempt doesn't mean that you're guilty of anything, so the usual innocent-unless-proven-guilty standard doesn't apply. I'm actually not sure what the standard is for contempt, and in particular, what the checks and balances are (i.e. if he believes that judge is holding him in contempt improperly, can he appeal it, and to whom?).

Re: So forgetting a password

[Coren22]

it will eventually be used against anybody from Snowden

Just FYI, using someone who is charge with treason, for you know, actually committing treason, doesn't make your argument very strong.

Re: So forgetting a password

[david_thornley]

There can be evidence against a person who is innocent. There was apparently a hit-and-run (I don't know for sure, I wasn't there) in which the victim gave the police a description of my car and my license plate number. That's evidence that I did it. It had better not be conclusive evidence, so they disregard the people who know where I actually was at the time of the alleged incident.

Re:So forgetting a password

[david_thornley]

Last I looked, case law on forcing the decryption of files was unsettled. It seemed to be pretty well accepted that the courts could require decryption of something they knew was there (which doesn't appear to be the case here), and not if the act of decryption would help incriminate (such as a hard disk in the house that was not necessarily tied to him).

Re:So forgetting a password

[mysidia]

Being held in contempt doesn't mean that you're guilty of anything

Yes it does mean you're guilty of something. It's a conviction with an expeditious trial in front of a judge with no jury. Contempt of court is a criminal conviction. Although it is prerogative of the court that the judge can declare people in contempt, and pass sentence; this is due to a tradition of trying contempt charge from the bench by the judge whose court has been violated or disrespected, and a jury is not involved.

It can still be appealed. An appeal of criminal contempt starts in the superior court; an appeal of civil contempt starts in the court of appeals.

Re:So forgetting a password

[david_thornley]

IANAL, but AFAIK it is generally legal to have planned data destruction implemented. For example, many companies destroy all email older than a given duration, and that's fine. The court can order them to preserve evidence starting at a given time, but if you have a 90-day email retention policy, do something horrible, and the police show up 91 days later, you've destroyed the evidence perfectly legally.

Typically, the police will make a disk image and preserve it themselves, but in some cases (like a modern iPhone) they can't get the decryption key directly and so the disk image is useless.

Re: So forgetting a password

[Zxern]

No need to believe the either. He isn't being charged with the crime, he's be charged and held for obstruction. They clearly don't have enough evidence to proceed with child pornography charges or they would have already.

Re:So forgetting a password

[LinuxLuver]

"I don't remember the password. I cannot comply". Job done.

Re:So forgetting a password

[LinuxLuver]

My understanding of the 5th Amendment is that you can't be compelled to testify against yourself. But anything you own is evidence (potentially) and is fair game. Maybe if the hard drives were connected directly to his brain that could avoid being scrutinized. Will this act as a spur for developing intra-cranial, encrypted data storage accessed by though alone? That would be interesting when it comes to it...and it will one day.

Re:So forgetting a password

[LinuxLuver]

"If this was permitted then cops would be able to pick any house at random and search it for whatever they suspect might be in there." Terrorism....there now do exactly that.

Re: So forgetting a password

[epyT-R]

You are at least somewhat familiar with the cold war? Stalin's gulag system? The work camps of North Korea? Abuse in prisons has nothing to do with capitalism.

Re:So forgetting a password

[Ihlosi]

He's asked to provide information that can then be used to access other information

So he's being required to be an expert witness against himself?

Re: So forgetting a password

[Ihlosi]

I agree; but being that this was OS X, there is very little chance that something like a keylogger could have been installed without the user's express consent.

OS X uses an encrypted connection with peripherals, like a keyboard or a mouse?

If it doesn't, you can just log the bits on the USB. The operating system is irrelevant, it'll never even have a chance to notice this.

Re: So forgetting a password

[allo]

Nope, there cannot be evidence, if you're innocent. There may be big indications, but evidence is a proof you're not innocent.

Re: So forgetting a password

[easyTree]

Nice of Stalin to do thé proof of concept / feasibility study / legwork and capitalism jumps on board when the model had been refined. Embrace and extend!

Re:So forgetting a password

[eric_harris_76]

What a delightful way of putting it: ' not a punitive measure, its a conducive measure"

It's not about past behavior, it's about future behavior, IOW.

From this I conclude that punishment doesn't reduce recidivism. Generally speaking.

Re:So forgetting a password

[russotto]

Fortunately this sort of extremely limited view of the Fifth Amendment -- which would allow not a compelled confession to a murder, but a compelled demand to produce the body of the victim -- is not endorsed by the Supreme Court.

Re: So forgetting a password

[macs4all]

Thunderstrike 2 worm can infect your Mac without detection

Kind of an Edge-case, don't ya think? Considering you have to plug in a compromised TB adapter. It qualifies as "physical access" (by the "Evil Maid", etc.), since the exploit cannot be achieved without same.

It is widely considered among security experts, and most Slashdotters, that physical access is nearly impossible to guard against.

And I am not sure that Thunderstrike went beyond the proof-of-concept stage, anyway.

So, is that the best you can do? If so, still no cigar...

Re: So forgetting a password

[david_thornley]

What do you think "evidence" means? There is a witness report that says I'm involved in the incident. In what linguistically useful way is that not evidence? Would it become evidence if I were convicted (although I wasn't there)? Would it be evidence only if true, and not an honest mistake? Would you not consider it evidence even if I had committed the hit-and-run I am alleged to, since it isn't conclusive proof?

By any meaning of the word I, as a native English speaker with a passing interest in etymology and linguistics, am aware of, the witness report is evidence.

Moreover, while you may think you shouldn't have to lift a finger to prove your innocence, that's not a practical thing to do in the real world.

Re:So forgetting a password

[shutdown -p now]

No, since the information that he's asked to provide is not incriminating in and of itself.

Re:So forgetting a password

[shutdown -p now]

A demand to produce the body would still fall under the scope of the Fifth, because knowing where the body is would be incriminating in and of itself.

What wouldn't be is if, say, the police reasonably suspects that a body is locked in a specific place, to demand a key to that place. Surrendering the key is not producing the body - it is only allowing the door to be open. It is not illegal to lock a door, so the fact that one has the key is not illegal. And there is no demand to produce the contents - police will go and obtain it on their own, once they have access to it.

SCOTUS hasn't ruled on this one way or the other, so it remains to be seen.

Re: So forgetting a password

[macs4all]

I agree; but being that this was OS X, there is very little chance that something like a keylogger could have been installed without the user's express consent.

OS X uses an encrypted connection with peripherals, like a keyboard or a mouse?

If it doesn't, you can just log the bits on the USB. The operating system is irrelevant, it'll never even have a chance to notice this.

I assume that would take either a compromised driver, or a compromised peripheral. The former falls under the "not sure how you'd get that installed without user consent", and the latter falls under the "How does the peripheral transmit said keystrokes/mouse clicks to the "command and control" server?" Certainly not over USB or Bluetooth, at least not without the assistance of a compromised driver.

Re:So forgetting a password

[russotto]

A demand to produce the body would still fall under the scope of the Fifth, because knowing where the body is would be incriminating in and of itself.

Not a problem; they can give immunity on that particular point. This was the case in United States v. Hubbell, 530 U.S. 27 (2000). There were particular incriminating documents that Hubbell produced under a grant of immunity which covered only the act of production, not the information on the documents. The Supreme Court did not accept this; the information on the documents could not be used to prosecute Hubbell.

SCOTUS hasn't ruled on this one way or the other, so it remains to be seen.

SCOTUS appears to view it as settled law that one cannot be forced to reveal a combination to a wall safe, which is as close an analogy as you're going to get (that's also in the majority opinion in Hubbell, though it first appears in a dissent in a 1988 case; the majority did not dispute the analogy in that case, only how it applied) If you get any more mechanistic, you find that the documents do not exist until the encrypted data is combined with the decryption key; that view provides even an even stronger case for fifth amendment protection, as in this view the defendant is being required to _create_ the evidence against him.

Re:So forgetting a password

[shutdown -p now]

you find that the documents do not exist until the encrypted data is combined with the decryption key; that view provides even an even stronger case for fifth amendment protection, as in this view the defendant is being required to _create_ the evidence against him.

It is a potentially interesting angle, but I doubt it would fly. It would mean that any and all laws that make some information illegal would cease to apply the moment it is encrypted, because it is "no longer there" (and later it magically reappears when the key is applied). This could be stretched even further by saying that e.g. compression is also similar, in that the output is not directly usable; and the compression code is the "key".

This would then apply across the board: copyright, national secrets etc. So for example if a guy steals some top secret data, encrypts it, and hands it over to Chinese in two separate transactions - one for the data, and the other for the key - it would seem that nothing illegal has occurred, because the data in its encrypted form is not top secret - only the decryption output would be, and it doesn't exist until encrypted data and key are combined in a very specific way.

Somehow, I doubt that this will work out that way.

Re:So forgetting a password

[7-Vodka]

I don't understand why you people keep comparing encryption on computers to safes.

Are you so ignorant to not know that there was encryption on paper long before it existed in computers?

Safes are not the proper analogy, paper encryption is.

Re:So forgetting a password

[jbmartin6]

Rudeness isn't useful. I'll let it go though and point out this isn't an anology. This is a statement that current case law cites previous cases involving combination safes.

Re: So forgetting a password

[Coren22]

Offering your country's secrets to China and Russia is treason however.

Re:So forgetting a password

[argumentsockpuppet]

In the article I read, he did apparently attempt to cooperate and tried several guesses at passwords and apparently failed.

He was found to have legal pornography on other devices which lends credence to the argument his lawyer makes. His lawyer makes the case that the evidence they are attempting to obtain is based on the accusations of a sister who is angry that the suspect stopped supporting her.

I question the reliability of the witness, but that's not enough to convince me that a judge shouldn't attempt to get all possible facts in this or any other case. That's a matter of judgement, and the role of a judge. In this case, the judge has apparently decided that an angry relative was telling the truth and a man failing to succeed in decrypting data was lying about forgetting a password.

(Honestly, I think the judge's suspicions are right and the man is deliberately failing to produce the password.)

Initially, the court determined it didn't have the authority to compel the suspect to take further action, but the prosecution moved to a different court and there found a judge that would side with them.

Have you ever had an angry relative? I have. Have you ever forgotten a password? I have. Do you make a habit of protecting personal information, like tax returns, with a password? I do. I don't like the idea that any of us could be in this situation with no recourse, and no ability to comply, actually innocent and held in prison without a trial.

This is not a new argument.

Since I personally believe this man is guilty, I hope evidence is found that proves to a jury he is guilty. However, since I also believe in the rights of the accused and agree with (most of) the constitution of the US and believe in the rule of law, I also hope this judge is slapped down by a higher authority for failing to uphold the laws protecting the rights of the accused. There are too many "if" statements for me in this case. "If" the sister is telling the truth, and "if" the suspect is lying about not knowing the password and "if" the encrypted data could be decrypted and "if" when decrypted, it would give needed evidence, and "if" holding this man in prison without a trial or even charges will change his decision to lie and "if" this man, who has never been accused of a crime (according to his attorney,) is found guilty then justice would be served.

But at what cost? Can I send a person to jail with no trial, no charges even, by running
dd bs=1024 count=1048576 < /dev/urandom > myfile
and putting it on their computer then making a false allegation? How about if I write a virus infecting thousands that creates random noise files on people's computers then emails accusations to police? Discussion question: How would you react if the police confiscated your devices and demanded a password you don't have to a file you didn't know was on your computer?

(There is a tiny dark voice in my mind that thinks that building a virus to create false evidence on people's hard drives and emailing false confessions, preferring to email from .gov addresses, would go a long way towards preventing tyranny. I try to drown that voice with alcohol.)

Re: So forgetting a password

[allo]

Evidence is something, which cannot be proven wrong. A witness' statement is no real evidence, but a (strong) indication, if you're not the witness yourself. This means, when i am not guilty, there cannot be *evidence*, which does not mean i cannot be sentenced. But this is then based on weaker indications. And some real evidence, that you're not guilty can of course beat this and safe your ass.

Maybe i am wrong with the word "evidence" as non-native speaker. I see it like a proof in the sense of a mathematical proof. Something, which is correct without any doubt and cannot be proven wrong.
So like a broken glass is an evidence for the claim "someone broke the glass", but not for the claim "the only person in the room broke the glass". There is a strong indication, that the only person in the room did it, but you cannot finally be sure, because nobody saw him doing it.
When there is a witness, that the glass was broken before he entered the room, it would of course help to prove him innocent, so he cannot be sentenced because of the fact that he most probably was the one, who broke the glass.

Re:So forgetting a password

[viperidaenz]

If your encryption key is stored in a self-powered USB device that erases itself unless you plug it in and give it a password every x days, what trick solves that problem?

By the time you get hauled in front of a judge, the key is erased and there is nothing you can do about it.

Re:So forgetting a password

[AK Marc]

You didn't shred it. The same holds true for companies that have a policy to delete emails over 90 days old. If they are sued on day 91, they aren't punished for shredding the emails. The proof they didn't shred them is that they had a pre-existing policy, so it was provably not done to avoid that specific action.

Though that doesn't save them if they are notified of an action at day 15 into the cycle, and they don't protect the data on day 90. If something like that is closer to how you see your USB key working, it would still be illegal shredding.

Re:So forgetting a password

[chadenright]

Nope, because the man could quite possibly be innocent. He may not have a body to produce. And if that's the case, holding an innocent man in jail indefinitely because the man doesn't have a body to prove that he is a murderer is a gross miscarriage of justice. Just reading that, it's blindingly obvious that holding an innocent man in jail indefinitely for failure to incriminate himself is stupid. The same principle applies here.

Re:So forgetting a password

[whoever57]

Nope, because the man could quite possibly be innocent. He may not have a body to produce.

And the same could be true in this instance. The encrypted files could have been placed there by a third party.

Re:So forgetting a password

[Nehmo]

All of these legal arguments aren't any good without showing their authority. IOW, is this concept from a controlling decision or is it just somebody's idea of what is just?

Well...

[Anonymous Coward]

The following comes to mind:
https://xkcd.com/538/

Sure it's not a hammer, but incarceration sounds like a reasonably persuasive wrench...

Re:Well...

[zazzel]

Of course, this shouldn't be legal behaviour for the jurisdiction. He DID turn over all documents, so doesn't that constitute compliance with the All Writs Act? Handing over a password (even if it's not forgotten - and that happened to me twice (!) with encrypted volumes) could mean testifying against yourself - and you don't have to do THAT outside of countries supporting The Inquisition's mode of justice.

Re:Well...

[myowntrueself]

The following comes to mind:
https://xkcd.com/538/

Sure it's not a hammer, but incarceration sounds like a reasonably persuasive wrench...

He's a cop. Its a federal detention center. He's being accused of child porn crimes.

Its probably already worse for him in there than being pounded with a wrench.

Re:Well...

[hucker75]

Yip, witch hunts live on.

Surely a fundamental human rights breach?

[advocate_one]

n/t

Re:Surely a fundamental human rights breach?

[phantomfive]

Which fundamental human right?

Re:Surely a fundamental human rights breach?

[Harlequin80]

Fair and reasonable punishment?

Clearly they don't have enough evidence to convict him. So at this stage he hasn't been found guilty of the main crime. However he is refusing to co-operate with a court, but it seems crazy that that could mean he dies in prison.

Re:Surely a fundamental human rights breach?

[Anonymous Coward]

Article 5. No one shall be subjected to torture or to cruel, inhuman or degrading treatment or punishment.
Article 6. Everyone has the right to recognition everywhere as a person before the law.
Article 9. No one shall be subjected to arbitrary arrest, detention or exile.
Article 10. Everyone is entitled in full equality to a fair and public hearing by an independent and impartial tribunal, in the determination of his rights and obligations and of any criminal charge against him.
Article 11.
(1) Everyone charged with a penal offence has the right to be presumed innocent until proved guilty according to law in a public trial at which he has had all the guarantees necessary for his defence.
(2) No one shall be held guilty of any penal offence on account of any act or omission which did not constitute a penal offence, under national or international law, at the time when it was committed. Nor shall a heavier penalty be imposed than the one that was applicable at the time the penal offence was committed.

Source: http://www.un.org/en/universal-declaration-human-rights/

Re: Surely a fundamental human rights breach?

[Anonymous Coward]

so just plant a hd full of rando bits and finger someone. of course its a violation of the justice principles.

Re:Surely a fundamental human rights breach?

[Anonymous Coward]

http://www.un.org/en/universal-declaration-human-rights/

Article 3.
Everyone has the right to life, liberty and security of person.

Article 9.
No one shall be subjected to arbitrary arrest, detention or exile.

Article 11.
(1) Everyone charged with a penal offence has the right to be presumed innocent until proved guilty according to law in a public trial at which he has had all the guarantees necessary for his defence.
(2) No one shall be held guilty of any penal offence on account of any act or omission which did not constitute a penal offence, under national or international law, at the time when it was committed. Nor shall a heavier penalty be imposed than the one that was applicable at the time the penal offence was committed.

These things?

Re:Surely a fundamental human rights breach?

[bug1]

The common sense one

Re: Surely a fundamental human rights breach?

[bug1]

Nothing to hide == nothing to fear

"Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say," - Edward Snowden

https://www.reddit.com/r/IAmA/...

Re: Surely a fundamental human rights breach?

[ZeRu]

He would have complied if there hadn't been anything incriminating on those drives.

Just like people wouldn't complain against The Patriot Act if they weren't supporting terrorism.
But I hope you're just trolling.

Re:Surely a fundamental human rights breach?

[Pepebuho]

Sorry, people accused of CP do not have constitutional rights

Re: Surely a fundamental human rights breach?

[TheReaperD]

Sorry but, as much as we may loathe someone, everyone is equally protected under the Constitution. If you don't like it, move to a country without fundamental rights and see how you like it. I hear North Korea is a good choice if you don't care about rights.

Re: Surely a fundamental human rights breach?

[Racemaniac]

"Brussels has effectively enacted curfew and everybody is fine with it"
as a belgian i must say this is the first i heard about that
probably right after the bombings there was some kind of curfew for a short period when they were still hunting down some suspects, but life is just returning to normal, as you would expect.

Re: Surely a fundamental human rights breach?

[advocate_one]

or Saudi Arabia, Bahrain or Abu Dahbi...

Re: Surely a fundamental human rights breach?

[mwvdlee]

What if the drive does NOT contain child porn but DOES contain information incriminating him of something completely unrelated?
Would the government be allowed to use that other information?

Re: Surely a fundamental human rights breach?

[phantomfive]

What a great quote.

Re: Surely a fundamental human rights breach?

[ShanghaiBill]

so just plant a hd full of rando bits and finger someone.

They could just claim they don't know the password. Please note that the suspect in this case has NOT used that defense. He has instead said that the government has no right to compel him, whether he knows the password or not. He appears to be standing on principle, which is admirable.

Re:Surely a fundamental human rights breach?

[shanen]

Fair and reasonable punishment?

Clearly they don't have enough evidence to convict him. So at this stage he hasn't been found guilty of the main crime. However he is refusing to co-operate with a court, but it seems crazy that that could mean he dies in prison.

Don't need to go as far as fundamental human right. At least not if the Bill of Rights hadn't been perverted to death. Free speech zones? Individual guns and to heck with the well regulated militias. Unreasonable search when they lack sufficient reason to convict him without it plus the requirement he incriminate himself if he actually did something? Sitting there indefinitely is certainly speedy trial, and it also seems like cruel and unusual punishment before conviction of the alleged crime.

Oh well, at least a couple of the Bill of Rights Amendments got skipped or have become irrelevant. No one is quartering troops in private homes these days, eh?

Then again, if he is a child pornographer, it is pretty hard to muster much sympathy. The least bad case is that he's seriously sick in the head, and that still wouldn't reduce the seriousness if he was directly involved in harming any children.

Re: Surely a fundamental human rights breach?

[gijoel]

I heard a good come back to that nothing to hide bullshit.

"If you have nothing to hide, then why are you wearing clothes?"

Re: Surely a fundamental human rights breach?

[Maritz]

Not everyone is quite so keen on get down on their knees and lick boots as you, mate.

Re: Surely a fundamental human rights breach?

[viperidaenz]

So I don't get arrested for indecent exposure. Sometimes I put on extra clothing to keep warm.

Why do you wear clothes?

Re:Surely a fundamental human rights breach?

[martyros]

Which fundamental human right?

The right not to testify against yourself?

Re: Surely a fundamental human rights breach?

[bug1]

Unfortunately Snowdon is branded a traitor by half your country

Not my country... besides, snowdens is a better quote than Franklin's in our current political climate where governments have made people afraid of liberty.

And its not possible to reach everyone, people who wont allow themselves to open their eyes wont be moved by any words, its the moderates that can be influenced.

Re: Surely a fundamental human rights breach?

[CrimsonAvenger]

Unfortunately Snowdon is branded a traitor by half your country

I doubt seriously that half my country even remembers who Snowden is. And that's assuming they ever knew.

The government has a hard-on for Ed Snowden, and a lot of the tech community supports him. Outside that? Not so much....

Re: Surely a fundamental human rights breach?

[kerubi]

You may think you have nothing to hide, but you don't know all the laws. If everything you have done is known, a law that you broke can most likely be found. Everyone has something to hide.

Re: Surely a fundamental human rights breach?

[BlacKSacrificE]

This counterargument is bad. You need to stop repeating this quote.

The framing of this counterargument accepts the basic premise that the only people who have something to hide are "bad people", and that if you're not a bad person then you won't have anything to hide.

You need to engage with and defeat this presumption that the only people who have something to encrypt are pedophiles.

The best free speech analogy is not this "hurr I have nothing to say" retarded horse shit, but a defense of hate speech on the basis that the sword that defends good free speech (political dissent, etc...) must necessarily defend objectionable speech. This context means that, yeah, pedophiles use encryption, and we object to that, but we can't defend our need to encrypt things we all agree need to be encrypted without also defending pedophiles. And that's a shitty trade-off and we all feel bad about it, but it's not ambiguous or up for debate; there's no way we can evaluate this ethical dilemma and end up putting the prosecution of pedophiles and terrorists ahead of our own encryption needs.

Re: Surely a fundamental human rights breach?

[BlacKSacrificE]

This counterargument is bad. You need to stop parroting this quote.

The framing of this counterargument accepts the basic premise that the only people who have something to hide are "bad people", and that if you're not a bad person then you won't have anything to hide.

You need to engage with this presumption that the only people who have something to encrypt are pedophiles.

The best free speech analogy is not this "hurr I have nothing to say" retarded horse shit, but a defense of hate speech on the basis that the sword that defends good free speech (political dissent, etc...) must necessarily defend objectionable speech. This context means that, yeah, pedophiles use encryption, and we object to that, but we can't defend our need to encrypt things we all agree need to be encrypted without also defending pedophiles.

And that's a shitty trade-off and we all feel bad about it, but it's not ambiguous or up for debate; there's no way we can evaluate this ethical dilemma and end up putting the prosecution of pedophiles and terrorists ahead of our own encryption needs.

Re: Surely a fundamental human rights breach?

[ZeRu]

That's why I think The Government should ban all encryption, it will make us feel much more secure /s

Re: Surely a fundamental human rights breach?

[tepples]

I doubt seriously that half my country even remembers who Snowden is.

Even in my country, most don't remember that Snowden is a fictional snowman from 1997.

Re:Surely a fundamental human rights breach?

[gweihir]

They get around that by claiming this is not punishment. This is just incentive to comply with the court's wishes. Of course, to any sane person, that argument is pure evil in itself and cannot hold water at all.

Re:Surely a fundamental human rights breach?

[cdrudge]

Article 5 - He's not being subjected to any of those (at least no more than any other jail inmate...but that's another issue)
Article 6 - Not sure how that applies here
Article 9 - It wasn't arbitrary. There was a lawful court order. He didn't comply. Contempt of court.
Article 10 - He had a fair and public hearing hearing. Multiple likely.
Article 11(1) - He has been presumed innocent from the original charges. He's being held in contempt
Article 12(1) - He hasn't been found guilty of a penal offense. He's been found in contempt of court. This article subsection applies to ex post facto laws.

Re: Surely a fundamental human rights breach?

[Wycliffe]

encryption = malfeasance.

I've recently installed ubuntu on my kid's computers. During installation, there is a single checkbox that says "encrypt harddrive" and it's done. My kids also are notorious for changing the password to something cute and then forgetting it. I also have a box of old harddrives that I pulled from system before disposing of the systems. Again, I don't have the passwords for these old drives. If the FBI busted into my house, they would find multiple computers with encrypted drives that I don't have access to plus a box full of encrypted drives that I also don't have access to. And this somehow makes me guilty of a crime???

Re: Surely a fundamental human rights breach?

[bug1]

You need to stop acting like a one size fits all solution is the only way forward.

Re:Surely a fundamental human rights breach?

[silas_moeckel]

PS every able bodied male 17-45 is part of the militia, if you realy want to use that definition we (17-45 year old men) should all automatically be able to own and carry guns by proving nothing more than citizenship age and gender.

Oddy I dont think every 17 year old male gangbanger should have a gun.

Re:Surely a fundamental human rights breach?

[sjames]

You're a pedophole aren't you? SHAZAM! all your rights are gone! Now shut up while we dismantle your house nail by nail looking for whatever.

Re: Surely a fundamental human rights breach?

[myowntrueself]

so just plant a hd full of rando bits and finger someone.

They could just claim they don't know the password. Please note that the suspect in this case has NOT used that defense. He has instead said that the government has no right to compel him, whether he knows the password or not. He appears to be standing on principle, which is admirable.

and his identity is being concealed by the government which makes it hard for people to rally around him.

Re: Surely a fundamental human rights breach?

[myowntrueself]

What if the drive does NOT contain child porn but DOES contain information incriminating him of something completely unrelated?
Would the government be allowed to use that other information?

The coolest outcome would be if the drive contains evidence of major crimes by the Philadelphia police department going all the way to the top and that he finally does relent and hands over the password to the feds.

Re:Surely a fundamental human rights breach?

[Caesar Tjalbo]

Article 5. No one shall be subjected to torture or to cruel, inhuman or degrading treatment or punishment. Article 6. Everyone has the right to recognition everywhere as a person before the law. Article 9. No one shall be subjected to arbitrary arrest, detention or exile. Article 10. Everyone is entitled in full equality to a fair and public hearing by an independent and impartial tribunal, in the determination of his rights and obligations and of any criminal charge against him. Article 11. (1) Everyone charged with a penal offence has the right to be presumed innocent until proved guilty according to law in a public trial at which he has had all the guarantees necessary for his defence. (2) No one shall be held guilty of any penal offence on account of any act or omission which did not constitute a penal offence, under national or international law, at the time when it was committed. Nor shall a heavier penalty be imposed than the one that was applicable at the time the penal offence was committed.

Source: http://www.un.org/en/universal...

I like the list but they don't count in Guantanamo Bay.

Re:Surely a fundamental human rights breach?

[Grishnakh]

Oh well, at least a couple of the Bill of Rights Amendments got skipped or have become irrelevant. No one is quartering troops in private homes these days, eh?

Actually, they are: there was a case a few years ago in Henderson, Nevada where a homeowner filed a lawsuit against the Henderson Police Department which included a 3rd-Amendment complaint. Apparently the police demanded to use his house as a temporary base for spying on one of his neighbors, and when he refused, they murdered his dog, beat him to a pulp, arrested him, and proceeded to use the house anyway, causing massive damage to it.

Re: Surely a fundamental human rights breach?

[Dread_ed]

and his identity is being concealed by the government which makes it hard for people to rally around him.

Odd that. Generally the first thing the police do when someone is accused of any CP violation is to release their information to the public, preferable before any of the evidence has been reviewed and definitely before there has been a trial of any kind. Strange that they would make the decision to not completely destroy this person's reputation as they have done with every other individual previously.

Re: Surely a fundamental human rights breach?

[Dread_ed]

If that information is what is on the drive you can bet your bottom dollar that if he gives up the password the drive would be proven to contain nothing but the foulest CP ever. No one would lament that he was placed in general population the night before his trial and his cell mates, violent men serving life sentences without the chance of parole, who were brutally sexually abused as children, had somehow been misinformed that he was child rapist.

A stretch, I know, but a system where this is even remotely plausible has too much power.

Re: Surely a fundamental human rights breach?

[myowntrueself]

If that information is what is on the drive you can bet your bottom dollar that if he gives up the password the drive would be proven to contain nothing but the foulest CP ever. No one would lament that he was placed in general population the night before his trial and his cell mates, violent men serving life sentences without the chance of parole, who were brutally sexually abused as children, had somehow been misinformed that he was child rapist.

A stretch, I know, but a system where this is even remotely plausible has too much power.

Throw in the fact that his identity is, for now, being concealed by the courts... they may be worried about something like this.

Re: Surely a fundamental human rights breach?

[TheReaperD]

My statement was in general, not just about this specific case.

Re:Surely a fundamental human rights breach?

[hucker75]

Coming from the UK, your use of the word gangbanger is amusing. It means something completely different over here.

What?

[Edis Krad]

The fifth + habeas corpus? This guy has the shittiest lawyer ever or am I missing something?

Re:What?

[Derekloffin]

Unfortunately for this guy, the 5th has been established to NOT apply in this circumstance, as it is not the suspect's testimony they are seeking, but instead to access something he possesses. It has been likened to if a person has a safe the police have a warrant to search, the person in charge of said safe must provide access to it. I believe the most a lawyer could do for him, given the case law, is get him to enter the password in private so as to not be seen, but that's about it. Now that doesn't mean it is just, but that's what the rules of the system are currently.

Re: What?

[TheReaperD]

Actually, there's case law in the opposite position as well that says you cannot be forced to give over a password under the 5th Amendment; physical encryption keys is another matter. Eventually, this will need to be ruled on by the SCOTUS. He's going to have to wait until his case gets cleared by a judge.

Re:What?

[Edis Krad]

It's still the fifth
https://en.wikipedia.org/wiki/...

Re:What?

[Ihlosi]

but instead to access something he possesses.

A password is not a physical object and hence cannot be possessed. Of course, if the suspect had written down the password, the police could search him, his possessions or any place where the hardcopy is suspected to be for it, because the hardcopy is a physical object and can be possessed.

Re:What?

[phantomfive]

Here is an analysis of the topic. So far, the question has not been addressed by the supreme court, and other courts have issued mixed decisions.

Re:What?

[Ihlosi]

There's a reason that the prosecution asserts the All Writs Act

Could the all writs act be used to force a suspect to produce a written confession?

"We want you to write down what you know, otherwise we'll jail you indefinitely."

Re:What?

[linuxrocks123]

You're almost completely wrong.

Supreme Court case law is 5th Amendment says you don't need to provide a password to a safe. 11th Circuit case law expands this to say you don't need to provide the password to an encrypted disk.

There are no district court decisions which support your position, exactly. There are a few district courts and the Supreme Court of Massachusetts which rather obviously misapplied the foregone conclusion doctrine to get the result they wanted in specific cases, but nothing else.

Pennsylvania isn't in the 11th Circuit. The EFF supports an expansive 5th Amendment when it comes to disk encryption, so I suspect the EFF may take this case up and appeal it to get some precedent set, now that they know about it.

Re:What?

[ole_timer]

under the 5th he can't "utter" the pass phrase, but he can be compelled to produce the unencrypted contents in most jurisdictions. that's what he is most likely in contempt of without reading the whole case.

Re:What?

[gweihir]

Nonsense from the side of information theory. But this is not about truth at all, this is about the exercise of power.

Re: What?

[MatthiasF]

And the difference between a password and an encryption key is what exactly? The length of the string?

Are they not the same damn thing?

Re:What?

[Agripa]

Except that you don't have to comply with opening your own safe if you're a suspect; if you don't, the police will just hire someone to crack the safe.

And it is not like it is impossible to crack any symmetrical or asymmetrical encryption using brute force. It will only take at most the same amount of time that a copyright of "limited" time can exist thanks to the Supreme Court's ruling on that subject.

Re:What?

[drinkypoo]

The EFF supports an expansive 5th Amendment when it comes to disk encryption, so I suspect the EFF may take this case up and appeal it to get some precedent set, now that they know about it.

I suspect they won't, unless they are quite sure that this guy doesn't have CP. They don't need to get associated with CP, even with the best of intentions. That would be a misstep.

Re:What?

[Tjp($)pjT]

Well, some powerful legal scholars and the court cases they describe disagree and state that in this exact predicament the 5th does apply. The so called Fischer test fails on point 3 and the burden is on the government. They warn that if this were not the case one could be jailed for contempt, and that is exactly what happened in this case. Likely the incarcerated lawyer did not push this hard enough, or the judge chose to ignore it. But without all the details we may fall short of the understanding needed to make an argument one way or the other. But understanding this person may not know, may have forgotten, or some other individual may have applied the FileVault passphrase, or may just be such a willful person (and two years makes that self evident) that he will never reveal the passphrase if he knows it; he should be released. The current zeal the courts are using to make encryption a worthless technology is unwarranted. Least people think this is a new problem, read the paper from the above link. Thomas Jefferson invented an encryption for mailed messages that was not broken for 100 years apparently. this problem is not modern at all and has been tested in courts since the beginnings of the U.S.A.

Consider if this hard drive contains emails between this defendant and his lawyer, thus privileged communications. Or contains material related to confidential informants. Disclosure in open court could be disastrous ... and in the former would violate the defendants rights in yet another way.

We have lost sight of the American concept that it is better to let a dozen guilty people go free that to jail one innocent man. Our prisons have uncounted numbers of innocents, some lucky enough to have people interested in freeing them to preserver until they are vindicated. Some innocents die having exhausted all appeals and they are executed. It is very sobering to look at The Innocence Project and understand many of these people lost decades behind bars while innocent.

Re:What?

[linuxrocks123]

No, it doesn't. Derivative use is still use. Testimony is considered incriminating when it provides any link in the chain of obtaining incriminating evidence.

What you describe is known as the "manna from heaven" theory of evidence. It was dubbed that sarcastically by the Supreme Court when ruling it was bogus.

Re:What?

[linuxrocks123]

They already have filed an amicus in this case. They also represented a child porn suspect in the 11th Circuit where they won and set a precedent that the 5th Amendment applies in these cases for that circuit.

Civil liberties advocacy organizations represented abhorrent groups and people fairly frequently, because the authoritarians come for them first. The ACLU represented the KKK in its lawsuit to win the right to publicly march, and won.

Re: What?

[TheReaperD]

The difference, from a legal perspective is a password is knowledge in your mind that you would be forced to give testimony to provide it to unlock a drive and could be protected under the 5th amendment over self-incrimination whereas encryption keys work like regular keys in the fact they are not knowledge you possess but, a virtual item that you can pass to law enforcement without saying a word just like handing over a key to a safe so, no 5th amendment option. Of course what they feds are trying to do is create a 5th amendment loophole by not requiring him to tell them the password but, instead that he can type it in himself so that there will be no testimony provided. It's a sneaky attempt to do a end-run around the bill of rights and I hope the SCOTUS doesn't go for it.

Re: What?

[TheReaperD]

It's just an attempt to do a dirty end-run around the 5th amendment and law enforcement should be smacked for it.

Re:What?

[david_thornley]

Actually, no. Copyright duration is unlikely to be extended more than a few decades at a time, every time Steamboat Willie is approaching public domain. Therefore, it's not likely to be for many years after the Earth is no longer inhabitable. Cracking AES-256 by brute force is likely to take much longer.

Re:What?

[Agripa]

Cracking AES-256 by brute force is likely to take much longer.

But still a "limited time" as defined by the Supreme Court.

Re:What?

[rhazz]

+1. There will likely be another case within 5 years that won't be quite as unappetizing to the public.

5th ammendment

[Anonymous Coward]

As much as I lack all sympathy for people in possession of child pornography, how is this not against the fifth amendment?

Re:5th ammendment

[Anonymous Coward]

Modded you up, god knows how many comments before it took an AC to point out what is the heart of this.

You can't be forced to bear witness against yourself

"nor shall be compelled in any criminal case to be a witness against himself,"

There it is in plain English. The judge holding this man till he complies needs to be tarred feathered then set on fire.

Re:5th ammendment

[Anonymous Coward]

Personally I don't care about the child pornography pictures and movies. More precisely, to me they're evidence of wrongdoing, they're horrible and I never want to look at them, but they in and of themselves shouldn't be criminal to possess.

That last bit is because it's too easy for another miscarriage of justice to claim another victim. Just punishing for possessing pictures is folly and it doesn't really matter what is in the pictures at all. Worse, the law as it stands means manpower is wasted on symptoms and it drives the real perps, those who actually abuse children making the filth, that much deeper underground, making them harder to catch. I want child abusers to be caught, and for that I want law enforcement to be effective, not stupid and petty. This here case is a good example of stupid and petty, even though apparently this specific situation has been twisted not to fall under the fifth.

What we should do instead? Keep a close eye on people who like child porn and make sure they never get close to actual children. In such situations it's much better to know people's tastes and remain vigilant than to try and punish for "poor taste" just so you no longer have to think about it.

Anyhow, I suspect this guy might figure he's much better off indefinitely imprisoned without conviction than being a cop and a convicted child botherer in prison, effectively until his death in any case. I say might because maybe he's just dug his heels in on principle and is in it to spite the system, even at the cost of life inprisonment without conviction in a supposedly free and just country. Also because being declared not guilty doesn't get him his job back, or his reputation, and this way he's guaranteed minimal but humane treatment. So he's in a bad situation but his options at change are worse. Better to be stuck in limbo then. I know I'd be very tempted to not give in just on principle, regardless of what's on the hard disk drives.

Re:5th ammendment

[phantomfive]

You don't have to be a witness against yourself, but you do have to provide physical evidence. For example, if a fingerprint or blood was found at the crime scene, you can be compelled to give your fingerprint or blood to test for a match.

The purpose of the 5th amendment is to prevent situations where police can torture you, or harass you until you confess. That isn't really an issue in the case of DNA or a fingerprint, because the police can't harass your fingers or blood into confessing.

Even so, the courts are conservative, and won't force you to give evidence if it can be found some other way. For example, they can't force you to open a combination lock on a safe, because the police have the capability to crack the safe. So the court won't force you to do that.

In the case of an encrypted hard drive, there may be no other way to get the evidence other than the owner decrypting it. So how will the courts rule? I have no idea, it's a complicated case, and the use of the "all writs act" makes it even more complicated. As likely as not, the court will rule based on a strange technicality in order to avoid the heart of the problem.

(A person can be held indefinitely if they defy a court order, they will be in contempt of court. I think that is true in basically every jurisdiction in the world. The power of the law is heavy).

Re:5th ammendment

[Ihlosi]

You don't have to be a witness against yourself, but you do have to provide physical evidence.

No. You just have to refrain from resisting the authorities (lawful) attempts of obtaining such evidence.

For example, if a fingerprint or blood was found at the crime scene, you can be compelled to give your fingerprint or blood to test for a match.

No, you can't be compelled to give blood. You can be compelled to refrain from resisting the authorities' attempts to draw blood (or rather: If you resist, you'll be properly restrained first, then your blood will be taken, and then you'll be jailed for resisting). Same thing for fingerprints. If you don't want to get ink on your fingers yourself, the authorities will perform the necessary movements for you.

In the case of an encrypted hard drive, there may be no other way to get the evidence other than the owner decrypting it.

A (written) confession is also physical evidence. Sometimes, there may be no other way to get this evidence than jailing the suspect indefinitely until he produces it. Think about it.

Re:5th ammendment

[Ihlosi]

How is jailing someone indefinitely to get a confession different from torture?

Torture is more unpleasant, but less boring.

Re:5th ammendment

[Ihlosi]

On the other hand, no matter what coercion you use to get him to enter the password, you can't choose what decrypted data you get.

Yes, you can. Just assume that XOR-encryption with a OTP was used; for any such ciphertext you can come up with an appropriate "key" that produces any plaintext you want.

Either he enters the wrong password and you get junk,

"Oh, well, yes I did in fact store 234 GB of seemingly random data on that disk, to use as a quick and easy source of random number."

Re:5th ammendment

[The Rizz]

Personally I don't care about the child pornography pictures and movies. More precisely, to me they're evidence of wrongdoing [...] but they in and of themselves shouldn't be criminal to possess.

The problem with this argument, and the reason it's been deemed illegal, is that if it's legal to possess something, someone will be happy to sell it to you. If there's money to be made with something, people are more likely to do it, even if it's illegal. Legalizing child pornography leads to a greater incentive to create child pornography.

It's basically the same reason it's illegal to hire a hit man.

There is also a secondary reason, and that's that any child in such a situation cannot have legally given consent to be involved. If it's legal to own, then there is no legal recourse someone would have to remove pornographic pictures of themselves from somewhere. For example, how about seeing something like this on store shelves at the local video store with a nice big sign saying "local talent's first film"?

Re:5th ammendment

[DigiShaman]

In the case of an encrypted hard drive, there may be no other way to get the evidence other than the owner decrypting it.

A (written) confession is also physical evidence. Sometimes, there may be no other way to get this evidence than jailing the suspect indefinitely until he produces it. Think about it.

They have the physical evidence already, the drives. The can copy and replicate the encrypted data to their hearts content. No, what they want is KNOWLEDGE, and it's knowledge that's immaterial. Being that this information is an extension of what's in his brain - requiring the final key to decode - how can the 5th not apply in this case??!!

Re:5th ammendment

[cdrudge]

Personally I don't care about the child pornography pictures and movies. More precisely, to me they're evidence of wrongdoing, they're horrible and I never want to look at them, but they in and of themselves shouldn't be criminal to possess.

Should it be criminal to possess money from a bank robbery? How about merchandise that was shoplifted? You might not have been the one that stole the money or merchandise, but at minimum it should be forfeited and possibly additional criminal charges if it can be demonstrated you were complicit in the original crime.

Similarly, CP is illegal to possess as it discourages it's trading and acquisition. If it wasn't illegal as you'd suggest, only the initial individual who created it would be liable. And subsequent trading would absolve later individuals of any wrongdoing. It'd create a market for the perpetual transfer of CP without legal consequences from the originally illegal activity.

Re:5th ammendment

[Anonymous Coward]

Personally I don't care about the child pornography pictures and movies. More precisely, to me they're evidence of wrongdoing [...] but they in and of themselves shouldn't be criminal to possess.

The problem with this argument, and the reason it's been deemed illegal, is that if it's legal to possess something, someone will be happy to sell it to you. If there's money to be made with something, people are more likely to do it, even if it's illegal. Legalizing child pornography leads to a greater incentive to create child pornography.

It's basically the same reason it's illegal to hire a hit man.

There is also a secondary reason, and that's that any child in such a situation cannot have legally given consent to be involved. If it's legal to own, then there is no legal recourse someone would have to remove pornographic pictures of themselves from somewhere. For example, how about seeing something like this on store shelves at the local video store with a nice big sign saying "local talent's first film"?

Yeah, they say that.... but then they hold that animated depictions of children in erotic situations are child pornography and are illegal. So even when there is no child involved at all, it is still a crime. This knocks that "for the children" argument off the table, even though pedophiles do some evil and demented stuff to children in order to produce real kiddie porn.

It is illegal primarily because it is icky. And very few people are willing to go to the mat over something as sick as getting off to images of little kids. Heck, I hesitate to even bring up the point because some idiot is bound to think that I'm arguing in favor of kiddie porn. In fact, I'm gonna post anonymous because folks tend to be incapable of actually comprehending a nuanced argument when "for the children" is involved, and I don't need the drama.

We see the same impulse with vaping. Even though e-cigarettes are orders of magnitude more safe than real cigarettes, the anti-tobacco folks are out for blood on vaping - because it reminds them of smoking cigarettes. Even though all evidence suggests that having e-cigarettes available as an alternative to cigarettes will save lives, our governments are moving to eliminate them as an option.

Similarly, from what I've read psychologists think that looking at kiddie porn can be an outlet for pedophiles and might reduce the impulse to actually act out on their fantasy. So if they are right, then animated kiddie porn might be a way to prevent harm to children. Which makes the finding that animated kiddie porn counts as illegal kiddie porn kinda ironic.

Re:5th ammendment

[Ihlosi]

Being that this information is an extension of what's in his brain

Yes. The need an expert witness. Unfortunately, the only available expert witness is the defendant. They're requiring him to be an expert witness against himself.

how can the 5th not apply in this case??!!

This.

Re:5th ammendment

[organgtool]

As much as I lack all sympathy for people in possession of child pornography

You might want to be careful about saying that. With all of the vulnerabilities in software these days, it would be relatively easy to have someone take advantage of one of those vulnerabilities to upload some reprehensible images to your computer and leave you with one hot potato on your lap. That's my main problem with any laws of possession: the burden of proof that you willfully obtained the contraband is so low that you're effectively presumed guilty until you prove otherwise.

Re:5th ammendment

[SLi]

That's a nice theory, but unfortunately it's wrong. For example, it has been established that compelling a suspect to give a handwriting sample (Schmerber v. California, 384 U.S. 757 (1966)) or to speak for voice identification (United States v. Dionisio, 410 U.S. 1 (1973)) does not violate the Fifth Amendment. Also permitted is compelling a suspect to sign a document that e.g. a foreign bank requires to release some information, although I'm too lazy to come up with a reference.

Re:5th ammendment

[Ihlosi]

a suspect to give a handwriting sample

Great. So what would they do if the suspect deliberately writes differently than he usually does? "We're sorry, Mr. Suspect, your handwriting does not match the ransom note we believe to be written by you, try again."? Or "We're sorry, Mr. Suspect, your handwriting does not match the stack of other documents we know to be written by you." (... then why does the court need yet another handwriting sample?).

speak for voice identification

Same thing here. Suspect deliberately changes his voice, so what do they do? "Sorry, your voice does not match the recording of the death threat we believe to be made by you, try again.", or "Sorry, your voice does not match the voice we know you have." (... then why does the court need yet another voice sample?)

Re:5th ammendment

[Bob the Super Hamste]

But if the police have the drives they have the physical evidence. What they want is for you to provide information to them but that information my prove his guilt and would against hist 5th amendment rights. Also what I have long wondered is as a person under investigation does one have to assist the prosecution in interpreting data? In other cases it seems like it has been well established that one does not have to assist investigators so long as one doesn't interfere with actions they undertake. If police have a warrant to search my house I can't stop them from searching but I am under no obligation to help them find what they are looking for. Same thing with cracking a safe I can't stop them from drilling out the lock but I in no way have to help them drill it out. A password to an encrypted volume is very much like a combination to a safe, just a safe that can't be drilled out in this universe.

Re:5th ammendment

[Agripa]

I'm all for strong encryption and absolutely against government-mandated backdoors, but I think in principle this is actually okay. This is the appropriate flip-side of having strong encryption that the government can't break. If, with probable cause, they subpoena you for access to the existing content, you should provide it.

The problem with this is the same as when the government pinky swears that it will not seize and search every bit of data traversing the internet with or without a warrant or due process; there is no way to hold them to it short of strong encryption which creates an arms race that they will lose and not only do they lose the ability to inspect data without a warrant, they also lose the ability to inspect encrypted data even with one. One of the papers which came out of the NSA said this very thing; once they get caught siphoning up domestic data, the increased use of encryption in response is going to make it more difficult for all law enforcement. Well, that happened.

Deniable encryption can be used. Now what does the court do? And if that is not sufficient, there are way to store an encryption key or password such that it cannot be seized without destruction or at least making it likely that it is no longer available. For instance store the password in the ordering of a deck of cards.

The only solutions to these problems are statutory which just brings the issue out into the open where they do not want it. It was a much better situation for them when everybody thought their communications were secure when really they were not.

Re:5th ammendment

[phantomfive]

Look bro, I wasn't making a legal argument. I was giving you examples to help you understand the situation.
But instead of understanding, you did the stupid thing and started arguing with me. As a result, you still don't understand the situation.

If you want to argue, you need to understand the full legal argument first, but you don't. Put some effort into it.

Re:5th ammendment

[phantomfive]

What they want is for you to provide information to them but that information my prove his guilt and would against hist 5th amendment rights.

Providing information is not against the 5th amendment rights, I gave two examples of cases where it's not, and if you use Google, you can find others.

Re:5th ammendment

[sjames]

So make it illegal to provide or make it.

Re:5th ammendment

[bingoUV]

So what would they do if the suspect deliberately writes differently than he usually does?

Handwriting analysts claim that they can find the true writer from even a deliberately uncooperative sample provider.

Suspect deliberately changes his voice

Here, there is some evidence that there is some uniqueness to the voice that cannot be faked. Techniques such as these are used to synthesize voice - it should be possible to analyze voice of deliberately uncooperative sample provider.

Re:5th ammendment

[future assassin]

You don't have to be a witness against yourself, but you do have to provide physical evidence. For example, if a fingerprint or blood was found at the crime scene, you can be compelled to give your fingerprint or blood to test for a match.

They already have the evidence, what’s in his mind is not physical evidence.

The purpose of the 5th amendment is to prevent situations where police can torture you, or harass you until you confess.

Being jailed forever without being convicted to force you to give up what is in your mind, is torture.

Re:5th ammendment

[phantomfive]

Sounds like you have a really sophisticated understanding of the law here. Like, I'll bet you learned about it in junior-high or something.

Re:5th ammendment

[future assassin]

Yah I watched you play slashdot lawyer and figured why not play the same game.

Re:5th ammendment

[guruevi]

So what's the difference between encryption governments can't break and a law that requires you to give the password (as you propose)? Probable cause is (sometimes) enough for a warrant, not enough for a conviction.

You're going around the "beyond a reasonable doubt" clause by just jailing someone with "probable cause"? Then people don't need any courts anymore, the police can just say "I think he did something bad" and the judge goes "well, jolly good, put him in 10y for contempt of court then". There would be no need for trials or juries because judges would have ultimate power to jail someone at a whim.

Re:5th ammendment

[BlueStrat]

In the case of an encrypted hard drive, there may be no other way to get the evidence other than the owner decrypting it.

        A (written) confession is also physical evidence. Sometimes, there may be no other way to get this evidence than jailing the suspect indefinitely until he produces it. Think about it.

They have the physical evidence already, the drives. The can copy and replicate the encrypted data to their hearts content. No, what they want is KNOWLEDGE, and it's knowledge that's immaterial. Being that this information is an extension of what's in his brain - requiring the final key to decode - how can the 5th not apply in this case??!!

Because we the government say so and we will happily imprison or kill anyone who opposes us. We've already fully subverted the election process such that anybody we allow you to vote for is already under our control.

What are you gonna do about it?

Pick up that can!

Strat

Re:5th ammendment

[phantomfive]

Yeah, I see you decided to play foot-in-mouth instead.

Re:5th ammendment

[idji]

I thought it was up to the prosecution to provide evidence rather than force the defendent to provide that evidence? Why should he have to prove his own guilt or innocence? The burden of proof is on the prosecution. Isn't what he said the same as "no comment"?

Re:5th ammendment

[The Rizz]

So make it illegal to provide or make it.

This could theoretically work nearly as well as the blanket ban.

Re:5th ammendment

[Verdatum]

The evidence existing to support this claim that handwriting analysts make is somewhere between horrible and nonexistent. Not to mention that a professional handwriting analyst has an obvious bias; they want to remain employed.

Re:5th ammendment

[beastofburdon]

Handwriting analysts claim that they can find the true writer from even a deliberately uncooperative sample provider.

And they are lying.

Re:5th ammendment

[bingoUV]

Yes, I'm much more convinced by the voice analysts.

Re:5th ammendment

[bingoUV]

I won't be surprised. I'm much more convinced by the voice analysts.

Re:5th ammendment

[Ihlosi]

And they are lying.

Oh, that is such a nasty word. Just call if "self-marketing".

Re:5th ammendment

[beastofburdon]

There is a reason we have so many detective shows these days, and it isn't because they are popular. Those shows are a psyop designed to make people believe that our current forensic techniques work several orders of magnitude better than they actually do.

Handwriting analysis, voice analysis, hair analysis, bite mark analysis, lie detector tests, and many more are no more accurate than a blind guess between 1000 suspects.
While they are much more accurate than these, fingerprints and DNA analysis are claimed to be much more accurate than they really are too. It is possible to have an absolute identification with them, but the tests required are extremely expensive and not used in law enforcement ever. The DNA tests used only look at a very small portion of DNA and the fingerprint tests only look at 5-9 points in the fingerprint when matching.

Our "justice" system relies on the false belief in these forensic tests that these shows give people. They should be prefaced with a disclaimer saying "Forensic techniques used in this program are greatly exaggerated or outright fictional and bear no resemblance to reality."

Re:5th ammendment

[rastos1]

For example, if a fingerprint or blood was found at the crime scene, you can be compelled to give your fingerprint or blood to test for a match.

No, you can't be compelled to give blood. You can be compelled to refrain from resisting the authorities' attempts to draw blood (or rather: If you resist, you'll be properly restrained first, then your blood will be taken, and then you'll be jailed for resisting). Same thing for fingerprints. If you don't want to get ink on your fingers yourself, the authorities will perform the necessary movements for you.

One of us is confused about what the word "compelled" means.

Encryption is useless

[Anonymous Coward]

As it is plain to see. What good does "unbreakable" encryption (if such an animal would really exist) do if you can simply be forced to reveal the passwords? None at all. You might as well forget about it and uninstall all encryption software now - lest it one day be taken as evidence you're hiding something - and get on with your life. Do not make waves. Do not raise suspicion. Conform. Is that so hard to do?

Re:Encryption is useless

[Kokuyo]

Actually, yes it's hard. I've been failing at it since primary school.

I expect as much as I've killed my social status in the past by adhering to my principles and my sense of how it should be, it could very well happen that one day I'll go out guns blazing, literally.

Conforming is for lower ranks of the pack. Betas can have it hard: They don't have a drive to lead yet will not bow to you unless you prove yourself worthy. Wanna take a guess how many worthy leaders I've met in my time?

Re:Encryption is useless

[MartinG]

Of course it's not useless.

I use full disk encryption all of the time. The threat I'm protecting against is losing my laptop, having it stolen, or selling it and risking someone getting their hands on all my passwords etc that are saved on there.

I'd quite happily decrypt it given a warrant.

Most reasons for using encryption and other privacy tools are not about avoiding capture by law enforcement - far from it.

Having said that I am troubled by cases (and I don't know the details for this particular one) where forgotten keys or passwords somehow imply guilt.

Re:Encryption is useless

[Stuarticus]

Didn't you feel a bit of an idiot when you read that back?

Re:Encryption is useless

[LQ]

... it could very well happen that one day I'll go out guns blazing, literally.

Ah, yes, the American Dream.

Re:Encryption is useless

[CrimsonAvenger]

Conforming is for lower ranks of the pack. Betas can have it hard:

On a completely unrelated note, I read recently that the whole alpha/beta/pack thing is a crock. A wolf pack in the wild doesn't have that structure. What it has is Dad/Mom/kids.

Yep, the "alpha male" is really just Dad. And the "alpha female" is Mom. "Betas" are the kids....

Re:Encryption is useless

[Kokuyo]

Alive and kicking, right here in Switzerland ;).

Re:Encryption is useless

[Luthair]

This sort of thing is why Truecrypt had a number of options around fake partitions etc.

Re:Encryption is useless

[Kokuyo]

I'm not sure why you're trying to attack me by questioning my intelligence when you didn't even have the common decency to point out what it is that you find idiotic and at least a reason why.

Don't you feel like a bit of an idiot for, indirectly, calling someone names who did nothing else than stating a bit of personal experience?

Re:Encryption is useless

[Bob the Super Hamste]

Personally even though I am in the same situation as you (nothing to hide from authorities) I would still tell them to piss off. I've done it to roaming TSA who asked if they could search my bag, I've done it to cops who have asked if they could search my car, I would do it to here as well. In the car incident they stuffed me in the back of the squad car and got a K-9 unit that happened to alert at the trunk, in the trunk they found my tool box, a couple quarts of oil, a set of spare belts (that fucking car threw belts all the time), a tire iron, spare tire and a jack, that was it. They dumped all of my tool out on the ground to "search" them so I got the joy of picking that mess up.

With the TSA agent they were kind enough to ask "Can I search your bag?" indicating that I had a choice and I responded with no. This horribly confuses them and resulted in re asking the question and getting the same response. The agent went and caller for their supervisor who also asked the same question and got the same response. The supervisor called his manager who then asked the same question and got the same answer. Eventually I was told by the highest person that they were going to be searching my bag. I responded that I do not consent to this search as it is a violation of my 4th amendment rights as they have neither probabal cause, reasonable suspicion, or a warrant as my person and effects were already screened while going through the security line. In the end they still did search my bag and found 2 changes of dirty cloths, a spare set of clean cloths, my work laptop, my phone, a note book, 2 pens, and my headphones. While in the end they still searched my bag I did waste over half an hour of each of their time which in my book is a net worth as was just waiting at the gate for my plane.

Re:Encryption is useless

[Grishnakh]

That reminds me of the adage about boiling a frog. Real frogs apparently aren't that stupid: they jump out when the water gets too warm.

Wrong password metod

[emanuele_fanton]

This is why it is suggested to use a hidden crypted partition witihin a crypted partition http://www.makeuseof.com/tag/c...

Need for timebased passwords

[dr.Flake]

On could imagine a service that is time dependant

Like, you have to log in every three months, or everything is deleted forever. That would be the only place, where a paraphrase is stored that is so complex you cant be expected to be able to remember.

You don't even have to actively use the service.

You just wait three months, than you say: "well I was using this service called KorsakovOnline.com, but they seem to have completely forgotten that i used their service and now they have deleted my profile and data, and they dont keep backups you know. So now its up to you to prove that i am even capable of providing the password."

Your move Mr Prosecutor

Re:Need for timebased passwords

[Kkloe]

can you trust them from the start that they will keep your stuff secret?, if it was so easy then even companies wouldnt care for having their own servers with secrets, but all comes to the trust part.

Re:Need for timebased passwords

[dr.Flake]

What keeps you from having another copy hidden even better from the man?

Mr Snowden was travelling the world with very dangerous and valuable information. Lets say the Chinese caught him and started to ask him questions in a rigorous manner? After a short time the drive would have become completely valueless.

Re:Need for timebased passwords

[Verdatum]

That wouldn't work at all. Figure out the service the suspect is using, serve it with a warrant for the encrypted data. Snapshot the system so that the clone doesn't realize that time has passed. Sit on the suspect for the password just like they're doing to this dude.

Re:IANAL, but...

[Kkloe]

Maybe because you are not giving them any evidence, you are giving them access, there is no evidence in the encrypted drive until they have found something.

Re:IANAL, but...

[Ihlosi]

you are giving them access

The suspect does not have to give the authorities access to anything; the authorities may, in this case, legally use force to remove any physical obstacles that keep them from obtaining the object(s) in question.

Re: Is it even child porn?

[loufoque]

The right solution to this problem is to get rid of all the laws preventing possesion of data. The whole concept is stupid, and it is easily abused.
Want to prevent child porn? Make distribution illegal, not possesion.

Scary

[mw]

Hmmm... what if you forgot the password? I've a USB stick with an encrypted volume for storing passwords and other private data, and the password is nowhere recorded. Should I forget it and come in conflict with the law I'm going to end in jail forever for having bad memory?

Seems like encryption without any precautions is really dangerous.

Re:IANAL, but...

[Kkloe]

Just some quick thing i found on the web:

933.15 Obstruction of service or execution of search warrant; penalty.--Whoever shall knowingly and willfully obstruct, resist, or oppose any officer or person aiding such officer, in serving or attempting to serve or execute any search warrant, or shall assault, beat or wound any person or officer, or his or her deputies or assistants, knowing him or her to be such an officer or person so authorized, shall be guilty of a misdemeanor of the first degree, punishable as provided in s. 775.082 or s. 775.083.

wouldt this apply?

Smart move

[Anonymous Coward]

Given what we know about the US legal system, this guy is looking forward to a early retirement with a out-of-proportion settlement for damages.
I suspect that within 6 months he will get an epiphany, remember the password, and the drive will turn out to have his collection of grannyporn.
The sister is in on the scam, surely. They both will retire to Panama or some such.

Re:IANAL, but...

[Ihlosi]

wouldt this apply?

If the "obstruction" was already in place before the warrant was served or executed, the person in question had no knowledge of the warrant and cannot obstruct it knowingly. Otherwise, it would be illegal to lock your door when you leave the house (the police may arrive at any time with a search warrant and find you absent and your house locked).

*sigh*

[SharpFang]

I wonder how it would go:

I plead the fifth.

There is no child porn on this drive. But there is software, which I have purchased legally, but don't possess the proofs of purchase; they've been lost during a move a year ago. Currently, the copyright-related laws take the approach 'guilty until proven innocent' upon discovery of such software - without proof of purchase I'm automatically assumed to have obtained it illegally. Therefore revealing contents of the drive would incriminate me on a case entirely unrelated to the current one, and in an especially unfair way since despite being innocent I'd be required to prove my innocence, and unable to do it, proclaimed guilty.

Re:*sigh*

[KagatoLNX]

I am not a lawyer. That said, here are a few comments on how I understand things and where I think they'd go. Your mileage may vary.

I always chuckle at this sort of thing. I like to call this "The Reiser Defense". If you ever followed the Hans Reiser trial, you'll note that he had a fundamental misunderstanding of how law works (or even is supposed to work). As a developer, he saw laws as a program. He thought that he had the program set up so as not to be able to convict him.

As it happens, the Law is not a program or set of mechanical rules. The Law may *appear* to be that way, but that's mostly a side effect of one of its goals. The Law is intended to be predictable so as not to be perverse when applied to people. The theory goes that people can only be held accountable for breaking laws if they can reasonably have been expected to know that they would fall afoul of it.

As it happens, this is not a blank check. You have responsibilities not to be entirely ignorant of the law. You have responsibilities to cooperate with law enforcement and the Court. You do not get to interpret the law any more than is necessary to mount your defense. All of your interpretations are subject to validation and endorsement by the Court. So the process surrounding justice use the trappings of a program or set of mechanical rules, but that is largely a construct to allow you to cooperate with the Court in executing the upholding the intent of the Law.

In fact, it's why it's called Contempt of Court. You have rights under the Law. It's the Court's responsibility to uphold those rights for you. Criminals do not respect the Law. If you behave in such a way as to prevent the Law from being applied by the Court, you show contempt for the rule of law and you hurt your chances in being able to exercise your rights under it. This is a fairly obvious social contract, and that contract--not some expectation that the law function as some sort of autistic machine--is what fundamentally underlies Due Process.

The Fifth Amendment is a law like any other. It's intention is to ensure that the parties involved in justice maintain separated duties. The theory is that you and the prosecution make claims and the court evaluates those claims. If the Court were permitted to compel you to make certain claims, then it's no longer really evaluating them and the integrity of the system breaks down. That's the context that Fifth Amendment lives in and that's the context within which Courts will evaluate it. It is not a "technicality" that gets you out of cooperating with warrants. So, while the law cannot force you to say something is true or false against your will, it *can* compel your cooperation in unlocking the filing cabinet containing the evidence that implies the same thing. That's the difference, evidence is different from testimony.

There is a bit of a grey area around combinations / passwords. This is largely due to prosecutors abusing your unwillingness to give them unfettered access to something as being parleyed into some kind of claim of guilt. That's what the Fifth Amendment addresses--your lack of a statement cannot be construed as a claim of guilt. This started with a dissent from the Supreme Court that mentioned that giving up the combination to a lock amounted to testimony that you had access to what it protects. It's similar to a different case where the prosecution subpoenaed "all of the papers that apply to " and the 5th was upheld as saying evaluating which papers were submitted papers would be tantamount to asking for testimony that some of the stuff was illegal. That fine line between testimony and your duty to comply with the collection of evidence by authorities is something best discussed with a lawyer, because it is not a silver bullet.

I believe that your unconventional take on copyright law isn't likely to get you anywhere. You're effectively claiming that Copyright Law puts you in a 'guilty until proven innocent' which is, more precisely, claiming a violatio

Re:*sigh*

[spain]

Since it's now been seven months and counting, he could attempt the tried and true politician-level response:

"I do not recall."

Per https://en.wikipedia.org/wiki/Contempt_of_court#United_States:

"A court cannot maintain an order of contempt where the imposed party does not have the ability to comply with the underlying order. This claim when made by the imposed party is known as the 'impossibility defense'."

Re:*sigh*

[Anonymous Coward]

I'm sure the prosecution will happily agree to a deal where you give them the password and they agree not to use any evidence found on your drive in copyright-related lawsuits. Your turn.

Re:*sigh*

[SharpFang]

Thing is you can be convicted for specific instances of software piracy: Application X, market value $x, fine $x. You can't be convicted "for software piracy in general". They need concrete proofs of concrete violations, and these reside on the disk. General admission won't be enough.

Re:*sigh*

[SharpFang]

Thing is - what if they cabinet contains items that are illegal under an entirely different set of laws than the current case?
In this case I'd be simultaneously prove my innocence in the current case and thoroughly incriminate myself in something entirely different. Or can I somehow force the prosecution to completely ignore everything contained within that doesn't pertain to current case?

Re:*sigh*

[SharpFang]

Are they really at liberty to do so? Can the court or the law somehow guarantee that?

Re:*sigh*

[shawn2772]

Are they really at liberty to do so? Can the court or the law somehow guarantee that?

Absolutely. The court just grants immunity from prosecution for any crime related to copyrights, and does so in writing. If any prosecutor tries to later use copyright-related evidence from the drive, the defendant just produces the written immunity grant and the court excludes the evidence from consideration. Depending on how the deal is written, it can also preclude use of evidence to discover other evidence ("fruit of the poisoned tree"), or even prosecution for evidence discovered completely independently (parallel construction).

This sort of thing happens all the time. Most often it's used to convince a witness to give testimony that implicates the witness in a minor crime, but proves that someone else is guilty of a major crime. But there's no limit to the sort of dealing that can be done. The deals are a form of contract, where the person agrees to do something they aren't otherwise obligated to do in exchange for the court promising to do or not do something.

IANAL, but all it takes is paying attention and you'll see lots and lots of this sort of thing in real life, especially in high-profile cases.

Re:*sigh*

[It doesn't come easy]

The Fifth Amendment is a law like any other.

Hardly. In the first place, the fifth amendment isn't a law at all. It is a declaration of one of the rights enjoyed by all people as believed by the founders. The inclusion of the Bill of Rights into the Constitution was done to EXPLICITLY remind the Federal Government that the people had certain rights that could never be abridged by any law created by the government (the writers of the Bill of Rights did not think the Constitution was clear enough on the rights held by the people, and withheld from the Federal Government, hence their insistence on including the Bill of Rights). So the Bill of Rights are a list of rights that cannot be abridged by any law.

I understand that over the years as a society we have agreed on some very narrow lawful exceptions to the Bill of Rights, but the Bill of Rights amendments are not laws, they are reminders to the Federal Government of the limits to the government's powers.

In addition, one would do well to remember that the Constitution itself is a document that spells out the LIMITS of the powers granted to the Federal Government by the CITIZENS, and not something that governs the citizen. Congress crafts laws, but those laws MUST be allowed by the Constitution, else they are declared unconstitutional. The job of the US Supreme Court is to do just that -- make sure that the government does not exceed it's limited powers.

Re:*sigh*

[guruevi]

Yes, you can be convicted for software piracy in general in the US because software piracy is a federal felony, not a business dispute (as it should be)

Plausible deniability

[burbilog]

That's why we really, really, REALLY need serious plausible deniability, despite of what security experts say about it. They force you to give up keys, you give up keys and they can't do anything else (unless they dismantle whole western law system). While it does not protect you from torture, does protect you from the law.

Re:Plausible deniability

[mysidia]

Divide your crypto key into 3 pieces. You own the third; Two other trusted third parties have the other half.

Every time you open the encrypted vault, you enter a key, and send your password to one of the trusted third parties who.submits their half of the key.

Your trusted third parties have an agreement that you contact them every N days, otherwise, they will automatically perform a secure destruction of their half of the key Upon inactivity, or upon your request, they will destroy the key, and forward your request to the other TTP.

Your communications with trusted third parties are conducted over a secure channel, each of you has a Public-Private keypair stored on tamper-resistant SmartCards.

Your trusted third parties' half of the key is stored on a tamper-resistant blackbox, and they don't have access to the key itself: only an encrypted message which Your smartcard is required to decrypt.

You might choose to use anonymous third-parties. Requests to open your vault are published to Bitcoin public blockchain. The response contains an encrypted secret key, and the decryption key is held by you only in RAM per decryption.

If there is no request to open the vault for N days, then the keys are automatically destroyed by the 3rd parties, and you pick N. For some data, N might be 5 days.

Re:Plausible deniability

[Geeky]

You're basically describing a variation on a dead man's switch.

.

The main problem with the idea is what happens if you're sick or in an accident that leaves you unable to make contact for N days without advance warning? There goes your data.

Re:Plausible deniability

[AmiMoJo]

I'm worried that plausible deniability might make things worse. Like in this case, the "expert" says that his best guess is that there is some illegal encrypted data on the drive, emphasis on the guess. Say the software had plausible deniability and the victim revealed his real password, and the data turned out to be nude selfies and bad love poems. The police "expert" could just claim that there must be another password that is hiding the real data. There isn't, but the victim can't prove otherwise.

So it comes down a judge being intelligent enough to understand this, or the victim goes to jail indefinitely until they reveal a non-existent password.

Re:Plausible deniability

[slacklinejoe]

Just buy/download one of the cryptolocker malware shells. All of your data is fully encrypted and prompts you for a payment or warns that you didn't respond within the 72 hour window. That would replace your standard crypto GUI, but introduce a reasonable plausible deniability. Not necessarily encouraging this, but it fits the scenario.

Re:Plausible deniability

[burbilog]

I'm worried that plausible deniability might make things worse. Like in this case, the "expert" says that his best guess is that there is some illegal encrypted data on the drive, emphasis on the guess. Say the software had plausible deniability and the victim revealed his real password, and the data turned out to be nude selfies and bad love poems. The police "expert" could just claim that there must be another password that is hiding the real data. There isn't, but the victim can't prove otherwise.

So it comes down a judge being intelligent enough to understand this, or the victim goes to jail indefinitely until they reveal a non-existent password.

Yes, that's why truecrypt/veracrypt is a very bad idea because of only two possible filesystems inside crypto parititon. If you have only two possible secret partitions then they can demand two keys. But there must me at least 4096 entry points into encrypted volume. So your filesystem #1022 contains nude selfies and bad love poems, filesystem #4009 contains banking information and partition #28 contains excel file with log of brothel visits and expenses... Then it becomes ridiculous -- by design most of entries are decoys (obviously, decoys must be overwritten randomly with random data along with real encrypted sectors all the time to avoid wear leveling analysis).

Re:Plausible deniability

[gweihir]

The security experts say "plausible deniability" cannot be implemented. They are right (and yes, I am one of them). Wanting something that cannot be made reality is stupid, no matter how beneficial it would be.

Re:Plausible deniability

[gweihir]

So it comes down a judge being intelligent enough to understand this, or the victim goes to jail indefinitely until they reveal a non-existent password.

And that is exactly the problem. "Plausible" deniability cannot be made reliably plausible. The only valid approach is that nobody can legally be forced to cooperate in anything that he claims could incriminate him _and_ he must be the judge of that. Nothing else will ever work due to fundamental limitations. Incidentally, civilized legal systems have that. Not many of those left and they were few in the first place.

Re:Plausible deniability

[MatthiasF]

So, I was just reading the USB-C discussions about how everyone is afraid Intel is trying to add DRM to headphones to "push anti-piracy efforts into headphones and close the analog gap". This made me start day dreaming about just how far copyright companies will go for DRM, eventually putting chips in our heads and such (monsters!).

But as I was reading your explanation, could not the same system be used with a cornea descrambler in the distant future? A computer image is encrypted and displayed on screen in the encrypted state, but looks like noise or has a hidden layer that can only be seen if the person has the right part of the key in a cornea display (like a contact lense or complete cornea replacement). The cornea system would decrypt the message partially so the chip in the brain reads the signal from the visual cortex and makes adjustments so the real image or information can be comprehended.

The computer, or the file, would have the first layer of encryption, whereas the second and third layers would be inside the individual (eyes, brain).

How would the state compel you to get access to the evidence? Ask a court to remove your eyes and probe your brain?

This debate is not about passwords or encryption keys but about the rights of citizens to secure their property from the government. In the not so distant past, the government could take pretty much anything they wanted from you. Some governments had high ethics and would not cause harm to you, but that's just semantics.

Now we are entering an era where technology is allowing us to own property that the government can not take. We can create digital property and encrypt it to the point where they cannot get access to it without our permission. Today it's photos, videos, documents, etc., but in the distant future this might extend to 3D models of actual possessions that could be recreated or perhaps even copies of our own selves, allowing a form of immortality.

Does the government have the right to this information if we do not give them permission and we do have the ability to completely block their access?

That is the question behind this entire debate. Part of the reason government exists is for communal protection, but if we start having the abilities to protect ourselves better than the government or we cannot rely on the government to compel a communal verdict on others, then why do we need that element of the government to still exist in our lives?

Re:Plausible deniability

[burbilog]

The security experts say "plausible deniability" cannot be implemented. They are right (and yes, I am one of them). Wanting something that cannot be made reality is stupid, no matter how beneficial it would be.

Can you please climb down from your ivory tower? This is exactly the problem with experts: you think in binary -- all or nothing. But we live in non-ideal world and encounter many non-ideal situations.

Let's look at the person entering some country and customs demanding to open his password manager. They know *nothing* about his password manager content, but still demand to open it, well, just because they can. Casual search. Now here is tough choice -- to give up all valuable passwords, including passwords to something that's going to lead into the jail or refuse to give up password and be thrown out of country. Nice choice, mister expert? Now only if password manager had thousands of decoys by design -- it would be unreasonable demand thousands passwords while the person cooperated...

The same applies to your notebook being investigated because you've lost it and somebody turned it to the police. They have zero evidence that you have cp or something like that on the disk, but they see encrypted volume and demand to open it. Again, because they can demand and they are in random search for something -- and the very act of decryption refusal serves as the reason for serious investigation while sufficient decoy is going to satisfy them. Again, non-black-and-white situation, no binary.

Is it going to work against torture? No. Is it going to work if customs have some tip from CIA or something like that? No. But it would work in many realworld situations.

But alas, experts think only about extremities.

Re:Plausible deniability

[gweihir]

You really have no clue what you are talking about. If the password manager is known to support " thousands of decoys by design" not only will they know about it, it will be very suspicious. They will just copy all of them and the decoys will be worthless. And they may lock you up for a few days because you pissed them off. Anybody with the least amount of actual clue will not cross such a border with a password manager with actual valuable passwords on their laptop. As to the encrypted laptop, no, the decoy will _not_ satisfy them. Either they need a court order so search in the first place in which case the situation does not arise. Or they can demand you open the encrypted volume, and to open the hidden encrypted volume as well (that they know the software you use supports) or else. In the second case you are screwed, no matter how "plausible" your deniability is. Oh, and incidentally, unless you were very careful and created the hidden volume shortly before the laptop was stolen, the presence of hidden volume can be detected with enough reliability to give probable cause.

"Plausible deniability" is for morons that do not understand how the real world works.

Re:Plausible deniability

[burbilog]

If the password manager is known to support " thousands of decoys by design" not only will they know about it, it will be very suspicious.

Of couse it will. Because morons like you prevented it from being widespread and included in every distribution as standard part of encryption. Catch 22...

Or they can demand you open the encrypted volume, and to open the hidden encrypted volume as well (that they know the software you use supports) or else. In the second case you are screwed, no matter how "plausible" your deniability is.

And if volume supports thousands of filesystems inside one volume and you turned out your primary password (with browser to browse banks and banking information, filesystem #4011) and your second password (let's say with granny porn, filesystem #517), will they demand password from filesystem #2301? Filesystem #511? Huh? At some point it becomes ridiculous. Yes, you had something that you really did not want to reveal, but here it is, officer. It's quite different from truecrypt's double filesystem with only ONE secondary volume.

Oh, and incidentally, unless you were very careful and created the hidden volume shortly before the laptop was stolen, the presence of hidden volume can be detected with enough reliability to give probable cause.

It is encrypted filesystem's task to carefully shuffle all sectors, overwriting non-used sectors with random data as well to avoid wear leveling analysis. If you boot into decoy system sometimes and browse a little (let's say doing your regular banking) then it is NOT a decoy after all, no matter how you investigate modification time.

Such a system is much more difficult to design than two-part system like truecrypt's. Doable? Yes. For example, today ram is cheap, so just load all encrypted filesystems into ram and work there, then dump back, overwriting remaining free space with random junk. Fragile, but quite doable and close to impossible to analyze. Or may be something else, but with expert morons throwing shit and derailing civilized discussion there is no such system, alas.

Re:Plausible deniability

[gweihir]

Wow, you _really_ have no clue how things actually work. Impressive!

Re:IANAL, but...

[quintessencesluglord]

If it did, the courts would be guilty of cruel and unusual punishment (misdemeanors don't usually come with an indefinite jail term).

The whole thing is ludicrous as the state is essentially compelling you to offer up evidence against yourself. It's not even a question of evidence tampering, but merely a suspicion that the contents of the hard drive contain evidence, and the legal authority to make you say "uncle".

Perhaps the hard drives contain a list of people he's killed. Perhaps they contain records of gambling receipts. Perhaps it details every furry convention he's been to. Whatever. He has numerous reasons not to divulge to contents of the HDs which have nothing to do with the case, so the whole thing seems like a fishing expedition.

The fact that they are sitting on him instead of going forward with the case suggests the case is weak.

The police are in physical custody of the hard drives. The terms of the warrant are complete. Just because the contents contain a digital cypher instead of an analogue one, it seems we throw every other aspect of legal rulings out the window. They might as well claim he is the Zodiac Killer as well since he is refusing to offer the key to those messages as well.

Boogeymen

[fnj]

Whom you would destroy, first dehumanize him by labeling him. It's OK to do anything to him, deny him any rights, if he's not human.

First they come for the suspected terrorists and suspected child pornographers. But it won't stop there.

Re:Boogeymen

[MrKaos]

Whom you would destroy, first dehumanize him by labeling him. It's OK to do anything to him, deny him any rights, if he's not human.

First they come for the suspected terrorists and suspected child pornographers. But it won't stop there.

You judge a society by how it treats it's most despised.

Re:Boogeymen

[MrKaos]

I think the point the GP is making is that the court of public opinion requires no evidence for conviction. Anybody can paint a picture, and if it looks real enough, who cares if there was ever an actual subject?

Oh for sure, I wasn't disagreeing, simply pointing out that there was an adage on the subject.

Re:Boogeymen

[Luthair]

It didn't start there either, this exact scenario came up 4-years ago in a mortgage scam case - http://www.cnet.com/news/judge...

Re:Boogeymen

[gweihir]

Very much so. They go after the easy targets first, because there they get the least resistance. When they start going after people that just have a different opinion or do not want to pray to the "big leader" every day, the methods of personal destruction without any valid legal recourse will be well established. And at some time they will just start to go after anybody they do not like. It is a well established pattern throughout human history.

Tell us where the bodies are buried

[crioca]

So what exactly is to stop a court from ordering someone accused of murder to "tell us where the bodies are buried" and when the suspect says "I don't know" locking them up indefinitely?

Re:Tell us where the bodies are buried

[Bob the Super Hamste]

This a thousand times. It is almost seems like we a gradually moving to a system where if you don't confess you will be charged with contempt or obstruction of justice.

Re:Tell us where the bodies are buried

[phantomfive]

You know, I'll bet there are court cases discussing questions very similar to that. And you know, I'll bet if you use google you can find the answer to your question.

Re:Tell us where the bodies are buried

[pellik]

Actually, it's reported that he claims not to know the password.

"...Rawls has a clean record and doesn’t know the passwords prosecutors are looking for, the defense argues" (http://gizmodo.com/child-porn-suspect-held-in-solitary-for-7-months-for-no-1773403443)

Re:Tell us where the bodies are buried

[guruevi]

And that falls under the 5th. You don't have to tell the police anything, ever, even in court or after a warrant has been obtained. You can only be convicted based upon the evidence they collect. Obviously they make it more attractive to cooperate (reduced sentencing etc) but it's in no way required. This judge thinks the victim is guilty and just locks him up until he says he did.

Re:Tell us where the bodies are buried

[phantomfive]

You're not very good at using Google. It's ok, I forgive you. But learn how.

Re:Tell us where the bodies are buried

[phantomfive]

I eventually tried "compelled to provide evidence." "Contempt of court" is a good one too

"why can't the court force someone to show where the bodies are buried" led me to this cool comic: http://www.legalmatch.com/law-... but not much else useful

"obstruction of justice" turned up results that were a little too abstract, so I tried "obstruction of justice body" and "obstruction of justice kidnapping", those gave better results.

I heard of a case several decades ago where someone was kidnapped, and the judge forced the defendant to tell where to kidnapped person was, and as a result the defendant was set free, but I can't find a reference to that.

If only there was some sort of protection....

[Vermonter]

Perhaps some sort of "right" that protected you from self-incrimination.... perhaps one day America will be a free enough country to have this kind of "right"

Re:IANAL, but...

[edjs]

Giving the law access to the drive is evidence that you have that access.

It seems to me...

[mark_reh]

that if he's been in jail for 7 months and has not coughed up the password, either he doesn't know it or his stay in jail has been too "comfortable". In the fascist state this may become after the next election, having the guards looks away while his fellow captives make his stay in the jail "uncomfortable" might induce him to comply with the court order.

Doesn't the NSA have copies of everything the guy has been downloading?

Re:It seems to me...

[organgtool]

Doesn't the NSA have copies of everything the guy has been downloading?

That would take a lot of effort to find that data, they'd still have to proceed with the trial and risk him getting off on a technicality, or they may not actually find anything because he might be innocent. From their perspective, why bother when they've already got him locked up indefinitely?

Re:It seems to me...

[Rockoon]

Doesn't the NSA have copies of everything the guy has been downloading?

Yes. Now the justice department is trying to do parallel construction to remove the need for that illegally obtained data, but they have hit a little snag....

Re:It seems to me...

[Howitzer86]

The NSA has everything; therefore, nothing.

Scary implications for Cryptolocker victims

[slacklinejoe]

It goes without saying that this would be a truly scary precedent if applied widely. Victims of cryptolocker for instance would have encrypted hard drives and literally have no way of providing the key or passphrase necessary to comply with a court order. Smart bad guys could just as easily borrow malware engines to do this to disguise their behavior, so it would not be easily apparent. My personal opinion is that passwords are firmly 5th amendment protected, I just wish it came up under a more defendable case. The investigators should have done more surveillance or traditional investigations (with warrant) before pulling the trigger on the arrest and could have easily removed the ambiguity from the situation.

Re:Scary implications for Cryptolocker victims

[davecb]

Their defense is to plead "necessity" when they finally get to see a judge.

Re:Scary implications for Cryptolocker victims

[duke_cheetah2003]

Victims of cryptolocker for instance would have encrypted hard drives and literally have no way of providing the key or passphrase necessary to comply with a court order.

Even more interesting is anyone could (and should) be able to use this as plausible deniability. "I didn't encrypt it, some malware did it and I have no idea how to get back in." There's really no way for anyone to know the truth of your claim, as the evidence that would confirm/deny your claim is encrypted.

Then you will be the child pornographer

[tepples]

let me install some WiFi cameras in your house. Let's say the bedrooms and bathrooms. They'll broadcast live stream 24/7 for anyone on the internet to see.

Then you will be the child pornographer. Between the two houses on this lot, there are a 13-year-old and a 17-year-old.

Revenge porn and right of publicity

[tepples]

If it's legal to own, then there is no legal recourse someone would have to remove pornographic pictures of themselves from somewhere.

If child pornography were decriminalized, the producer of the work would need to provide a model release signed by the actor's parent. Otherwise, the recourse would be revenge porn laws and trademark-like right of publicity laws.

Wish it was a more sypathetic defendant but

[DarkOx]

I hope this goes all the way to SCOTUS. The All Writs Act is a just a law, it does not trump the 4th and 5th amendments!

Its time this thing gets struck.

Re: Is it even child porn?

[Anonymous Coward]

Much more efficient and ethical would be to make children illegal.

Trust me. I live next to a daycare.

Preponderance of evidence

[tepples]

You're effectively claiming that Copyright Law puts you in a 'guilty until proven innocent' which is, more precisely, claiming a violation of due process.

Because most copyright cases are torts, not crimes, the standard is preponderance of evidence, not reasonable doubt. And in cases where it's uncommon for individuals to carefully preserve evidence of title, such as retail purchase of a lawfully made copy of a computer program, preponderance of evidence behaves similarly to "guilty until proven innocent".

Can you show bank records of a purchase that's roughly the right amount?

Not likely, especially if it was on the same receipt as a bunch of other products.

Re:Preponderance of evidence

[Agripa]

Because most copyright cases are torts, not crimes, the standard is preponderance of evidence, not reasonable doubt.

This is only the case because prosecutors choose not to enforce them.

Moralizing

[Anonymous Coward]

As much as I lack all sympathy for people in possession of child pornography, ...

Why no sympathy? You think possessing child porn is just a character flaw and those people just need to snap out of it or get severely punished?

It's moralizing like that that prevents people from seeking help; whether it's child porn, drugs, alcohol, or mental illness. Most people who end up getting help for those were forced to because they were found out in a public and humiliating way. Their lives are ruined. They will never be employed again and their family lives are many times destroyed. If they are lucky, they get on disability. Most times they end up homeless and an even bigger problem to society.

In our society we have this punishment and revenge mentality that doesn't solve the problem. So, people are just going to do it secretly until they are caught.

What I think we should do, is treat the consumers of child porn and spend our time and effort going after the producers. Now the producers are the ones with the character flaw - abusing children for profit sounds like one asshole to me.

Violated the spirit of the 5th Amendment

[schwit1]

No one should be compelled to aid in their own prosecution.

Re:IANAL, but...

[Kokuyo]

They have all the access they need. They can read every single goddamn bit on that drive.

This is like me writing a letter in Swiss German and them not finding anybody to translate. How am I responsible for translating it for them when I know it would be used against me?

Encryption is exactly that. Whether it's automated or not, it's just a translation of information into another "language". If Mr. FBI can't read it, then that's tough luck for him, isn't it?

Re: Is it even child porn?

[gweihir]

And maybe invest the resources in law enforcement to go after those that produce this stuff and the (doubtlessly many more) that abuse children but do not document it? Naaa, that would not give so many easy "victories" and, worse, the supply of the stuff could dry up because the actual problem gets solved, meaning less funding for law enforcement. We cannot have that, can we? "Cui Bono" looks very, very bad here.

Making the possession of data illegal has many very serious problems, not at all how easy it is to abuse it.

Re:Child Porn.... varieties

[phishybongwaters]

I didn't realize this was about the different levels of perversity. I guess I got confused by the fact that it's actually about the court jailing a guy until he de-crypts his harddrive because he MAY have child porn on it. It's not about child porn. It's about building a case against encryption. Terrorism didn't pan out, so they now (as I fully anticipated) fall back to child porn, because who the hell isn't disgusted with that? It's not about the content, it's about convincing Joe Blow and Joe SixPack that encryption is bad because..... kiddie porn.

The all writs act contradicts the bill of rights

[davecb]

They were from the same year, and I think the all writs act was older. The bill of rights arguable overrides it in any case, just like mu Canadian charter of right overrides both newer and older legislation...

deniable encryption

[ooloorie]

Although fairly new for the US legal system, this kind of "rubber hose" attack on cryptographic systems is nothing new. The solution is to use some form of deniable encryption.

Julian Assange developed the rubberhose file system for this purpose.

Chaffing and winnowing are other ways of achieving secrecy without a traditional encryption key.

A clear case of self-incrimination

[Sax Russell 5449D29A]

This looks like a clear case of forceful self-incrimination. When the dust settles, he will most likely get a big fat compensation check sometime in the future for this circus.

Re:Hidden Volumes

[Sax Russell 5449D29A]

That might be a good idea for now in oppressive countries such as Russia and China. In Western countries, however, it's better to stand up and fight for your rights.

"terrorists" vs. "childrens"

[mi]

because terrrrristchildrens

The "terrrrist" part didn't help the FBI against Apple — much as I, for one, wanted to see Tim Cook sent to jail over the same contempt of a court-order.

Re:"terrorists" vs. "childrens"

[david_thornley]

Cook didn't defy a court order. He received it and challenged it, as is his legal right. A court can't order you to do something without allowing you to respond and explain why you shouldn't be required to do it. He may have held the court, FBI, and court order in contempt privately, but he was complying completely with the legal process. The FBI withdrew their request before anyone could rule on Apple's filing, which suggests that they knew it was bogus.

These are not the interests of the legislators

[fyngyrz]

there's no way we can evaluate this ethical dilemma and end up putting the prosecution of pedophiles and terrorists ahead of our own encryption needs.

That's not true for legislators or the courts, because that does not define the competing interest for them. For them, the counter interest is delineated by future electability; if they can stand up there and say they are "tough on CP", they will gather votes.

The only way this can be changed is if a majority of the voting public can be educated as to the validity and importance of the argument you made; but so far, there's not even a hint that might happen.

re: Snowden

[King_TJ]

It's too bad, in hindsight, we didn't have one of the Kardashian's or maybe Snookie from Jersey Shore revealing the govt. spying. Then, MUCH more of America would feel a vested interest in the situation. :(

Illegal

[bill_mcgonigle]

There's already a federal court ruling that it's a fifth amendment violation to compel a password unless there is already evidence that the password is hiding convicting data.
The All Writs Act is inferior to the Constitution so the judge's action is illegal and he should be held personally liable for violating this person's civil rights. At least PA is not afraid to send a corrupt judge to prison once in a while.

Jimmy Hoffa

[unixcorn]

Judge: "You must tell us where Jimmy Hoffa's body is"
Mobster: "I plead the 5th your honor"
Judge: "But you were the last person seen with Mr. Hoffa"
Mobster: "I don't recollect that your honor"
Judge: "Ok, since we have no body, there must not have been a murder. You are free to go"

I am not sure what the difference is between this scenario and encrypted disks...if there is no body, a crime can't be proven.

Re:Which came first, the Chicken or the Egg?

[Bob the Super Hamste]

Well actually the word of a person is enough to get a warrant but if it was fabricated it does seem that the person should be brought up on perjury charges:

Fourth Amendment to the US constitution
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Fifth Amendment.

[jcr]

The government is trying to coerce the defendant to divulge information that can be used against him. Whether spoken, typed, or written in crayon, the defendant has no duty to comply. By jailing him for asserting his right against self-incrimination, the judge is violating his civil rights under color of law.

If we ever have a functioning justice system in this country again, that judge should be looking at some serious jail time of his own.

-jcr

No brute force decryption?

[eneville]

I find it hard to believe that the US government cannot decrypt the HDD. Must be less expensive than keeping someone in jail.

Comment removed

[account_deleted]

Comment removed based on user account deletion

another angle

[jason777]

Chances are, this scumbag has cp on the drive. But let's say for this argument, that there is in fact none on the drive. But, he does have some personal pictures (perhaps of an affair), or some corrupt business dealings, etc. If he gives up the password, he would incriminate himself on other things, especially personally with his wife. So, withholding the password does not necessarily mean that he is guilty of the charge.

Nothing to Disclose == Normal

[MensaMoron]

It isn't that I have nothing to Hide. That is a wrong premise. I have nothing to disclose. That is the right premise.

technical possibilities?

[admiral snackbar]

If this continues, what I expect to see soon is encryption that decrypts in 2 different unencrypted versions, dependent on the decryption key used. I can't imagine its that difficult. Make an encryption program that has the option of just normal encryption with 1 decryption key, but the added option of using a second decryption key, and a second set of files. For example: John Doe has 2 harddisks, each with 40 GB of information. One contains the blueprints of the F22 Raptor, the other the complete works from the Gutenberg Project, in 7 different languages. John Doe uses the encryption program to create a single encrypted file, size 80+ GB on a bigger harddisk. If John enters the password Gutenberg, the program decrypts the file into the Gutenberg library. If John enters the password Raptor, he gets the blueprints for the F22. Now law enforcement, if they find the file, not only have to force him to decrypt it, they have to prove there is a SECOND decryption key. If the program uses standard padding of the encrypted file with 100-200% of the original data, they could not even prove that there is a second decryption key just by looking at the size difference between the encrypted file and the Gutenberg library file.

Re:technical possibilities?

[SuiteSisterMary]

This has existed for a while. The tongue-in-cheek term for it is 'rubber hose encryption,' the idea being that you have something to give up when you're being beaten with a rubber hose.

Reasonable

[s.petry]

I have no idea why people insist on forgetting that part. Lets try an analogy. I invent a cypher and print a code on a paper. The court can grant a warrant to get the paper, but that does not mean they can grant a warrant to get the cypher key from my head. The 4th and 5th amendment are very clear on that. Even though our founding fathers are claimed to have never thought about things, they actually knew damn well about encryption and the need for personal secrecy. What if my encrypted paper contained plans to overthrow the tyrannical King. What if my paper was a personal confession for deeds the Church would frown on, but deeds that are not illegal (like Lust).

People always try to press the system for more, and again this is something the founders KNEW. This is why we have a Constitution which states "reasonable search and seizure", leaving no room to think it's everything someone can possibly conceive of.

Why he's probably not guilty

[slashmydots]

This sounds like a Mac and I have no idea how they operate but I'll say it anyway. So they couldn't find ANYTHING in his thumbnail cache, file-open history, file search history, etc? So in other words he's not guilty. It never comes down to just encrypted drives. There is ALWAYS other evidence.

What happens when...

[mark-t]

computers are sophisticated enough that they can evaluate your state of mind, and decryption would not only not be possible if you were not the one to decrypt it, but it would further not be possible if you were trying to decrypt it under any kind of duress, so it becomes literally impossible to comply with a court order mandating that you decrypt it for them?

No suprise

[wyattstorch516]

If you are an unpopular defendant all rules and notions of fair play go right out the window. Just ask Bill Cosby.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Used to go after the public

[strstr]

But not used to go after government agents? The all writs act should be used to get information on directed energy being used to assault citizens as perpetrated by government agents.

obamasweapon.com

What about the Fitfh Ement?

[Lisias]

That one where it's said that no one can be forced to provide evidences that would incriminate him/her ?

https://en.wikipedia.org/wiki/...

Uhh...

[easyTree]

Why? Just outsource the decryption to the guys that cracked the iPhone. What's that? You didn't really crack the iPhone or you want to have your cake and eat it?

Or is this about giving encryption the only-pirates-engage-in-file-sharing treatment?

Innocent until coerced into self-incrimination. Woohoo! Land of the free.

Our Enemy, The State.

[ToddInSF]

You can be "compelled" to do what the state demands, and you have no real recourse.

decoy password

[tristanbobistan]

no fan of children or their pornographers, but i have a technical question related to the future of the revolution and the role cryptography might play: has he not considered the option in truecrypt to use a decoy password? that would work, right? if he had it?

Criminal vs Civil

[Zxern]

Is this really that much different than when a company dumps a truckload of files when they are force to produce documents in civil case? Bury a few memos in a truckload of documents and hope the other guy misses it. The evidence was produced, but they aren't under any obligation to help you find what you're looking for. In this case the drives are in evidence, the police can poke and prod it for as long as they want. Why should he be compelled to help them find what they are looking for?

The threat of lawsuits from parents

[tepples]

The threat of lawsuits from parents ought to be enough to discourage the sexual abuse that occurs during production of CP. Or is the majority of CP produced by parents with their own children? And what sexual abuse occurs during production of animated CP, which some jurisdictions have also banned?

Neither, actually.

[Ihlosi]

I assume that would take either a compromised driver, or a compromised peripheral.

Neither, actually. Unless you count a sniffer on the USB lines as "compromised peripheral". (hm, yes, hiding the sniffer inside the device/inside its USB connector is probably the most inconspicuous method).

"How does the peripheral transmit said keystrokes/mouse clicks to the "command and control" server?"

You don't have to transmit anything if you're capable of retrieving the device. You can pack a few GB worth of flash memory even into tiny devices; and even a fraction of a GB stores days worth of keystrokes and mouse movements.