Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man jailed 16 months, and counting, for refusing to decrypt hard drives

arstechnica.com

Post reply on HN
Print view View original

371–380 of 504 posts

Re: Man jailed 16 months, and counting, for refusing to decrypt hard drives

#371

Post by throwanem »

DuskStar wrote: post #130
throwanem wrote: post #117

Earlier quoted context omitted.

Images and videos of child sexual abuse aren't just "information about [...] crime"; their creation, possession, and distribution are all actions which themselves qualify as criminal under modern American jurisprudence. This is generally justified on the grounds of ongoing harm to the victims, which, while not unreasonable, I think might be a weaker argument than that distribution in particular may make and expand a…

I think his point is that for pretty much every other crime - from murder to jaywalking - possession of evidence relating to that crime is not itself illegal. I know that if I ended up recording a murder (FPV drone) I'd turn that over to the police no question, but for CP? Drone camera, meet thermite.

Let's not be absurd, shall we? You'd be extremely well advised to make an immediate report of the crime, and you would certainly leave your drone's memory card as evidence, but other than that, I don't see what you'd have to worry about - and I've myself been involved in a couple of reports of possession of child pornography, back in my retail storefront IT days. It was really nothing like the Spanish Inquisition.

Re: Man jailed 16 months, and counting, for refusing to decrypt hard drives

#372

Post by erelde »

ue_ wrote: post #329
__s wrote: post #198

Earlier quoted context omitted.

It's not a private activity, it directly supports an industry of violence against children

> directly supports an industry of violence against children Not necessarily, and even so, can it be proven?

If I see proof (undoctored video) of a dog being beheaded (a child being sexually abused) I think I'm safe to conclude that a dog was killed (a child was raped).

If then that video was sold (or distributed in any way) to fetishists of dog beheading I could conclude that there is some kind of commercial (distribution) process going on here.

Note for children: I'm using parenthesis in a way that shouldn't be done.

Re: Man jailed 16 months, and counting, for refusing to decrypt hard drives

#373

Post by throwanem »

michaelmrose wrote: post #301
throwanem wrote: post #268

Earlier quoted context omitted.

In pedophilia specifically? I doubt it. But it's not a far inference from dopamine's role in sexual arousal and satisfaction [1], and its role in drug addiction [2]. While it would be a stretch to postulate that the effect of child pornography on those disposed to it exactly matches that of drugs which provoke massive dopamine release on those who take them, the effects of dopamine on sexual behavior in the human mal…

Is it reasonable to suppose that perverts would be more likely to offend or just consume more porn?

Maybe, maybe not. That's a fraught subject around pornography in general, with tendentious argumentation on every side.

On the other hand, children are extraordinarily vulnerable to many forms of abuse, this among them. In a system of laws one of whose explicit purposes is to afford those vulnerable to mistreatment protection under law, I don't think it is on its face unreasonable to argue that children merit extraordinary protection as well. While there is perhaps a fair question to be asked around whether the sort of law under discussion actually serves that end, I would at the very least suggest anyone raising the question in a serious way be very well prepared to answer objections and counterarguments of every imaginable sort.

Re: Man jailed 16 months, and counting, for refusing to decrypt hard drives

#374

Post by throwanem »

naasking wrote: post #311
throwanem wrote: post #178

Earlier quoted context omitted.

Are you sure? There's a strong neurocognitive argument to be made that reinforcing the tendency, by repeatedly acting on it with pornography to the end of, among other things, rather strongly triggering the dopamine reward system, will tend to strengthen the interest by reinforcing the circuits which interact with it, and vice versa. I don't think anyone would argue this "cures" the tendency - certainly I will not! B…

> Are you sure? There's a strong neurocognitive argument to be made that reinforcing the tendency, by repeatedly acting on it with pornography to the end of, among other things, rather strongly triggering the dopamine reward system, will tend to strengthen the interest by reinforcing the circuits which interact with it, and vice versa Reinforcing the circuits to reward yourself with more porn, not with molesting chil…

That's a counterintuitive result, and I would be very interested to learn more about it. Rather than sling accusations of pseudoscience and authoritarianism, will you cite some of these studies?

Re: Man jailed 16 months, and counting, for refusing to decrypt hard drives

#375

Post by dijit »

belorn wrote: post #315
realo wrote: post #206

I have a question... Suppose the suspect Alice only has a portion of the key. Someone else (Bob...) has the remaining key bits. Alice is busted, and 'compelled to give the key', and DOES provide her portion of the key. Bob is never found. Then Alice would be indefinitely imprisoned, even if she would have actually complied with the court order. It seems unethical, to me. Bonus question: Alice pretends that Bob exists…

I co-authored a project that works on Debian that do unattended reboots of encrypted disk drives which allows for scenarios where Alice don't know any part of the key. Every time the machine boots up bob get a request on the network and he can chose to approve or deny. Bob in turn could be in a different country which would make coercion a bit hard. (Project called Mandos)

I think I remember you giving a talk about this at SmashTheStack in Malmo, Sweden.

I believe I asked then about maybe having support for non-debian systems and eventually something like Windows in the distant future.. What kind of support would you need for it to be worthwhile investing in that?

Re: Man jailed 16 months, and counting, for refusing to decrypt hard drives

#376

Post by ethbro »

oconnor663 wrote: post #180
ethbro wrote: post #77

Earlier quoted context omitted.

Following from this, if perfect encryption leaves a ciphertext indistinguishable from random noise, then what proof does the court expect that a given decryption is the correct decryption? If he were to hand them an elaborately constructed fake file system, who would they be to say those weren't the encrypted contents? (For purposes of thought exercise, mooting arguments about headers / magic fingerprints / leaky met…

You could perfectly encrypt a hard drive such that it could decrypt to anything, but the "key" (a one-time pad) would be as big as the drive itself. All real-world crypto software uses short keys, which are just big enough that it's impossible to brute-force guess them. In general for a given encrypted drive, there is probably no other key besides the real one that would produce meaningful looking output, because the…

I get the one time pad size argument (as well as the analog that a shorter key is therefore a hashing function in some respect?).

The thing I found curious though is that the legal argument seems to depend not on providing your encryption key (which is generally assumed to be protected), but the act of decryption.

In the absence of the key, any plaintext produced from a ciphertext is... questionable?

Re: Man jailed 16 months, and counting, for refusing to decrypt hard drives

#377

Post by cookiecaper »

baddox wrote: post #365
cookiecaper wrote: post #84

Earlier quoted context omitted.

It's not fantasy. Fantasy is a world where you can tell the police "I know how to open that thing that you have a lawful order to investigate, and you don't, so any crime of which I'm suspected is now uninvestigatable, nanny nanny boo boo". The analog with other difficult locks is just fine; the fact that these locks are so good that they are unbreakable doesn't really change anything about the accused's obligation t…

> It's not fantasy. Fantasy is a world where you can tell the police "I know how to open that thing that you have a lawful order to investigate, and you don't, so any crime of which I'm suspected is now uninvestigatable, nanny nanny boo boo". And your alternative to this "fantasy" is that you go to jail for the rest of your life if you refuse to comply? I find that far more ridiculous.

Yes, effectively. The alternative to effectively giving oneself a life sentence is to comply with the order and allow the government the access they need to proceed with the criminal case. This man's incarceration on contempt charges will end on the day that he complies with the lawful order.

Rawls is rolling the dice here. He's hoping that he can press this issue on constitutional grounds and that he'll prevail, which will prevent the investigators from accessing the contents of his disk and, in all likelihood, prevent his conviction. If he wins on the constitutional matters, he'll be able to walk free as a bird when the case is decided (and may end up being entitled to compensatory damages). That's the outcome he's hoping for.

If he loses the constitutional case, he will probably decrypt the disks and allow the justice system to finish processing his case so that he can get an end date on his incarceration. In all likelihood, complying with the order will lead to his criminal conviction and a sentence of at least several years. After that sentence completes, he will be a convicted felon, and in most states, he will have to register as a sex offender. He will have to live under a variety of restrictions related to those statuses for the rest of his life.

Rawls's hope is that the court will rule that he cannot be ordered to decrypt his disks on constitutional grounds. This is all a wager on his part. As his incarceration on contempt charges is essentially voluntary, characterizing it as an "indefinite" or "life" sentence is improper. He has no sentence. To go free, he need only comply with the lawful order that was served upon him (of course, he will probably be arrested on charges related to the data on his computer shortly thereafter, potentially before leaving the jailhouse), or convince a higher judge that the order should be stayed pending the outcome of the lawsuit challenging its validity.

Another potential avenue to freedom, at this stage, would be convincing Congress and the President that the law should be modified so that either a) the judge's order is invalidated by new statutory requirements and the constitutional matter is no longer relevant; or b) the crime being investigated is no longer criminal.

Re: Man jailed 16 months, and counting, for refusing to decrypt hard drives

#378

Post by cookiecaper »

baddox wrote: post #368
cookiecaper wrote: post #84

Earlier quoted context omitted.

It's not fantasy. Fantasy is a world where you can tell the police "I know how to open that thing that you have a lawful order to investigate, and you don't, so any crime of which I'm suspected is now uninvestigatable, nanny nanny boo boo". The analog with other difficult locks is just fine; the fact that these locks are so good that they are unbreakable doesn't really change anything about the accused's obligation t…

> The protection in the Fifth is to prevent a perverse system of coerced confessions, where innocent people can be placed on the stand and forced to falsely confess before the court. Do you have a source for this claim? Compelled confessions are already invalid. I'm skeptical that this was the primary purpose of the amendment.

> Compelled confessions are already invalid.

Compelled confessions are not "already invalid" separate from the Fifth Amendment. To the extent that statutory restrictions prevent it, that arises from the same impulse of the Fifth and is most likely primarily intended to be supplementary thereto.

The right against self-incrimination is intended to establish a system of justice that requires prosecutors to obtain real proof rather than making it dependent on manipulating the accused, who may well be innocent, into believing that a confession is the only way out (that is, confessions extracted by coercion).

Similar rights existed in multiple state constitutions prior to the ratification of the federal constitution. Note also that incorporation didn't begin to occur until the late 1800s-early 1900s, so independent state statutes protecting this right would've been necessary, and their existence doesn't mean that the Fifth didn't also target this protection.

>Do you have a source for this claim?

This overview seems pretty accessible: http://www.slate.com/articles/news_and_politics/explainer/20....

Quote:

>The Fifth Amendment [...] was created in reaction to the excesses of the Courts of Star Chamber and High Commission. [...] These courts utilized the inquisitorial method of truth-seeking as opposed to the prosecutorial, meaning that prosecutors did not bear the burden of proving a case, but that sufficient "proof" came from browbeating confessions out of the accused. [...] With the abolition of the Courts of Star Chamber and High Commission, the common law courts of England incorporated this principle of nemo tenetur—that no man should be bound to accuse himself. By the 18th century, English law provided that neither confessions coerced during the trial nor pretrial confessions obtained through torture could be used. This was based on the belief that coerced confessions were inherently unreliable.

Re: Man jailed 16 months, and counting, for refusing to decrypt hard drives

#379

Post by [deleted] »

elif wrote: post #338
libertymcateer wrote: post #272

Earlier quoted context omitted.

> A possible answer to the first question: Alice is not compelled to provide the key. She is compelled to decrypt the drive. Obviously she can't do that without Bob. Alice is screwed and will spend the rest of her life in prison. Yes, and in this scenario she would not be held in contempt, so your hypothetical does not apply. You can only be held in contempt for refusing to comply with court orders, not for the failu…

I wonder if he had an encryption scheme that deleted the data in the event of n password failures and also something of legal value like bitcoins on the drive. Perhaps, then he could argue that knowingly attempting to log in using potentially incorrect passwords constitutes undue harm.

[deleted]

Re: Man jailed 16 months, and counting, for refusing to decrypt hard drives

#380

Post by cookiecaper »

Natanael_L wrote: post #348
cookiecaper wrote: post #84

Earlier quoted context omitted.

It's not fantasy. Fantasy is a world where you can tell the police "I know how to open that thing that you have a lawful order to investigate, and you don't, so any crime of which I'm suspected is now uninvestigatable, nanny nanny boo boo". The analog with other difficult locks is just fine; the fact that these locks are so good that they are unbreakable doesn't really change anything about the accused's obligation t…

Being forced to decode written notes to incriminate yourself is about equal to producing the password that decodes the encrypted data. In both cases you use a secret and some procedure to derive readable information from some other information. And in both cases, it is generally impossible to prove you are able to!

The difference is that if a defendant is forced to decode a unique cipher they've made up, there's no independent way to verify its contents. You can't prove that an investigator didn't say "Look, the only way you're going to ever get out of here is if you 'decode' this and make sure it says that you committed the crime."

Whereas with a well-understood, industry-accepted cipher, you can use the key and obtain the evidence exactly as it sits independent of the defendant's disposition and without requiring any unique or special tooling to be provided by the defendant. There is no opportunity to influence the contents of the decrypted disk. Ultimately, encryption may end up strengthening the prosecution's case because it can't reasonably be argued that any evidence tampering or manipulation occurred prior to decryption.

When the defendant either discloses the passphrase or enters it to unlock the disks for the police without disclosing it, the disk will either decrypt or not, and when it decrypts, it will either contain the evidence or not. Nothing said to or done by the defendant since the evidence was seized can have any influence on the contents of the disk. That means the Fifth Amendment's purpose of preserving a prosecutorial justice system dependent upon the use of objective proof rather than individual manipulation remains intact.

It would be interesting to see how this would've played out if Rawls had been using something like TrueCrypt's hidden container encryption, which uses steganographic techniques to allow the user to generate distinct blocks of cleartext from the same block of encrypted data. In that scenario, theoretically, there is no way to prove that the hidden container exists and that you have not fully complied with the police's request to decrypt.

Post reply on HN