Live data from Hacker News

Man jailed indefinitely for refusing to decrypt hard drives loses appeal

arstechnica.com

11–20 of 413 posts

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#12

Earlier quoted context omitted.

Assuming it's shown to be a foregone conclusion you have child porn on your machine, yes.

Then why hasn't this person been prosecuted yet? Are they just wanting him to give up his credentials so that they can refer to this case as a precedent?

A possibility is that if they prosecute based on what they have now, then he will _never_ decrypt it - they may be aiming to break up a porn-ring or the actual producers, and he may have very valuable data on the drive, that may potentially save lives

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#13
post #2

So if I forget my password, I can be in jail forever?

It would be interesting to know why he has not used this excuse.

Imagine having encrypted disk format where fast delete happens by writing over the main key in the volume header with random data and not all zero or some other magic value. You could have lots of deleted disks and memory sticks and go to jail because you can't decrypt them when asked.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#14
post #2

So if I forget my password, I can be in jail forever?

That would be an interesting case but that's not what seems to be argued here. The state is arguing that they have enough evidence that "the presence of child porn on his drives was a 'foregone conclusion.'". It's likely the defendant didn't use forgetting-the-password as a defense because it was obvious via IP traffic and witness testimony that he had regularly and recently used his computer.

The ruling here seems focused on the point of whether the knowledge/use of a password constitutes self-incrimination, which people have a Constitutional right not to engage in. IANAL, but it seems akin to arguing that you have a Fifth Amendment right not to give up a DNA sample.

edit: Looks like I'm wrong, defendant did use forgetfulness as a defense at one point, though that was ultimately not his only reasoning for appeal.

Look at page 7 of the document here:

https://arstechnica.com/wp-content/uploads/2017/03/rawlsopin...

        Approximately one week after the Quashal Denial,
        Doe and his counsel appeared at the Delaware County Police
        Department for the forensic examination of his devices. Doe
        produced the Apple iPhone 6 Plus, including the files on the
        secret application, in a fully unencrypted state by entering
        three separate passwords on the device. The phone contained
        adult pornography, a video of Doe’s four-year-old niece in
        which she was wearing only her underwear, and
        approximately twenty photographs which focused on the
        genitals of Doe’s six-year-old niece. 


        Doe, however, stated
        that he could not remember the passwords necessary to
        decrypt the hard drives and entered several incorrect
        passwords during the forensic examination. The Government
        remains unable to view the decrypted content of the hard
        drives without his assistance.

However, in the next paragraph, the document refers to a ruling in which the court found that there was enough evidence to show that the suspect "remembered the passwords needed to decrypt the hard drives but chose not to reveal them because of the devices' contents". I imagine the details of that evidence was in the Oct 5., 2015 hearing in which the suspect "neither testified nor called witnesses. He offered no physical or documentary evidence into the record and provided no explanation for his failure to comply with the Decryption order".

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#16
This reads as extremely bizarre. I mean, reading the fifth amendment makes it pretty clear - no one should be compelled to witness against oneself. However, it looks like the current executive and judicial are thinking "well, those Founders were just idiots for putting such an amendment in, clearly it'd be much easier to prosecute people if we could compel them to witness against themselves, so why don't we just ignore it and put people in jail indefinitely until they agree to witness against themselves?". Terrifying that it is so easy for them to completely ignore all constitutional protections.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#17
post #13
post #2

So if I forget my password, I can be in jail forever?

It would be interesting to know why he has not used this excuse. Imagine having encrypted disk format where fast delete happens by writing over the main key in the volume header with random data and not all zero or some other magic value. You could have lots of deleted disks and memory sticks and go to jail because you can't decrypt them when asked.

It's possible that the suspect wasn't thinking things through when he was hit with the search warrant. It says that he gave them his iPhone 5S password but not his Mac password, or the passwords for the hard drives. They apparently were able to get into the Mac (maybe the password was the same as his iPhone?) but not his hard drives. He is said to have "refused" to give those passwords. I suppose he gave up the ability to maintain a consistent defense when he said "No, I don't have/want to" instead of "I forgot".

https://arstechnica.com/wp-content/uploads/2017/03/rawlsopin...

I'm confused by this statement in the above ruling:

    The Forensic examination also
    disclosed that Doe had downloaded thousands of files known
    by their “hash” values to be child pornography.


    The files, however, were not on the Mac Pro, but instead had been
    stored on the encrypted external hard drives. Accordingly,
    the files themselves could not be accessed.
So forensic analysis of the Mac revealed that he downloaded known porn files (identifiable by the database of hashes that law enforcement uses)...but don't you need access to the actual file to be able to calculate its hash? If the files were moved to, or downloaded right to the encrypted drives, how could forensic analysis reveal the files' hash values?

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#18
post #14
post #2

So if I forget my password, I can be in jail forever?

That would be an interesting case but that's not what seems to be argued here. The state is arguing that they have enough evidence that "the presence of child porn on his drives was a 'foregone conclusion.'". It's likely the defendant didn't use forgetting-the-password as a defense because it was obvious via IP traffic and witness testimony that he had regularly and recently used his computer. The ruling here seems f…

If it's a foregone conclusion, why don't they charge him under CP laws and be done with it? Looks like it's either not as foregone as they try to present it, or they try to use it to establish a precedent (or probably both) and latch on this case because of the defendant being so unsympathetic.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#19
post #14
post #2

So if I forget my password, I can be in jail forever?

That would be an interesting case but that's not what seems to be argued here. The state is arguing that they have enough evidence that "the presence of child porn on his drives was a 'foregone conclusion.'". It's likely the defendant didn't use forgetting-the-password as a defense because it was obvious via IP traffic and witness testimony that he had regularly and recently used his computer. The ruling here seems f…

The self-incrimination clause was motivated by the practice of forced confessions, which were elicited by threats, indefinite detention and torture. You can get a DNA sample with a cotton swab, but it takes much worse to extract information from someone's mind.
Post reply on HN