Live data from Hacker News

Man jailed indefinitely for refusing to decrypt hard drives loses appeal

arstechnica.com

101–110 of 413 posts

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#101

Earlier quoted context omitted.

Not quite, IMO -- combination safes can be feasibly opened without the combination.

Encrypted drives can be opened without the password. Difficulty varies of course, but it can be done (e.g. iPhone).

That was only because they chose a weak password. With a 100+ bit password, it's impossible.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#102
post #84
post #66

Earlier quoted context omitted.

yeah, if it's a foregone conclusion, then why isn't the trial over and time being served?

Where's the mandatory minimums for possession of child porngraphy? The zero tolerance? Our prisons fill with drug offenders, yet we give sex offenders a scarlet letter + probation?

I don't think drug offenders should be put in prison since it's a victimless crime. I think child porno while much more serious does invoke some of that chain of reasoning.

To me there is a big difference between a guy who found some on the internet and someone who produces or pays for it.

I would be wary of putting in minimum sentencing for such crimes unless it was only targeted towards those producing/paying as you can reach murky area's. Two i can think of off the top of my head would be finding images inside someone's browser cache who browses a site like 4chan where people will post it randomly.

That and art, if someone draws child pornography is that a crime? If blizzard says one of their overwatch characters is 17, are the people who make those animated porno videos making child porn? And are the people watching it consuming child porn?

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#103
post #78
post #64

Earlier quoted context omitted.

The critical question is, why haven't they charged him? It is disingenuous of them to bring up the evidence they currently have essentially in an attempt to demonize him. Their evidence is sufficient or it isn't; if it is they should charge him; if not they're demanding self-incrimination.

You need to distinguish between requiring the defendant to turn over incriminating evidence (which the 5th amendment does not protect), and requiring the defendant to make incriminating statements ( i.e. to provide incriminating testimony). Sometimes, the act of producing evidence in response to a government request involves the defendant making implicit incriminating assertions. If the government says "produce all y…

Quite aside from anything else, can someone explain whether or not the same logic would apply to (for example) asking someone to open a safe vs. the code to open the safe. It seems like this ruling would say that failing to open the safe is functionally the same?

As a gratuitously distorted example, lets say i had cooked accounting books in a spreadsheet on my computer, and they were encrypted by a random password that /i/ do not know, but have on a memory stick in a safe. It seems that logically that would be equivalent, but i also am very much not a lawyer so am perfectly willing to accept i am missing nuance of the law.

Outside of the law i don't like the forgone conclusion stuff - for example, revolution period you could say hanging out with revolutionaries regularly could reasonably conclude your documents include a calendar for revolutionary meetings so you should be required to provide that information and/or information required to receive that. Obviously that's some contorted logic but i don't think it's that far removed from this.

I would argue that a hash match should be sufficient, and i would be convinced that (absent other information and details) this was evidence that he's a pedo, but i can see how a lawyer could create reasonable doubt where in reality there is none (specifically referring to hashes here, nothing else).

Of course i can't serve on a jury (and apparently knowing what you're talking about may be disqualifying? :-/)

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#104
post #92
post #90

Earlier quoted context omitted.

The Court's opinion explicitly addresses that (at 18-19). It first recognizes that impossibility of compliance is a defense to a contempt charge. But it then explains why the trial judge reasonably did not buy that argument: > At the contempt hearing, the Government presented several witnesses to support its prima facie case of contempt. Doe’s sister testified to the fact that, while in her presence, Doe accessed chi…

18 months later, though, it is completely plausible that he really has forgot. I don't think I would remember a complex password that I haven't used for 18 months. Hell, I sometimes have to reset simple passwords that I created last month. If you don't use knowledge, you forget it.

Perhaps, but the judge can only make judgements based on the arguments presented.

If the defendant wanted to argue that he no longer remembered the password (but would be willing to decrypt the drive if he could), then that's something that the judge would consider. But a judge can't (and won't) simply say "Oh, maybe he hasn't complied because he just forgot the password. I'm going to let him off"

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#105
post #26

Here's a recording of the oral arguments for the US Court of Appeals, Third Circuit back in September: http://www2.ca3.uscourts.gov/oralargument/audio/15-3537USAv.... The gov's argument seems to be that because the defendant doesn't have to give the government the password but rather produce the decrypted hard drives, his actions aren't protected under the fifth. Analogy drawn with unlocking a safe. EFF counter-argum…

Can you be compelled to provide something that you don't have access to? Were anyone else in this situation, wouldn't it be plausible to simply claim you don't know that password?

I've wondered about scenarios where you can legitimately claim to not know the password to decrypt a drive. A few different cases I can think of which may be ruled differently by a court.

1) I use a password manager so I don't know the password. However, I have the means to acquire the password.

2) I use a password manager but somehow lost access to it unintentionally.

3) I use a password manager and lost access to it by design. (eg. Using a dead man's switch of some kind that deletes it if I don't "check in" for some period of time)

4) I used to know the password. However, I suffered a traumatic brain injury and cannot recall it.

I obviously don't have the answers but I think these are interesting to think about as different points in a large legal grey area.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#106
post #52
post #16

This reads as extremely bizarre. I mean, reading the fifth amendment makes it pretty clear - no one should be compelled to witness against oneself. However, it looks like the current executive and judicial are thinking "well, those Founders were just idiots for putting such an amendment in, clearly it'd be much easier to prosecute people if we could compel them to witness against themselves, so why don't we just igno…

The argument made in the article is that it's a "foregone conclusion" that there's child porn on the drives, so decrypting them isn't self-incriminating because they already know what's on the drive. That said, personally I don't buy it. What if there's evidence of other illegal acts on the drive too, ones the police don't know about? Then decrypting the drive would definitely be incriminating because it would tell p…

I'm not sure I understand something, either their argument about hashes, or how whole disk encryption works. I assumed that whole disk encryption meant that the disk, unencrypted, has high entropy, so the whole thing equally looks like snow. Doesn't FileVault encrypt the whole disk? So, where's this hash?

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#107
post #16

This reads as extremely bizarre. I mean, reading the fifth amendment makes it pretty clear - no one should be compelled to witness against oneself. However, it looks like the current executive and judicial are thinking "well, those Founders were just idiots for putting such an amendment in, clearly it'd be much easier to prosecute people if we could compel them to witness against themselves, so why don't we just igno…

The supreme court is unelected, and are the supreme authority in this nation, above president and congress. the solution is simple - make the supreme court stand up to elections. America has had atrocious decisions from the supreme court. In Dred Scott, they said black people have no rights because they are black. In Roe v Wade, the abortion laws of 47 states were struck down by 5 oligarchs. No matter what you believ…

Yes, letting the American people elect Donald Trump to the Supreme Court would obviously improve their decisions.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#108
post #16

This reads as extremely bizarre. I mean, reading the fifth amendment makes it pretty clear - no one should be compelled to witness against oneself. However, it looks like the current executive and judicial are thinking "well, those Founders were just idiots for putting such an amendment in, clearly it'd be much easier to prosecute people if we could compel them to witness against themselves, so why don't we just igno…

The supreme court is unelected, and are the supreme authority in this nation, above president and congress. the solution is simple - make the supreme court stand up to elections. America has had atrocious decisions from the supreme court. In Dred Scott, they said black people have no rights because they are black. In Roe v Wade, the abortion laws of 47 states were struck down by 5 oligarchs. No matter what you believ…

[deleted]

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#109

Earlier quoted context omitted.

Assuming it's shown to be a foregone conclusion you have child porn on your machine, yes.

Then why hasn't this person been prosecuted yet? Are they just wanting him to give up his credentials so that they can refer to this case as a precedent?

Subtle point: "they" don't want or care about his credentials -- they want the underlying evidence for which they know exists (check out "The foregone conclusion doctrine" in page 34 of the source document[0]) and they know that he is capable of providing said evidence.

> > Here, based on Doe’s own statements, the testimony of his sister, and forensic analysis of the hard drives seized from Doe via a search warrant, the government already knows that Doe possessed and owned the hard drives, that he can decrypt them, and that they contain child pornography.[0]

Based on computer logs (of checksummed files being transferred to drives (and, importantly, knowing those filepaths) he admits to owning), online activity, witnesses, his own admission, and his unlocking of his phone provided the evidence needed to reasonably detain him on suspicion of a serious crime. The defendant is known to collect child pornography, even provably sourcing his own from family members -- again, the source document provides far more detail.

Further, my understanding is that the complication is his refusal is frustrating the process of deciding exactly which crimes for which to charge him and he is acting in defiance of a court order (to produce evidence).

[0] https://cdn.arstechnica.net/wp-content/uploads/2017/02/fedsr... (warning: some parts are sickening)

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#110
post #52

Earlier quoted context omitted.

The argument made in the article is that it's a "foregone conclusion" that there's child porn on the drives, so decrypting them isn't self-incriminating because they already know what's on the drive. That said, personally I don't buy it. What if there's evidence of other illegal acts on the drive too, ones the police don't know about? Then decrypting the drive would definitely be incriminating because it would tell p…

I'm not sure I understand something, either their argument about hashes, or how whole disk encryption works. I assumed that whole disk encryption meant that the disk, unencrypted, has high entropy, so the whole thing equally looks like snow. Doesn't FileVault encrypt the whole disk? So, where's this hash?

The defendant provided the password to his iphone (that contained highly-unsavory media of his nieces), which contained an unlock code for his laptop (filevault backup decrypt key). He connected the external drives to this laptop, and when he'd transfer media from his laptop to the drives, logging would occur with the file checksums. The hash/checksum is on the laptop with the filepath to the identified external drives, and because the hashes match known media of child victimization, the prosecution knows exactly where the evidence exists on the drive, once decrypted.
Post reply on HN