Man jailed indefinitely for refusing to decrypt hard drives loses appeal • Hacker News Board

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#151

Post by ryan_j_naughton » Tue, Mar 21, 2017, 7:11 AM UTC

Thought experiment: What if there were an encryption system whereby if a user inputs one decryption key, the encrypted data decrypts to one set of values and if the user uses a second key, it decrypts to a second set of values.

Sure, in order to encode both sets of data into a single encrypted result would require more storage space, but that is a small price to pay for protection against self incrimination from our ever growing police and surveillance state.

The end of the article captures why this idea would be so effective, viz. "The authorities, however, said no testimony was needed from Rawls. Rather, they said, 'he can keep his passwords to himself' and 'produce his computer and hard drives in an unencrypted state.'"

It is absolutely true and valid that the government has the right to compel people to hand over evidence that they are KNOWN to possess (in the same way that legal discovery is essential to civil cases). The line the government is drawing between self-incrimination and forced cooperation in an investigation is they they don't want him to tell them the password or what is on the drives -- they simply want him to hand over the drives in an intelligible state. Thus, if one could decrypt the drives to an intelligible set of data but not the data they desire, then you would be complying with the court order and could not be held in contempt.

Can someone on HN who knows more about cryptography help poke holes in my idea?

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#152

Post by meesterdude » Tue, Mar 21, 2017, 7:12 AM UTC

null0pointer wrote: post #105

zer0t3ch wrote: post #59

Earlier quoted context omitted.

Can you be compelled to provide something that you don't have access to? Were anyone else in this situation, wouldn't it be plausible to simply claim you don't know that password?

I've wondered about scenarios where you can legitimately claim to not know the password to decrypt a drive. A few different cases I can think of which may be ruled differently by a court. 1) I use a password manager so I don't know the password. However, I have the means to acquire the password. 2) I use a password manager but somehow lost access to it unintentionally. 3) I use a password manager and lost access to i…

one i've ben thinking of is a shuffled keymapping or keyboard - you know what password you type, but not what it actually translates into.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#153

Post by xelxebar » Tue, Mar 21, 2017, 7:13 AM UTC

rayiner wrote: post #78

_xhok wrote: post #64

Earlier quoted context omitted.

The critical question is, why haven't they charged him? It is disingenuous of them to bring up the evidence they currently have essentially in an attempt to demonize him. Their evidence is sufficient or it isn't; if it is they should charge him; if not they're demanding self-incrimination.

You need to distinguish between requiring the defendant to turn over incriminating evidence (which the 5th amendment does not protect), and requiring the defendant to make incriminating statements ( i.e. to provide incriminating testimony). Sometimes, the act of producing evidence in response to a government request involves the defendant making implicit incriminating assertions. If the government says "produce all y…

Thanks for the lucid explanation.

What befuddles my non-lawyer mind is that why such evidence is needed in the first place. If it's established firmly that someone has piles of illegal files, then for the sake of their incrimination, why do the files need to be produced at all?

If on the other hand, the files are being requisitioned for purposes unrelated to the the defendant's current outstanding culpability, then what laws does that kind of thing fall under?

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#154

Post by michaelmrose » Tue, Mar 21, 2017, 7:13 AM UTC

hackuser wrote: post #65

hackuser wrote: post #56

Some discussion overlooks that this is a special case: ... the appeals court, like the police, agreed that the presence of child porn on his drives was a "foregone conclusion." The Fifth Amendment, at its most basic level, protects suspects from being forced to disclose incriminating evidence. In this instance, however, the authorities said they already know there's child porn on the drives, so Rawls' constitutional…

And for ease of reading, I'll reply to my own comment with other interesting issues: * "The fact remains that the government has not brought charges," [his attorney] Donoghue said in a telephone interview . It seems a warrant is at issue, if I understand correctly. * The contempt-of-court order against Rawls was obtained by authorities citing the 1789 All Writs Act. The All Writs Act was the same law the Justice Depa…

They want to establish useful precedent ideally

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#155

Post by michaelmrose » Tue, Mar 21, 2017, 7:15 AM UTC

timv wrote: post #104

pinum wrote: post #92

Earlier quoted context omitted.

18 months later, though, it is completely plausible that he really has forgot. I don't think I would remember a complex password that I haven't used for 18 months. Hell, I sometimes have to reset simple passwords that I created last month. If you don't use knowledge, you forget it.

Perhaps, but the judge can only make judgements based on the arguments presented. If the defendant wanted to argue that he no longer remembered the password (but would be willing to decrypt the drive if he could), then that's something that the judge would consider. But a judge can't (and won't) simply say "Oh, maybe he hasn't complied because he just forgot the password. I'm going to let him off"

Its literally impossible to prove someone has or hasn't forgotten something. You shouldn't be able to jail someone indefinitely for not producing something you can't prove exists.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#156

Post by _9vpl » Tue, Mar 21, 2017, 7:16 AM UTC

ryan_j_naughton wrote: post #151

Thought experiment: What if there were an encryption system whereby if a user inputs one decryption key, the encrypted data decrypts to one set of values and if the user uses a second key, it decrypts to a second set of values. Sure, in order to encode both sets of data into a single encrypted result would require more storage space, but that is a small price to pay for protection against self incrimination from our…

This is possible, at least in some contexts. I'm no expert, but the bitcoin wallet, Trezor, has implemented this - known as "plausible deniability".

The idea is if you are compelled somehow by force to unlock your bitcoin wallet, you can use a secondary password that assumingly has less bitcoin than your regular bitcoin wallet.

https://news.bitcoin.com/bitcoin-wallet-plausible-deniabilit...

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#157

Post by RangerScience » Tue, Mar 21, 2017, 7:18 AM UTC

olliej wrote: post #103

rayiner wrote: post #78

Earlier quoted context omitted.

You need to distinguish between requiring the defendant to turn over incriminating evidence (which the 5th amendment does not protect), and requiring the defendant to make incriminating statements ( i.e. to provide incriminating testimony). Sometimes, the act of producing evidence in response to a government request involves the defendant making implicit incriminating assertions. If the government says "produce all y…

Quite aside from anything else, can someone explain whether or not the same logic would apply to (for example) asking someone to open a safe vs. the code to open the safe. It seems like this ruling would say that failing to open the safe is functionally the same? As a gratuitously distorted example, lets say i had cooked accounting books in a spreadsheet on my computer, and they were encrypted by a random password th…

If I understand the parent post, it's basically protecting you against the "leading questions" of investigation...?

You opening the safe cannot be used as evidence against you; that would cause your action to be "testimonial", and protected. The contents of the safe are evidence, and not testimonial.

If I'm understanding this correctly; it would be like saying "open the safe with the illegal weapons in it", and pointing at the safe. If you open it, does that mean you're admitting the weapons are illegal?

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#158

Post by tedunangst » Tue, Mar 21, 2017, 7:20 AM UTC

ryan_j_naughton wrote: post #151

Thought experiment: What if there were an encryption system whereby if a user inputs one decryption key, the encrypted data decrypts to one set of values and if the user uses a second key, it decrypts to a second set of values. Sure, in order to encode both sets of data into a single encrypted result would require more storage space, but that is a small price to pay for protection against self incrimination from our…

They also have a set of hashes of files they expect to find. If they don't find those files, they'll probably ask more questions.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#159

Post by fatal510 » Tue, Mar 21, 2017, 7:27 AM UTC

striking wrote: post #37

Overtonwindow wrote: post #35

This raises an interesting idea: why not create two passwords for encrypted drives, one password decrypt the drive, another password completely wipes the drive. This way if someone is forced to give a password to decrypt something, that password renders the data moot. Thoughts?

Here's mine: destruction of evidence is a crime. Probably not the best idea. Hiding the partition or otherwise making the encrypted data hidden is probably your only bet.

That's why you say "There is nothing on that drive! Here you can have the password."

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#160

Post by mrmstr » Tue, Mar 21, 2017, 7:29 AM UTC

Buge wrote: post #99

oxide wrote: post #84

Earlier quoted context omitted.

Where's the mandatory minimums for possession of child porngraphy? The zero tolerance? Our prisons fill with drug offenders, yet we give sex offenders a scarlet letter + probation?

Keep in mind that a 17 year old taking a nude picture of themself is in possession of child pornography. Do you want a harsh minimum sentence for that?

You gotta cut the government some slack here, they have contracts with private prison providers and quotas to fulfill. Can't have compassion and reason get in the way of that.

Also think of the children.