Live data from Hacker News

Man jailed indefinitely for refusing to decrypt hard drives loses appeal

arstechnica.com

181–190 of 413 posts

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#181
post #101

Earlier quoted context omitted.

Encrypted drives can be opened without the password. Difficulty varies of course, but it can be done (e.g. iPhone).

That was only because they chose a weak password. With a 100+ bit password, it's impossible.

True, though 100 bit passwords are extremely uncommon. Even deadhorsebatterystaple claims to be less than 50.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#182

Earlier quoted context omitted.

It's not as black and white as you make it. If there is a warrant to search my property, I am obligated to assist if required. E.g. open the gun safe. (Hey, speaking of guns...You know what other antedquated amendment from the Founding Fathers would be really convenient to ignore...) Now, AFAIK, no one has tested whether that still hold true of a combination safe, where the access substaintivly requires information f…

> If there is a warrant to search my property, I am obligated to assist if required. I'm not sure that's true, the police are authorized to break whatever they need to if you don't assist. As for combo safes, this seems like a good overview: http://blogs.denverpost.com/crime/2012/01/05/why-criminals-s...

Yes, they can proceed without your assistance. Also, they can charge you with obstruction with justice.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#183
post #16

This reads as extremely bizarre. I mean, reading the fifth amendment makes it pretty clear - no one should be compelled to witness against oneself. However, it looks like the current executive and judicial are thinking "well, those Founders were just idiots for putting such an amendment in, clearly it'd be much easier to prosecute people if we could compel them to witness against themselves, so why don't we just igno…

Your interpretation of the 5th amendment is quite different than it has been historically interpreted by the courts. For example, in a trial, the prosecutor might subpoena some documents and you cannot refuse to turn over those documents, unless doing so would trigger a 5th amendment assertion. Turning over the documents implicitly testifies to at least two important pieces of information: that the documents exist an…

So here's my concern: guy's now been in jail without charge for 18 months. The prosecutors say his guilt is a foregone conclusion, but apparently it's not foregone enough that they're willing to go ahead and prosecute without the contents of his hard drive. They're gonna hold off until they get what they need.

We're starting to get to the edge of the point where this guy might legitimately forget his password. I think we can assume the FBI has been running a common passwords/dictionary attack with common password symbol substitutions for the last 18 months, and apparently they haven't found the answer, so this password is probably a pretty good one that's not based on a word or even a sentence.

If he stays in jail without trial for another two years and then says "I can't remember my password any more", what should we do?

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#184
post #78

Earlier quoted context omitted.

You need to distinguish between requiring the defendant to turn over incriminating evidence (which the 5th amendment does not protect), and requiring the defendant to make incriminating statements ( i.e. to provide incriminating testimony). Sometimes, the act of producing evidence in response to a government request involves the defendant making implicit incriminating assertions. If the government says "produce all y…

Thanks for the lucid explanation. What befuddles my non-lawyer mind is that why such evidence is needed in the first place. If it's established firmly that someone has piles of illegal files, then for the sake of their incrimination, why do the files need to be produced at all? If on the other hand, the files are being requisitioned for purposes unrelated to the the defendant's current outstanding culpability, then w…

IANAL, but from reading about this case (and opinions from actual lawyers), I believe it's because they actually don't have the evidence to convict (or they believe the evidence they have, absent the files on the encrypted drive, are not enough, or at least not enough for the sentence they want). They know the evidence on the drive exists, but cannot get up in front of a judge and jury and say "because we found these hashes in the logs, we know there are these files on the drive". They have to actually produce the files themselves.

So, you might say, ok, then that means asking Rawls to unlock the drives is asking him to incriminate himself, and that's not cool. But still, go back to the "foregone conclusion" bit: this isn't a fishing expedition to see if they can find evidence of wrongdoing. They're not asking him, "Hey, do you have any child porn on your hard drives? If so, give them to us." If that were what they're doing, Rawls would be perfectly in the right to say, "I do not have any files to give you". They know, based on the log files, that the incriminating files are on the drive. They are merely requiring Rawls to produce evidence that they know exists, and his refusal to do so is unlawful. Just as if someone refused to turn over bank records that the authorities knew existed.

I know I'm not explaining this perfectly (IANAL, as I said), but hopefully this helps?

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#185

Earlier quoted context omitted.

> Quite aside from anything else, can someone explain whether or not the same logic would apply to (for example) asking someone to open a safe vs. the code to open the safe. It seems like this ruling would say that failing to open the safe is functionally the same? Basically, judges don't agree on which way this scenario comes out. > Outside of the law i don't like the forgone conclusion stuff - for example, revoluti…

a safe will simply be cracked if there is a warrant. easy as that.

Kind of missing the point: let's say it's a safe that is incredibly difficult to crack, and there's a 90% chance of making a mistake that will trigger a failsafe that will destroy the contents of the safe. In that scenario, the authorities would be unlikely to attempt to crack it.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#186

Some discussion overlooks that this is a special case: ... the appeals court, like the police, agreed that the presence of child porn on his drives was a "foregone conclusion." The Fifth Amendment, at its most basic level, protects suspects from being forced to disclose incriminating evidence. In this instance, however, the authorities said they already know there's child porn on the drives, so Rawls' constitutional…

And for ease of reading, I'll reply to my own comment with other interesting issues: * "The fact remains that the government has not brought charges," [his attorney] Donoghue said in a telephone interview . It seems a warrant is at issue, if I understand correctly. * The contempt-of-court order against Rawls was obtained by authorities citing the 1789 All Writs Act. The All Writs Act was the same law the Justice Depa…

> My completely amateur thoughts: If they already can prove he has child porn, then they don't need the additional evidence. If they do need the additional evidence, then he is incriminating himself.

Except that's not how it works, and that's not what the 5th protects against. Let's say you have bank records that incriminate you in some money-laundering scheme. The authorities know that you have these records, because an associate of yours has informed them that you do. The protection against self-incrimination is about transfer of information, not about pure action (even if that pure action implicitly transfers incriminating information). The incriminating information would be "I have bank records that detail illegal activity". The authorities already know that; they do not have to ask you to provide that incriminating information. However, it is absolutely within their rights to say "give me all your bank records dated from X to Y", and yes, you must comply.

Sure, you can try to provide incomplete or doctored records, but if they're able to prove that they're incomplete, you're in contempt of the court order, and they'll likely add obstruction of justice or evidence tampering to the list of charges.

In the narrowest possible view, the 5th protects you from being put up on the stand and to be coerced into a confession. Some/many judges interpret it a bit wider than that, but it seems few would find the request that Rawls turns over the files in question to be problematic.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#187

Earlier quoted context omitted.

Isn't the man innocent until proven guilty?

The court accepted evidence that he'd downloaded and shared all manner of such filth, including both technical evidence and testimony from his sister.

Then why couldn't they convict him on that evidence?

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#188
post #164

Earlier quoted context omitted.

I don't think drug offenders should be put in prison since it's a victimless crime. I think child porno while much more serious does invoke some of that chain of reasoning. To me there is a big difference between a guy who found some on the internet and someone who produces or pays for it. I would be wary of putting in minimum sentencing for such crimes unless it was only targeted towards those producing/paying as yo…

> That and art, if someone draws child pornography is that a crime? If blizzard says one of their overwatch characters is 17, are the people who make those animated porno videos making child porn? And are the people watching it consuming child porn? The answers to these questions are obvious: no and no. If the answers are any different or short of being absolute, then that's a clear hole in the first amendment.

"18 U.S. Code § 1466A - Obscene visual representations of the sexual abuse of children

Any person who, in a circumstance described in subsection (d), knowingly produces, distributes, receives, or possesses with intent to distribute, a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting, that (1) (A) depicts a minor engaging in sexually explicit conduct; and (B) is obscene (...) or attempts or conspires to do so, shall be subject to the penalties provided in section 2252A(b)(2), including the penalties provided for cases involving a prior conviction. It is not a required element of any offense under this section that the minor depicted actually exist."

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#189

Thought experiment: What if there were an encryption system whereby if a user inputs one decryption key, the encrypted data decrypts to one set of values and if the user uses a second key, it decrypts to a second set of values. Sure, in order to encode both sets of data into a single encrypted result would require more storage space, but that is a small price to pay for protection against self incrimination from our…

Encrypted data should be indistinguishable from random, so if you had an encryption system that randomised the unused portion of your disk nobody except yourself would know whether there was data there or not.

Re: Man jailed indefinitely for refusing to decrypt hard drives loses appeal

#190
post #16

This reads as extremely bizarre. I mean, reading the fifth amendment makes it pretty clear - no one should be compelled to witness against oneself. However, it looks like the current executive and judicial are thinking "well, those Founders were just idiots for putting such an amendment in, clearly it'd be much easier to prosecute people if we could compel them to witness against themselves, so why don't we just igno…

Your interpretation of the 5th amendment is quite different than it has been historically interpreted by the courts. For example, in a trial, the prosecutor might subpoena some documents and you cannot refuse to turn over those documents, unless doing so would trigger a 5th amendment assertion. Turning over the documents implicitly testifies to at least two important pieces of information: that the documents exist an…

There are, as far as I can tell some weaknesses in that argument, at least from a lay perspective.

- There must be evidence that I can unlock the device for the two situations to be equivalent, and the request must be for specific documents known to exist. If they don't exist all evidence found must be invalidated because the cause for the search was invalid.

- If evidence of ability to unlock the device does not exists, but the assumption is that since it's mine I can unlock it, I think the analogy is slightly flawed. Since the ask is now not about producing a specific thing I'm known to possess, I'm indirectly being asked to produce a document (password), albeit not in material form but typed on a keyboard. Since it's never been proved that I actually am able to open it, the situation is not equivalent, but more like there being a safe in my house that nobody has seen me open, no key is know to exist, but since I own the house I am assumed to be able to open it, and I'm held in contempt because I say I can't or won't open it. It's not too uncommon for a house to contain a safe the current owner can't open, but it does not lead to the same situation since it can usually be forced open. The only difference with good encryption is that the option to use force has become increasingly impotent.

- Unlocking a computer without proper limits and auditing of the search is also more like being asked to give access to any document storage rooms I own or have access to. Reason being that unlocking a device will in many cases give access to more than the bare contents of the drive, giving access to emails, Dropbox, and other logged on applications and sessions. Since parallel construction appear to be a thing, it's ripe for abuse.

Maybe there needs to be a process where independent auditors can, under surveillance of the defendants lawyer produce named documents from seized evidence, as giving police and/or prosecutors blanket access to devices entire content could create lots of opportunities to create parallel construction stories for any content found not under the current warrant, and as bizarre parallel construction is, it appears to have been used.

Post reply on HN