Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

bleepingcomputer.com

Post reply on HN
Print view View original

21–30 of 284 posts

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#21

Post by ivanbakel »

xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

Hashes might not fall under being "beyond reasonable doubt" - I'd be interested to see the legal history, if any, of them being used in convictions. There'll always be the argument of the pigeonhole principle.

On a similar note, I wonder if this will spur interest in a kind of file-doping program to confuse hashes of drive contents. A few pixels won't make a difference if you're planning on just viewing some images.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#22

Post by nashashmi »

xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

Depends on the kind of encryption used. If the encryption is convergent encryption, the hash ID stays.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#23

Post by Arnt »

jo909 wrote: post #20
NiklasMort wrote: post #8

Earlier quoted context omitted.

that makes 0 sense, if the files are encrypted they cannot be a match

From what I understand, they have basically the logfile or other metadata from the program he used to download/manage these files, which contains the hashes. The encrypted drives in question are external drives, not the OS drive.

Reference?

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#24

Post by [deleted] »

godzillabrennus wrote: post #2

The accused crime is heinous and there is some evidence against him stated in the article but common, an indefinite jail sentence with no conviction? Then people wonder why the country elects Trump to shake things up. This guy should stand trial or be let go.

[deleted]

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#25

Post by poizan42 »

Pywarrior wrote: post #19
infinisil wrote: post #14

Earlier quoted context omitted.

> Do they encrypt known CP files with the FileVault key and then compare? This shouldn't work because if they had the key (which should be encrypted with the password) then they could also just decrypt the rest. Somebody on IRC said that maybe the encrypted filesystem saves hashes of the files unencrypted, but not sure if Apple's FileVault does this.

Storing hashes of unencrypted files, would that allow FileVault to verify it was decrypted without error?

The correct order is hash then encrypt, exactly so you can't do that. Now I don't know if FileVault is doing this correctly, but hopefully it does.

Edit: So two people have downvoted me without explanation. Is what I'm saying wrong?

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#26

Post by geofft »

xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

Some Googling finds http://caselaw.findlaw.com/us-3rd-circuit/1853477.html , which says there's both an internal hard disk and an external hard disk, and the external one is the one at issue:

> The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash” values to be child pornography.[3] The files, however, were not on the Mac Pro, but instead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed.

If he's downloading them or storing them by some content-addressable system (torrents, something rsync-like that generates hashes before syncing them, etc.), I can easily believe that there's forensic evidence on the internal hard drive that the files were copied, including the hash of the plaintext, but the files themselves aren't present in plaintext.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#27

Post by jo909 »

Arnt wrote: post #23
jo909 wrote: post #20

Earlier quoted context omitted.

From what I understand, they have basically the logfile or other metadata from the program he used to download/manage these files, which contains the hashes. The encrypted drives in question are external drives, not the OS drive.

Reference?

http://www2.ca3.uscourts.gov/opinarch/153537p.pdf

Despite Doe’s refusal, f orensic analysts discovered the password to decrypt the Mac Pro Computer , but could not de crypt the external hard drives. [...] The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash ” values to be child pornography. 3 The files, however, were not on the Mac Pro, but i nstead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#28

Post by geofft »

ivanbakel wrote: post #21
xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

Hashes might not fall under being "beyond reasonable doubt" - I'd be interested to see the legal history, if any, of them being used in convictions. There'll always be the argument of the pigeonhole principle. On a similar note, I wonder if this will spur interest in a kind of file-doping program to confuse hashes of drive contents. A few pixels won't make a difference if you're planning on just viewing some images.

I think they're also looking for other files, whose hashes they don't have forensic evidence of, to secure a stronger conviction (e.g., they might suspect him of producing child pornography and not just downloading it, and so they're looking for files whose hashes they don't already know).

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#29

Post by jancsika »

There's a better article in Ars:

https://arstechnica.com/tech-policy/2017/03/man-jailed-indef...

From that article:

> The court also noted that the authorities "found [on the Mac Book Pro] one image depicting a pubescent girl in a sexually suggestive position and logs that suggested the user had visited groups with titles common in child exploitation." They also said the man's sister had "reported" that her brother showed her hundreds of pictures and videos of child pornography. All of this, according to the appeals court, meant that the lower court lawfully ordered Rawls to unlock the drives.

And then this from Rawls' public defender:

> "The fact remains that the government has not brought charges," Donoghue said in a telephone interview. "Our client has now been in custody for almost 18 months based on his assertion of his Fifth Amendment right against compelled self-incrimination."

There are numerous quotes from Comey and many others in the FBI and DOJ who have argued that forced decryption is necessary to catch the bad guys. But here the argument is the exact opposite: the evidence they have is so overwhelming that it is a "foregone conclusion" that more of the same incriminating evidence is on the encrypted drive.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#30

Post by cmiles74 »

Arnt wrote: post #23
jo909 wrote: post #20

Earlier quoted context omitted.

From what I understand, they have basically the logfile or other metadata from the program he used to download/manage these files, which contains the hashes. The encrypted drives in question are external drives, not the OS drive.

Reference?

It sounds like they suspect the files were downloaded directly to the external drive, perhaps there's a pointer in a log file or something with the path. Clearly they haven't proven that, hence their wish to inspect the decrypted drive.

IMHO, if they really wanted to charge him and take him to trial, they have plenty of evidence. I doubt a jury would be sympathetic to the "I forgot my password" argument and the logic would be that if the files _were not_ on the external drive then he would willingly decrypt it to prove as much.

Post reply on HN