Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

bleepingcomputer.com

Post reply on HN
Print view View original

31–40 of 284 posts

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#31

Post by cmiles74 »

jancsika wrote: post #29

There's a better article in Ars: https://arstechnica.com/tech-policy/2017/03/man-jailed-indef... From that article: > The court also noted that the authorities "found [on the Mac Book Pro] one image depicting a pubescent girl in a sexually suggestive position and logs that suggested the user had visited groups with titles common in child exploitation." They also said the man's sister had "reported" that her brother s…

Is this all about setting precedent for holding people indefinitely under the All Writs Act? It seems like they'd easily win at trial.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#32

Post by Neverbolt »

stephengillie wrote: post #15
xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

Something doesn't add up in this story. Encryption and hashing are different processes with different algorithms - SHA vs MD5. For example, IPSec VPNs hash a packet with MD5 to prevent tampering, then encrypt the hash with SHA256 to prevent viewing. (Because the message could be modified while encrypted, were it not also hashed.) Isn't the point of encryption that it doesn't create a reliable hash - that 2 identical…

There are several misconceptions in this comment, first and foremost that SHA is encryption, which it is not. It is a hashing algorithm, not unlike MD5, though "stronger".

Secondly, when you have two files that are exactly the same and encrypt both with the same key, method and parameters then both will have the same hash. ( Though I could imagine Apple doing stuff with padding, and other parameters to make this not happen)

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#33

Post by ja27 »

xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

My understanding is that they know the file hashes and path they were written to from logs of the tool he used to download them.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#34

Post by ZenoArrow »

One potential option:

1. Install a hardware keylogger (software keylogger wouldn't work) in the laptop.

2. Release the defendant.

3. Get a warrant for the arrest of the defendant for CP-related crime.

4. Decrypt the laptop with the password recovered from the keylogger.

All of this depends on the suspect using the laptop again, but I'm guessing they'd want to recover the contents on the laptop.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#35

Post by cmiles74 »

xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

I was thinking perhaps the hash is from something like BitTorrent, where they have a list of hashes that actually identifies components of the file. Then they see that the data for a particular series of matching hashes looks like they were saved to an external drive.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#36

Post by libeclipse »

ZenoArrow wrote: post #34

One potential option: 1. Install a hardware keylogger (software keylogger wouldn't work) in the laptop. 2. Release the defendant. 3. Get a warrant for the arrest of the defendant for CP-related crime. 4. Decrypt the laptop with the password recovered from the keylogger. All of this depends on the suspect using the laptop again, but I'm guessing they'd want to recover the contents on the laptop.

Anyone with half a brain wouldn't trust anything they get back from a third party.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#37

Post by libeclipse »

> Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content.

This makes zero sense. It would have to be an utterly terrible encryption program for anyone to be able to see the hashes of the encrypted files.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#38

Post by [deleted] »

jancsika wrote: post #29

There's a better article in Ars: https://arstechnica.com/tech-policy/2017/03/man-jailed-indef... From that article: > The court also noted that the authorities "found [on the Mac Book Pro] one image depicting a pubescent girl in a sexually suggestive position and logs that suggested the user had visited groups with titles common in child exploitation." They also said the man's sister had "reported" that her brother s…

[deleted]

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#39

Post by chatmasta »

Neverbolt wrote: post #32
stephengillie wrote: post #15

Earlier quoted context omitted.

Something doesn't add up in this story. Encryption and hashing are different processes with different algorithms - SHA vs MD5. For example, IPSec VPNs hash a packet with MD5 to prevent tampering, then encrypt the hash with SHA256 to prevent viewing. (Because the message could be modified while encrypted, were it not also hashed.) Isn't the point of encryption that it doesn't create a reliable hash - that 2 identical…

There are several misconceptions in this comment, first and foremost that SHA is encryption, which it is not. It is a hashing algorithm, not unlike MD5, though "stronger". Secondly, when you have two files that are exactly the same and encrypt both with the same key, method and parameters then both will have the same hash. ( Though I could imagine Apple doing stuff with padding, and other parameters to make this not…

Right... so for the authorities to "compare" the hash of an encrypted file with that of a known original, they would need to encrypt the original with the same private key used to encrypt the encrypted file. If they had that private key, wouldn't it be sufficient to unlock the drive? They wouldn't need his cooperation to decrypt the drive if they had a private key. So it seems like a catch-22 compelling him to decrypt the drive based on a hash collision.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#40

Post by geofft »

jancsika wrote: post #29

There's a better article in Ars: https://arstechnica.com/tech-policy/2017/03/man-jailed-indef... From that article: > The court also noted that the authorities "found [on the Mac Book Pro] one image depicting a pubescent girl in a sexually suggestive position and logs that suggested the user had visited groups with titles common in child exploitation." They also said the man's sister had "reported" that her brother s…

> "The fact remains that the government has not brought charges," Donoghue said in a telephone interview. "Our client has now been in custody for almost 18 months based on his assertion of his Fifth Amendment right against compelled self-incrimination."

To be clear (and I am pretty sure the public defender knows this, but is just phrasing it like this for public perception), the prosecution's position is that the Fifth Amendment is irrelevant because they're compelling him to do an act under the All Writs Act and not to testify about anything (produce a password, produce files, etc.). The approach they're taking is that he's a person in a position to do something to let the government access evidence, and it doesn't matter that he's the person they want evidence against, instead of a third party (as with New York Telephone Co., or more recently Apple), and he's in prison for refusing compliance with the writ.

It's totally unclear that this legal strategy should work in a just/ideal society, but, at least for now, the courts are allowing it.

Post reply on HN