Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man jailed over computer password refusal

bbc.co.uk

Post reply on HN
Print view View original

101–110 of 239 posts

Re: Man jailed over computer password refusal

#101

Post by jessriedel »

smokeyj wrote: post #76
boredguy8 wrote: post #42

Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. So, for instance, say you had encrypted files of plans to build a bomb and detailed schematics of the White House. The judge can order you to decrypt the files…

How easy would it be for an officer to present an encrypted computer and say - if you don't unlock this, you're getting thrown in jail. This is no different than a witch hunt, it's totally unprovable and throwing people in jail over not knowing a piece of information is unethical.

In the US, the prosecution is going to have to prove beyond a reasonable doubt that there is, in fact, encrypted information and that the suspect knows the key.

Yes, there are going to be gray areas. But if Bob has one computer in his house with his and only his finger prints all over it, wear that indicates that the computer has been used extensively, and the computer hard drive is filled with an encryption scheme wrapped around otherwise useless gigabytes of random data, then I am sure beyond a reasonable doubt that there is encrypted data on the hard drive and Bob has the key.

Re: Man jailed over computer password refusal

#102

Post by jimmyk »

evgen wrote: post #24
xenophanes wrote: post #13

I realize this story is in the UK, but could it happen in the US or would the 5th amendment protect you? As an American, it seems a bit insane to me for someone to be jailed for refusing to help convict himself.

The 5th amendment protects against forced testimony, not against compulsion to provide evidence. You can refuse to testify against yourself, you cannot refuse to comply with a valid search warrant.

Perhaps a solution is to commit two crimes: crime A which has to do with the encrypted file, and crime B which has nothing to do with it. Then, use a phrase which is self-incriminating for crime B as the password for the encrypted volume. For example, "IBrokeTheSpeedLimitBy15MilesPerHourOnJuneTheTwenty-Seventh,InTheYearTwoThousandAnd4".

Re: Man jailed over computer password refusal

#103

Post by SageRaven »

boredguy8 wrote: post #42

Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. So, for instance, say you had encrypted files of plans to build a bomb and detailed schematics of the White House. The judge can order you to decrypt the files…

For those seriously interested in this area of law, I highly recommend http://cyb3rcrim3.blogspot.com, as it's a really good source of info on the topic . Susan Brenner is a law prof, and her analysis of current cases is a constant treasure trove of interesting nuggets of insight into the law as it pertains to computers, electronic devices, and digital media. It's broken down enough for the layman to grasp, yet heavy enough in vocabulary and citations/references, that a you'll have a decent understanding of the law and how the justice system works.

Re: Man jailed over computer password refusal

#104

Post by fluidcruft »

kgo wrote: post #72
alextgordon wrote: post #69

Earlier quoted context omitted.

Wikipedia has this to say: http://en.wikipedia.org/wiki/United_States_v._Boucher On February 19, 2009, Judge Sessions reversed the magistrate's ruling and directed Boucher "to provide an unencrypted version of the Z drive viewed by the ICE agent.

That case was goofy because he initially typed in his password in front of law enforcement and provided them access, which nullified any claims of self incrimination. It'd be similar to confessing to murder, telling the cops where the body is, and then invoking your right to remain silent, and expecting them not to look for the body under "fruit of the poisonous tree" logic.

Did he? I thought he drove through the checkpoint with the machine turned on/suspended in his back seat with the drive mounted.

Re: Man jailed over computer password refusal

#105

Post by ciupicri »

NathanKP wrote: post #32

It seems like a bad idea to store anything incriminating on your local hard drive. Why not keep your encrypted files on a flash drive? If the police show up destroy the flash drive using a hammer, ensuring that the flash memory chip is thoroughly pulverized and completely unreadable. Likewise, if you are going to be using the internet for devious purposes drive around and use a neighbor's open wireless network access…

I don't think that a flash drive would have been enough in his case. Maybe he had lots of pornographic pictures or videos with children.

Re: Man jailed over computer password refusal

#106

Post by boredguy8 »

kgo wrote: post #77
boredguy8 wrote: post #73

Earlier quoted context omitted.

What happens if you say you forgot the password, and the files in question haven't been accessed in over a year? This is a question in my initial post that's still relevant to UK jurisprudence; an answer to which could move the conversation forward in a way far more productive than imagining I didn't know the article was about something that happened in the UK.

I apologized man... What more do you want?

I'm not the one downvoting you. But I want a conversation that's adding information or content to which I wouldn't easily have access. So for instance, an answer to the question I pose above (or, if not a concrete answer, something along the lines of what would probably happen).

Re: Man jailed over computer password refusal

#107

Post by ciupicri »

awakeasleep wrote: post #20

As great as hidden volumes are, traces showing the inconsistency between the fake and real volume will be left on your system unless you take heroic measures to erase them. Things like logs of all the external drives you connect, and links to recently opened files.

Regarding recently opened files, you can always say that you deleted them.

Re: Man jailed over computer password refusal

#108

Post by Tycho »

lkjuhygthyujk wrote: post #90
boredguy8 wrote: post #42

Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. So, for instance, say you had encrypted files of plans to build a bomb and detailed schematics of the White House. The judge can order you to decrypt the files…

I was a grad student in CS at Cambridge when this law was introduced. A nice man from the police came to lecture us about it. We asked about proving that say the results from a Monte Carlo simulation, or even just a blank disc weren't encrypted - we were told not to worry the law would only be used against terrorists. Since this was before 911 - the 'terrorists' in question were presumably the IRA, not sure they had…

A policeman came to visit our social education class in highschool, and my friend asked was it illegal to have an encrypted file that you don't know the password for. The policeman just looked at him like 'WTF are you talking about?'

Re: Man jailed over computer password refusal

#110

Post by aplusbi »

ck2 wrote: post #17

In the USA can you be compelled to testify against yourself by being coerced into giving a password to law enforcement? Has this been tested yet, out of curiosity? I remember reading they can deny you entry/exit to the USA if customs can't read your laptop but never heard anything like local/FBI. If not, I hope it doesn't go before this particular supreme court.

You cannot be compelled to incriminate yourself in the US. However, that doesn't mean you can't be compelled to give up your password, since it's not the act of giving up the password that is incriminating.*

As an analogy, if you had a safe that contained incriminating evidence and you hid the key, you could be compelled by the court to reveal the location of the key.

* As far as I know (IANAL) whether or not giving up a computer password is considered self-incrimination or not is still undecided.

Post reply on HN