Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man jailed over computer password refusal

bbc.co.uk

Post reply on HN
Print view View original

151–160 of 239 posts

Re: Man jailed over computer password refusal

#151

Post by Vivtek »

ck2 wrote: post #17

In the USA can you be compelled to testify against yourself by being coerced into giving a password to law enforcement? Has this been tested yet, out of curiosity? I remember reading they can deny you entry/exit to the USA if customs can't read your laptop but never heard anything like local/FBI. If not, I hope it doesn't go before this particular supreme court.

It's not analogous to testifying against yourself (Fifth Amendment). It's analogous to forcing you to give them a key to a door so they can search your basement.

Re: Man jailed over computer password refusal

#152

Post by Vivtek »

jrockway wrote: post #58
lhnn wrote: post #50

Earlier quoted context omitted.

My understanding is that the "oops Agent Smith, my WiFi was unsecured" is not legally feasible, or is going away.. you are responsible for access to your pipe. Which sucks... heh.

Where did you get this idea from?

I got this idea from the MPAA telling my ISP to tell me to secure my WiFi or lose my connectivity.

Re: Man jailed over computer password refusal

#153

Post by bshep »

omh wrote: post #38
vic_nyc wrote: post #23

I wonder why he didn't say he "forgot the password". Although it may seem implausible, how could they prove it's not true?

I think that the law is worded so that it's an offence to have encrypted files and not be able to decrypt them. Whether it's deliberate or just forgotten isn't relevant (though I'd hope it would make a difference in sentencing).

Just out of curiosity, what would happen if someone e-mailed you something with a title of 'Here are the files you requested about [illegal stuff]' and include an attachment with encrypted contents.

Then say I notify the cops about your 'illegal' activities.

Re: Man jailed over computer password refusal

#154

Post by blahblahblah »

evgen wrote: post #141
wjy wrote: post #64

Earlier quoted context omitted.

Testifying is providing information to the court. Decrypting your hard drive is providing information to the court. What's the difference? I would argue that all evidence is really just information. Once again, the old lines dividing one category from another become blurred.

The difference is that testimony is revealing the contents of your brain ("I saw X, I did or did not do Y, I felt Z") and evidence is revealing the contents of your car trunk. Evidence does not have its own opinion of what did or did not happen, evidence does not decide what is or is not the truth. Evidence simply exists; it is for others (giving testimony) to give evidence context and relevance.

The password is among the contents of your brain.

Re: Man jailed over computer password refusal

#155

Post by barrkel »

16s wrote: post #145
points wrote: post #49

Earlier quoted context omitted.

How can you even prove that a file is encrypted? The whole law is baloney.

Use TrueCrypt to do whole disk encryption on your Windows XP hard drive. Then boot your computer with a Linux Live CD and dd the first 512 bytes to stdout. This is what you'll see in plain text ASCII: "TrueCrypt Boot Loader" No expert is needed to prove that you are using TrueCrypt whole disk encryption. It has a huge stamp right up front.

That's certainly true for that particular instance, in that particular implementation. But it's not necessarily the case. Take some random file and encrypt it with gpg; there's nothing obvious in the contents to mark it out as encrypted data.

Re: Man jailed over computer password refusal

#156

Post by sswam »

kgo wrote: post #71
boredguy8 wrote: post #70

Earlier quoted context omitted.

But some people are ASKING about the US, and everything I've said above is as it pertains to US law. Which is a worthwhile discussion anyway, as US readers are the largest single group of HN readers.

Apologies... If you had replied to a question, I wouldn't have felt compelled to post that. But in the UK, it's illegal to refuse to give up your password.

Giving up my passwords would compromise the security of other people, so I wouldn't do it.

Re: Man jailed over computer password refusal

#157

Post by lmkg »

boredguy8 wrote: post #42

Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. So, for instance, say you had encrypted files of plans to build a bomb and detailed schematics of the White House. The judge can order you to decrypt the files…

> The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th.

This is a really subtle point, but in the US this is not (usually) the case, because this is still self-incrimination. You see, by entering the password, you are demonstrating that you have access to the encrypted information, and demonstrating that you have that power is technically self-incrimination. The password is one piece of information that you can't be compelled to divulge, and the fact that you have the password is a separate piece of information, and you cannot be compelled to reveal either. This is also a really important piece of information too, because in order to stick you with any legal consequences associated with the encrypted information, they generally have to prove that you have control over or access to the information. If a file is encrypted it is still possible to reasonably doubt that you have access to its contents despite having access to the physical drive it is on.

While it is (currently, as far as I am aware) untested in the court of law, it may be possible to compel someone to use or divulge their password if this does not incriminate the person to do this. I can think of two ways this could happen: a) access/control to the encrypted information has already been proven, so the testimony is of null value b) the prosecution is not allowed to use the fact that you know the password in court, and takes the gamble that they can prove access/control some other way (possibly by using contents of the information).

This is, of course, assuming that passwords are classified as "testimony" and therefore protected by the 5th Amendment. If the password is ever recorded on a physical medium such as a piece of paper, that piece of paper is probably not testimony, but rather evidence. This means that, like the key to a safe, it is protected by the 4th Amendment rather than the 5th, and you can be compelled to give up the paper via a warrant. This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick?

(IANAL, but I've studied the topic as a layman)

Re: Man jailed over computer password refusal

#158

Post by sswam »

boredguy8 wrote: post #45
NathanKP wrote: post #32

It seems like a bad idea to store anything incriminating on your local hard drive. Why not keep your encrypted files on a flash drive? If the police show up destroy the flash drive using a hammer, ensuring that the flash memory chip is thoroughly pulverized and completely unreadable. Likewise, if you are going to be using the internet for devious purposes drive around and use a neighbor's open wireless network access…

Intentionally destroying incriminating evidence is probably not something you should ever do. Certainly not in such a way that leaves evidence in the form of pulverized IC remains all over your kitchen counter.

I can see there will be a market for edible micro SD cards.

"Sir, we see from your blood sample that you have recently digested some silicon wafer..."

Re: Man jailed over computer password refusal

#159

Post by sswam »

tjarratt wrote: post #44
NathanKP wrote: post #32

It seems like a bad idea to store anything incriminating on your local hard drive. Why not keep your encrypted files on a flash drive? If the police show up destroy the flash drive using a hammer, ensuring that the flash memory chip is thoroughly pulverized and completely unreadable. Likewise, if you are going to be using the internet for devious purposes drive around and use a neighbor's open wireless network access…

I understand that in some areas, not only is it illegal to operate an insecure wireless access point (in the UK at least), you can be held accountable for the actions of people that use the access point.

that's amusing, considering that every wireless access point is insecure

Re: Man jailed over computer password refusal

#160

Post by 16s »

barrkel wrote: post #155
16s wrote: post #145

Earlier quoted context omitted.

Use TrueCrypt to do whole disk encryption on your Windows XP hard drive. Then boot your computer with a Linux Live CD and dd the first 512 bytes to stdout. This is what you'll see in plain text ASCII: "TrueCrypt Boot Loader" No expert is needed to prove that you are using TrueCrypt whole disk encryption. It has a huge stamp right up front.

That's certainly true for that particular instance, in that particular implementation. But it's not necessarily the case. Take some random file and encrypt it with gpg; there's nothing obvious in the contents to mark it out as encrypted data.

tom@ubuntu:~$ gpg -c flag.png

tom@ubuntu:~$ gpg -v --list-packets flag.png.gpg

   :symkey enc packet: version 4, cipher 3, s2k 3, hash 2

   salt eae60ad4255dc4e2, count 65536 (96)

   gpg: CAST5 encrypted data
OpenPGP encrypted data is easy to find too. It even tells you the algo used. The example is symmetrically encrypted, but it works the same with asymmetric keys. Even shows who it is encrypted for. Edit: formatting.
Post reply on HN