Man jailed over computer password refusal • Hacker News Board

Re: Man jailed over computer password refusal

#191

Post by rdtsc » Wed, Oct 06, 2010, 5:03 AM UTC

Vivtek wrote: post #151

ck2 wrote: post #17

In the USA can you be compelled to testify against yourself by being coerced into giving a password to law enforcement? Has this been tested yet, out of curiosity? I remember reading they can deny you entry/exit to the USA if customs can't read your laptop but never heard anything like local/FBI. If not, I hope it doesn't go before this particular supreme court.

It's not analogous to testifying against yourself (Fifth Amendment). It's analogous to forcing you to give them a key to a door so they can search your basement.

Maybe. It is still not clear. In this case "your basement" consists of information (bits). The 5th protects you from divulging information that would incriminate yourself.

If they want to take your hard drive or take your computer as evidence they can take it by issuing a warrant. They can argue that your encrypted stuff is really dangerous because it is encrypted but I think they shouldn't be able to make you talk and divulge the encrypted info.

Now that is what "I think" should happen. I believe there will occur some high profile case, that will lead to creation of laws that will either force key escrow, ban encryption, or force you to divulge the password under threat of jail time or very high fines.

Re: Man jailed over computer password refusal

#192

Post by SwellJoe » Wed, Oct 06, 2010, 5:04 AM UTC

stretchwithme wrote: post #74

boredguy8 wrote: post #42

Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. So, for instance, say you had encrypted files of plans to build a bomb and detailed schematics of the White House. The judge can order you to decrypt the files…

just tell 'em you forgot it

Lying under oath is a criminal offense. Proving you're lying may be tricky, but if it were to somehow become obvious you were lying, you'd then have to answer for that offense as well as whatever other charges you were dealing with before.

This is really common advice, but I'm not sure it's the best option.

Re: Man jailed over computer password refusal

#193

Post by rdtsc » Wed, Oct 06, 2010, 5:16 AM UTC

jrockway wrote: post #57

pilom wrote: post #28

Earlier quoted context omitted.

In the US the current rules for personal hard drives are bound by the 5th amendment which has been interpreted as "a reasonable expectation for privacy." What happens is the police say "Give us your password and we'll drop whatever sentence by 75% for helping the investigation." You don't have to give your password but the NSA works pretty extensively with law enforcement and the FBI (most US cases that require passw…

Do you think the NSA is going to reveal to foreign governments that they've broken AES by going after some guy with child porn on his laptop? I personally doubt it. Could the NSA cooperate with the FBI? Yes. Will they? Not if it means they can't spy on Russia anymore.

They could just provide the password without divulging how they did it. The best way would be for them to get the drive, if they crack the password, and the password looks like it could have been guessed or generated from some contextual info about the subject or the case, then they return it the police. If they do crack it but the password is actually a random string and disclosing it would betray NSA's abilities, they they simply refuse to disclose it.

On the other hand maybe it would be better to create disinformation that they have cracked all kinds of ciphers or at least their popular implementations? Maybe it will lead enemies to try to implement their own or use alternate implementations that are actually less secure. This will be similar to Airforce's disinformation related to captured UFO tech in the 50s and 60s...

Re: Man jailed over computer password refusal

#194

Post by jessriedel » Wed, Oct 06, 2010, 5:28 AM UTC

jemfinch wrote: post #132

jeromec wrote: post #118

Earlier quoted context omitted.

To establish reasonable doubt all the defense has to do is come up with some alternative way all of your facts can be true without Bob having the key. I can think of two from the top of my head. 1. Bob has mischievous friends, or worse, enemies at school. He leaves his laptop unattended/exposed where someone installs the encryption then wipes their fingerprints, or perhaps has worn gloves. Bob takes his laptop home a…

I think you're confusing "reasonable doubt" with "any doubt at all." Postulating malicious data-encrypting malfeasance is not reasonable doubt, it's conspiracy theory.

Incidentally, Wikiedia claims (emphasis mine):

>One of the earliest attempts to quantify reasonable doubt was a 1971 article by Rita Simon and Linda Mahan, "Quantifying Burdens of Proof: A View from the Bench, the Jury, and the Classroom." In a later analysis of the question ("Distributions of Interest for Quantifying Reasonable Doubt and Their Applications," 2006[10]) , three students at Valparaiso University presented a trial to groups of students. Half of the students decided the guilt or innocence of the defendant. The other half recorded their perceived likelihood, given as a percentage, that the defendant committed the crime. They then matched the highest likelihoods of guilt with the guilty verdicts and the lowest likelihoods of guilt with the innocent verdicts. From this, the researchers gauged that the cutoff for reasonable doubt fell somewhere between the highest likelihood of guilt matched to an innocent verdict and the lowest likelihood of guilt matched to a guilty verdict. From these samples, they concluded that the standard was between 0.70 and 0.74.

Re: Man jailed over computer password refusal

#195

Post by stretchwithme » Wed, Oct 06, 2010, 5:44 AM UTC

SwellJoe wrote: post #192

stretchwithme wrote: post #74

Earlier quoted context omitted.

just tell 'em you forgot it

Lying under oath is a criminal offense. Proving you're lying may be tricky, but if it were to somehow become obvious you were lying, you'd then have to answer for that offense as well as whatever other charges you were dealing with before. This is really common advice, but I'm not sure it's the best option.

it was tongue in cheek. of course you don't have the right to lie to protect yourself from a legitimate investigation where probable cause already exists.

Re: Man jailed over computer password refusal

#196

Post by limmeau » Wed, Oct 06, 2010, 6:33 AM UTC

16s wrote: post #162

16s wrote: post #160

Earlier quoted context omitted.

tom@ubuntu:~$ gpg -c flag.png tom@ubuntu:~$ gpg -v --list-packets flag.png.gpg :symkey enc packet: version 4, cipher 3, s2k 3, hash 2 salt eae60ad4255dc4e2, count 65536 (96) gpg: CAST5 encrypted data OpenPGP encrypted data is easy to find too. It even tells you the algo used. The example is symmetrically encrypted, but it works the same with asymmetric keys. Even shows who it is encrypted for. Edit: formatting.

Here's what the gpg data looks like when using someone's public key to encrypt a file... now we know who to go hit over the head with a hammer ;) tom@ubuntu:~$ gpg -v --list-packets file.gpg :pubkey enc packet: version 3, algo 16, keyid 63E6E0BBB9FEE3A5 data: [2045 bits] data: [2047 bits] gpg: public key is B9FEE3A5 gpg: using subkey B9FEE3A5 instead of primary key 7A997B0A

With option --throw-keyids, you'd have to try your hammer on several heads until one fits.

Re: Man jailed over computer password refusal

#197

Post by rwmj » Wed, Oct 06, 2010, 7:01 AM UTC

Not the first one: http://www.theregister.co.uk/2009/11/24/ripa_jfl/

Re: Man jailed over computer password refusal

#198

Post by billswift » Wed, Oct 06, 2010, 7:05 AM UTC

jeromec wrote: post #164

lmkg wrote: post #157

Earlier quoted context omitted.

> The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. This is a really subtle point, but in the US this is not (usually) the case, because this is still self-incrimination. You see, by entering the password, you are demonstrating that you have access to the encrypted information, and…

This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick? Considering that the record for number of decimal places memorized for Pi appears to be 67,890 I'd argue memorizing a 128-character random sequence would be both possible and most secure. ;)

Entering it at a keyboard without mistake would probably be a lot harder.

Re: Man jailed over computer password refusal

#199

Post by InclinedPlane » Wed, Oct 06, 2010, 7:08 AM UTC

edanm wrote: post #87

ryanwaggoner wrote: post #6

Earlier quoted context omitted.

Ah well...at least I thought of something worth doing :)

More people should learn from this attitude. This is what I say every time I have an idea, and I later found out someone already built a startup around it (happens quite a lot, since I spend half my waking time thinking of startups).

Indeed. It means you possibly have a head for good ideas. You should be far, far more worried if nobody else has beaten you to the punch on any of your ideas, because that would tend to indicate that your ideas are either impractical or of low quality.

Re: Man jailed over computer password refusal

#200

Post by billswift » Wed, Oct 06, 2010, 7:12 AM UTC

lkjuhygthyujk wrote: post #136

MrRage wrote: post #127

Earlier quoted context omitted.

> Since this was before 911 - the 'terrorists' in question were presumably the IRA, not sure they had much of an online presence back then. You do know that 9/11 was not the first terrorist attack on the US by Islamic extremists, do you?

Yes, but I'm assuming the UK didn't draft a law in the mid 90s to prevent Islamic attacks on the US. The fact that their plans would be written in a foreign language (never mind a foreign alphabet) would have been more than adequate to keep it secret from British intelligence. ps. You do know that we have been having terrorist attacks for almost a century.

>The fact that their plans would be written in a foreign language (never mind a foreign alphabet) would have been more than adequate to keep it secret from British intelligence.

This is one of the stupidest statements I have ever seen.