Man jailed over computer password refusal • Hacker News Board

Re: Man jailed over computer password refusal

#201

Post by nandemo » Wed, Oct 06, 2010, 7:25 AM UTC

rdtsc wrote: post #39

camiller wrote: post #18

Earlier quoted context omitted.

nah, the police can't torture you for your password. Only the evil criminals can do that. The courts can incarcerate you for not revealing a password, it's is up to you the criminal to decide if the punishment for not revealing the password is more/less severe than the punishment for whatever crime your hiding the evidence of with the password. Edit: OK now I have found evidence to prove myself wrong. At some point i…

> Only the evil criminals can do that. Depending on the country, the symmetric set difference between the police and "evil criminals" is quite small. And even then when the police can't torture your officially, they can have ways of torturing you un-officially. They can lock you up with a group of gang members who are on the un-official "payroll" of the police. They rape and torture you until you reveal the password.…

It's even easier than that. You don't need actual torture to extract confessions:

Pressed by Police, Even Innocent Confess in Japan

http://www.nytimes.com/2007/05/11/world/asia/11japan.html

Also:

Japan is unique among democratic countries in that confessions are obtained from 95% of all people arrested, and that its courts convict 99.9% of all the suspects brought before them. (...) It is how the police obtain these confessions that troubles human-rights activists. A suspect can be held for 48 hours without legal counsel or contact with the outside world. After that, he or she is turned over to the public prosecutor for another 24 hours of grilling. A judge can then grant a further ten days of detention, which can be renewed for another ten days.

http://www.debito.org/?p=217

Re: Man jailed over computer password refusal

#202

Post by ErrantX » Wed, Oct 06, 2010, 7:32 AM UTC

jeromec wrote: post #118

jessriedel wrote: post #101

Earlier quoted context omitted.

In the US, the prosecution is going to have to prove beyond a reasonable doubt that there is, in fact, encrypted information and that the suspect knows the key. Yes, there are going to be gray areas. But if Bob has one computer in his house with his and only his finger prints all over it, wear that indicates that the computer has been used extensively, and the computer hard drive is filled with an encryption scheme w…

To establish reasonable doubt all the defense has to do is come up with some alternative way all of your facts can be true without Bob having the key. I can think of two from the top of my head. 1. Bob has mischievous friends, or worse, enemies at school. He leaves his laptop unattended/exposed where someone installs the encryption then wipes their fingerprints, or perhaps has worn gloves. Bob takes his laptop home a…

Doesn't work; it's an age old argument ("wasn't me guv, was my mate wearing my clothes") and it will be struck from the record if you claim it with no evidence.

Remember; reasonable doubt is not just the production of an alternate theory, it requires legitimate evidence to verify.

Both the example theories you cite would usually be easy to disprove as well. The first because you could look at various aspects of activity on the computer either side of the creation of the encrypted file and show that it resembles their usual activity (for example, there are numerous other ways to do it).

Now, this is where it gets clunky. I'm speculating here, but from direct experience so... take it with caution.

If you're under investigation for something and refuse to hand over a password then you're unlikely to automatically go to jail over it. The case that probably exists is that there is evidence to support the accusation, but no actual images/material. The latter is needed for a prosecution to succeed. I've never seen a case that looks like a blank go as far as demanding encryption keys - unless you are insanely careful there will always be traces left outside the encrpted file.

(BTW, Pro Tip - if you want to be secure from investigation, scrap windows (it logs way too much) and switch to Linux. Much of the forensics stuff is Windows focused so you instantly throw the [get the right file system and the main forensic tools won't even recognise it...]. Couple that with encrypted containers and you're on to a winner)

Re: Man jailed over computer password refusal

#203

Post by jacquesm » Wed, Oct 06, 2010, 7:40 AM UTC

xentronium wrote: post #139

jacquesm wrote: post #91

Earlier quoted context omitted.

This is about the UK, not about some banana republic.

Ha-ha, oh, wow. http://en.wikipedia.org/wiki/Uses_of_torture_in_recent_times... http://en.wikipedia.org/wiki/Torture_and_the_United_States

I hope you weren't seriously trying to conflate the Northern Irish situation (which was more like a civil war or a war for independence) and the US military with the UK police.

That doesn't make either of those right, there is no mistake about that, but the UK police is amongst the most professional forces in the world. Not quite the RCMP but to suggest that they'd torture inmates to get a password is simply nonsense.

Re: Man jailed over computer password refusal

#204

Post by abalashov » Wed, Oct 06, 2010, 7:46 AM UTC

billswift wrote: post #198

jeromec wrote: post #164

Earlier quoted context omitted.

This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick? Considering that the record for number of decimal places memorized for Pi appears to be 67,890 I'd argue memorizing a 128-character random sequence would be both possible and most secure. ;)

Entering it at a keyboard without mistake would probably be a lot harder.

And if nothing else, utterly tedious.

Re: Man jailed over computer password refusal

#205

Post by abalashov » Wed, Oct 06, 2010, 7:48 AM UTC

I am not sure I understand the basis on which this person was jailed. If the court order to search his computer was provided on the basis of probable cause, what was that probable cause? If law enforcement already had evidence of some kind of misdeed, why do they need access to his computer? If the evidence of his misdeeds is on the computer, wouldn't providing it be a) self-incrimination of some description, as mentioned extensively elsewhere here and b) law enforcement's inability to get access to the information get the case dismissed due to lack of evidence?

Re: Man jailed over computer password refusal

#206

Post by tomjen3 » Wed, Oct 06, 2010, 7:54 AM UTC

SwellJoe wrote: post #192

stretchwithme wrote: post #74

Earlier quoted context omitted.

just tell 'em you forgot it

Lying under oath is a criminal offense. Proving you're lying may be tricky, but if it were to somehow become obvious you were lying, you'd then have to answer for that offense as well as whatever other charges you were dealing with before. This is really common advice, but I'm not sure it's the best option.

Sure it may be criminal, but honestly if they can't prove it - what possible harm could come from it?

Re: Man jailed over computer password refusal

#207

Post by tomjen3 » Wed, Oct 06, 2010, 7:58 AM UTC

boredguy8 wrote: post #45

NathanKP wrote: post #32

It seems like a bad idea to store anything incriminating on your local hard drive. Why not keep your encrypted files on a flash drive? If the police show up destroy the flash drive using a hammer, ensuring that the flash memory chip is thoroughly pulverized and completely unreadable. Likewise, if you are going to be using the internet for devious purposes drive around and use a neighbor's open wireless network access…

Intentionally destroying incriminating evidence is probably not something you should ever do. Certainly not in such a way that leaves evidence in the form of pulverized IC remains all over your kitchen counter.

Under danish law, it is not illegal to destroy evidence of your own or your loved ones wrong doing.

Re: Man jailed over computer password refusal

#208

Post by Deestan » Wed, Oct 06, 2010, 8:34 AM UTC

mattm wrote: post #126

A friend of mine flew back home to Canada. After clearing customs, he was one of the random people chosen to have their luggage inspected. He had his laptop on him and the customs agent booted up the computer, asked him to enter his password and then took his laptop away before bringing it back without telling him anything about it. I wondered what would have happened if he refused to type in the password.

Customs aren't law enforcement, they just like to think so.

The request to enter a password should be treated as a impolite request, which you should politely deny.

Re: Man jailed over computer password refusal

#209

Post by praptak » Wed, Oct 06, 2010, 8:48 AM UTC

billswift wrote: post #198

jeromec wrote: post #164

Earlier quoted context omitted.

This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick? Considering that the record for number of decimal places memorized for Pi appears to be 67,890 I'd argue memorizing a 128-character random sequence would be both possible and most secure. ;)

Entering it at a keyboard without mistake would probably be a lot harder.

For symmetric ciphers, 128 bits, not characters is considered secure. Assuming the uuencode character set [A-Za-z0-9+/] it's 6 bit per character, so 22 chars only. Quite doable.

Re: Man jailed over computer password refusal

#210

Post by philwelch » Wed, Oct 06, 2010, 8:54 AM UTC

boredguy8 wrote: post #45

NathanKP wrote: post #32

It seems like a bad idea to store anything incriminating on your local hard drive. Why not keep your encrypted files on a flash drive? If the police show up destroy the flash drive using a hammer, ensuring that the flash memory chip is thoroughly pulverized and completely unreadable. Likewise, if you are going to be using the internet for devious purposes drive around and use a neighbor's open wireless network access…

Intentionally destroying incriminating evidence is probably not something you should ever do. Certainly not in such a way that leaves evidence in the form of pulverized IC remains all over your kitchen counter.

Maybe you just put your private data on flash drives and smash it to bits with a hammer for your own personal privacy, or to get rid of pictures of an ex-girlfriend. There's no way of knowing.