Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Court rules that people can't be locked up indefinitely for refusing to decrypt

techdirt.com

Post reply on HN
Print view View original

111–120 of 180 posts

Re: Court rules that people can't be locked up indefinitely for refusing to decrypt

#111

Post by sjy »

gamblor956 wrote: post #19
solveit wrote: post #15

Earlier quoted context omitted.

"I encrypted the device but don't have the key" isn't a defense to being compelled to decrypt the device?

No, they can hold you in contempt for up to 18 months in federal court, or indefinitely in many state courts. OTOH, if you were to argue that it's not your device, or that you weren't the person that encrypted it, that's a very different situation.

This is incorrect. You can’t be held in contempt for failing to comply with an order you can’t comply with, for example due to a loss of memory. In this case the court did not believe that the defendant had forgotten the key.

Re: Court rules that people can't be locked up indefinitely for refusing to decrypt

#112

Post by sjy »

function_seven wrote: post #26
nordsieck wrote: post #18

Earlier quoted context omitted.

> "I encrypted the device but don't have the key" isn't a defense to being compelled to decrypt the device? Try to think about it from the court's point of view. The truth could be: A. You legitimately forgot. B. You're lying. I know which one Occam's Razor favors.

The whole point of a justice system is that Occam and his Razor are a terrible way of determining guilt. Yeah, I'd bet that most people claiming to have forgotten a key or password are lying. But so what? How do you differentiate those who're concealing vs. those that legitimately don't know the string of characters? If they float, they're a witch, if they sink, then I guess they're not? (That's what 18 months for co…

You differentiate them using circumstantial evidence. Was the encrypted disk found under a pile of dust in the attic? Then to forget the password is quite believable. Is there independent, convincing evidence that you regularly and recently used the password? Then you’re probably lying. Or maybe you’re just really unlucky. Wrongful convictions do happen.

Re: Court rules that people can't be locked up indefinitely for refusing to decrypt

#113

Post by sjy »

tantalor wrote: post #80
supernova87a wrote: post #60

The problem with this new territory is exactly the unsettled issue of whether providing a password is testimonial and protected. The protection against self-incrimination is/was a protection against being put on trial and being forced to say or give testimony that you took part in or committed a crime. It is not a protection against any and all evidence from being produced against you. In a previous age, not saying w…

It's not a modern problem. You could always rig a tamper-proof device (eg booby trap) to destroy evidence if forced without the key.

That’s quite a different problem, because if the booby trap goes off, the person who set it can’t be compelled to un-destroy the evidence.

Re: Court rules that people can't be locked up indefinitely for refusing to decrypt

#114

Post by sjy »

nwallin wrote: post #92

The idea of being locked up for not handing over a password terrifies me. I was deployed a few years ago and living in the conexes. I was bored and decided to go all out on encrypting everything. I picked a completely random 16 character password (I piped the output from /Dev/urandom through some tr command that only allowed typeable characters through) and committed it to muscle memory. I used this laptop every day…

It is not a crime if, as a matter of fact, you forgot the password. As always, it’s up to the court to decide that fact after looking at the evidence.

Re: Court rules that people can't be locked up indefinitely for refusing to decrypt

#115

Post by akersten »

supernova87a wrote: post #60

The problem with this new territory is exactly the unsettled issue of whether providing a password is testimonial and protected. The protection against self-incrimination is/was a protection against being put on trial and being forced to say or give testimony that you took part in or committed a crime. It is not a protection against any and all evidence from being produced against you. In a previous age, not saying w…

> The problem with this new territory is exactly the unsettled issue of whether providing a password is testimonial and protected.

I can see no possible correct answer than "yes, absolutely, it is testimonial."

If I may take some minor artistic liberty and change the words without changing the scenario:

Consider a person on trial for murder, and the prosecution believes they wrote down where the body is buried on a piece of paper. The paper's got blood on it and was found next to a hatchet and duct tape. Gee shucks though, it's written in an ancient dialect of Silbo Gomero and they're the last person alive who speaks it. The prosecution would really love to have that evidence for their case. Can they make the defendant translate it for them?

Absolutely not, right? That's clear-as-day 5th amendment, if-I-translate-this-for-you-I'm-incriminating-myself territory.

It is the exact same concept with encryption. There is a piece of information unintelligible to an adversary (prosecutor), that the adversary believes (due to surrounding known evidence) would further their case. The only way to transform the information into something useful for the prosecutor is with the help of the defendant, using knowledge that exists only in the defendant's mind (password).

Asking the defendant to create the evidence against themselves (evidence that does not exist until the defendant creates it, mind you - not something like the contents of a safe where the physical evidence exists whether the defendant wills it or not) is a 100% textbook 5th amendment violation.

I really feel that if someone sees this any other way, they fundamentally misunderstand how encryption works. The documents the prosecution wants do not exist unless the defendant (re)creates them, and you can't ask someone to create evidence (testimony) against themselves (5th amendment, again).

Re: Court rules that people can't be locked up indefinitely for refusing to decrypt

#116

Post by sjy »

pbecotte wrote: post #73
gamblor956 wrote: post #21

Earlier quoted context omitted.

(1) is not obviously true. Even judges known to favor defendant's rights can't agree whether this would constitute a testimonial act. Claiming otherwise suggests that you don't understand how the law works, how the technology works, or both. (2) is not obviously false, because you're conflating two separate things: the encryption key and the contents of the encrypted device. Using the analogy of a locked safe: a pict…

I dunno what the law says. However, it is very easy to imagine a situation where someone LEGITIMATELY cannot decrypt the device. Is indefinite detention without even a criminal charge a valid punishment for that? We can make analogies all day "is it testimony? Is it like the code to a safe?"... But there is a real concrete fact that the government wants to be able to imprison someone indefinitely, without a jury tria…

> the government wants to be able to imprison someone indefinitely, without a jury trial, for claiming not to know something when there is certainly a reasonable doubt about them knowing it.

This is incorrect. The judge could not have found Rawls in contempt if the judge was not satisfied that he intentionally failed to comply with the password disclosure order.

Re: Court rules that people can't be locked up indefinitely for refusing to decrypt

#117

Post by cryptonector »

baddox wrote: post #46
SpicyLemonZest wrote: post #29

Earlier quoted context omitted.

They can't require you to personally admit to it, but if they know about a notebook where you wrote it they can require you to give up the notebook. (The rule makes more sense if you think about it in terms of financial crimes; it'd be hard to ever prosecute someone for fraud if they didn't have to give up their books.)

> it'd be hard to ever prosecute someone for fraud if they didn't have to give up their books. I'm pretty sure it's relatively simple for police to break into offices and take financial records. I would imagine it happens relatively often, because simply asking a suspect to give up their books seems more likely to result in them attempting to hide or destroy their books. The reason police and prosecutors don't like e…

It's called rubber hose cryptanalysis for a reason. Holding you in prison at all (let alone indefinitely) requires violence. Violence is applied to get the defendant to reveal their decryption keys.

Re: Court rules that people can't be locked up indefinitely for refusing to decrypt

#118

Post by manfredo »

sjy wrote: post #105
manfredo wrote: post #83

Earlier quoted context omitted.

> The rule makes more sense if you think about it in terms of financial crimes; it'd be hard to ever prosecute someone for fraud if they didn't have to give up their books. I don't think these two situations are the same. When you run a business there are legal requirements to retain data, and provide that data when audited. The police telling you to tell them were you placed a notebook doesn't seem like an equivalen…

> And how can the police prove you wrong if you say you forgot where you placed it? By producing other evidence that suggests that you’re lying (eg. metadata or witnesses suggesting that you recently entered the correct password). In this case the judge had to reject Rawls’ claim of lost memory in order to find him in contempt. Maybe the judge’s finding of fact was wrong, but that’s not what the case is about now.

> By producing other evidence that suggests that you’re lying (eg. metadata or witnesses suggesting that you recently entered the correct password).

People have forgotten passwords in a matter of minutes in some cases. Not to mention, this guy has been held in prison for 4 years. Plenty of time to forget a password. Forget the password to an encrypted drive is a life sentence?

Re: Court rules that people can't be locked up indefinitely for refusing to decrypt

#119

Post by manfredo »

xeromal wrote: post #104
manfredo wrote: post #83

Earlier quoted context omitted.

> The rule makes more sense if you think about it in terms of financial crimes; it'd be hard to ever prosecute someone for fraud if they didn't have to give up their books. I don't think these two situations are the same. When you run a business there are legal requirements to retain data, and provide that data when audited. The police telling you to tell them were you placed a notebook doesn't seem like an equivalen…

What if you don't give up your books that you're legally required to keep? What happens? How did they get them?

My point is a company handing over books is not the same situation as the police commanding you to tell them where you put a journal. A company's financial records are something they are specifically required to keep and provide by law. If they don't have their books in their possession then they're in violation of the law. The government doesn't even need any suspicion, any company can be audited.

Re: Court rules that people can't be locked up indefinitely for refusing to decrypt

#120

Post by phkahler »

thaumasiotes wrote: post #20
ereyes01 wrote: post #7

> The Fifth Amendment gives witnesses a right not to testify against themselves. Rawls argued that producing a password for the hard drives would amount to an admission that he owned the hard drives. But the 3rd Circuit rejected that argument. It held that the government already had ample evidence that Rawls owned the hard drives and knew the passwords required to decrypt them. So ordering Rawls to decrypt the drives…

> Rawls argued that producing a password for the hard drives would amount to an admission that he owned the hard drives. But the 3rd Circuit rejected that argument. It held that the government already had ample evidence that Rawls owned the hard drives and knew the passwords required to decrypt them. So ordering Rawls to decrypt the drives wouldn't give the government any information it didn't already have. Of course…

It's more like they can make you open a safe. It's too bad for you if you kept someone's head in that safe.
Post reply on HN