Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ: We can force you to decrypt that laptop

news.cnet.com

Post reply on HN
Print view View original

31–40 of 128 posts

Re: DOJ: We can force you to decrypt that laptop

#31

Post by pielud »

djackson wrote: post #15
pielud wrote: post #10

Earlier quoted context omitted.

These protections extend to everyone, no matter how despicable. In order for good people to be free, some bad guys might also get away. Such is the price of a free society.

Do you think the government should have subpoena power in order to collect evidence? Do you think they should be able to search a murderer's home for the weapon? I'm not saying they should have this power without a warrant, but nobody has the protection from a _reasonable_ search.

Do you think the government should have subpoena power in order to collect evidence? Do you think they should be able to search a murderer's home for the weapon?

Of course they should. But that's no the issue here. The issue at hand is whether or not the government can compel you to give them information.

Consider this. You have a box, buried in the Mojave desert, with some documents in it. You've memorized the gps coordinates of this box. Should they be able to compel you state those coordinates?

Sure, they could search 100s of square miles looking for your box, and they might stumble upon it. But they shouldn't be able to force your to tell them where it is.

An encryption key is the same. They can try to brute force it if they wish. They're just looking for a much smaller box in a much bigger desert.

Re: DOJ: We can force you to decrypt that laptop

#32

Post by losethos »

God says...

childbearing violets kept Fear hearsay consumption confuted exceedeth depend blowing restlessly troublesome god entangle stated occupying adding next plain disciple custom unhesitatingly valley empire University remission prosperity winked withdrawn fresh redeemed God's falls sex attracts

Re: DOJ: We can force you to decrypt that laptop

#33

Post by 16s »

shareme wrote: post #21

What we are actually seeing is how far behind the DOJ and FBI are behind in having competent computer forensics professionals as part of their human resources.. We saw the same thing with the Patriot Act..do not have proper staff? than by God make sure that the US constitution suddenly does not apply if traveling outside the US..

They have plenty of competent computer forensics guys and equipment. But even with all of that, proper encryption with a strong passphrase is infeasible to attack. Forcing the key holder to disclose the key is the easy, inexpensive first step.

Re: DOJ: We can force you to decrypt that laptop

#34

Post by jarin »

Shenglong wrote: post #30

Prosecutors stressed that they don't actually require the passphrase itself, meaning Fricosu would be permitted to type it in and unlock the files without anyone looking over her shoulder. I wonder if anyone has thought of using more than one keys as a decryption possibility. I've always considered it, but never figured there'd be too much use. Say, have one correct key to decrypts data stored in one way, and another…

Truecrypt has supported that kind of plausible deniability for a while.

Re: DOJ: We can force you to decrypt that laptop

#35

Post by gospelwut »

roc wrote: post #5

The truly interesting bit, will be when a case of (real or alleged) multiple hidden encrypted volumes is publicized. If the government feels the information they want is on a laptop, the laptop's owner would suddenly find themselves forced to prove a negative (there are no more hidden volumes), lest they be held in contempt. If they can seemingly compel you to reveal something they can't proven even exists and lock y…

For her sake, she has a hidden & real TC volumes -- i.e. she has both a real and fake TC OS volume. I don't know of any other encryption methods that allow hiding a volume within another volume as such. Even so, if I boot up your fake volume and it's pretty apparent it hasn't been used in 8-months or simply has a blank My Docs folder, I don't know how that will go.

I suppose somebody could make the argument that all that unused space is slack or something like that ("Oh yeah I only use 20GB/200GB HDD). Though, as people have said, this is pretty new territory.

Perhaps I misread the article, but I didn't see a mention of whether this involved hidden TC volumes or not.

EDIT: Clarity.

Re: DOJ: We can force you to decrypt that laptop

#36

Post by chrisjsmith »

lotharbot wrote: post #8
chrisjsmith wrote: post #3

Does it matter? Governments are bullies. http://www.vvsss.com/grid/xkcd-on-crypto.gif Here in the UK, we already have to hand over our keys or be chucked in jail.

Is there any reason you linked to a third-party site instead of xkcd itself? http://xkcd.com/538/ (easily googled -- xkcd crypto, first hit.)

Oh pedant, I thoroughly apologise for my ignorance. May my vegetables all die, my breath smell for eternity and my armpits flood with hair and engulf the earth.

Re: DOJ: We can force you to decrypt that laptop

#37

Post by andrewcooke »

djackson wrote: post #20
andrewcooke wrote: post #14

Earlier quoted context omitted.

rights are rights because they allow you to do what would otherwise be illegal. for example, there's no need for a right to free speech if you're only going to say things that everyone thinks should be said. rights exist because some things are so important they are worth the cost of abuse. At first blush it may be thought surprising that one should have a right to do that which one ought not. Is it not better to con…

Nobody has the right to avoid a reasonable search in the United States. You are protected by the fourth amendment from unreasonable searches, but you aren't going to convince me that a detective has no right, with a warrant in hand, to search a suspect's home for a murder weapon. Similarly, you aren't going to convince me that a prosecutor, warrant in hand, has no right to search a computer for evidence of credit car…

all i'm saying is that you can't say a right cannot exist because it lets bad things happen.

in this case, there may be a right to silence. i don't know (i am not american) if that "really is" a right. but if it is a right then it exists even if it allows, say, a paedophile to escape justice (through remaining silent). it's not nice, but it's the price you pay to help guarantee freedom.

[edit: it's perhaps worth adding that you could make rights more complicated. you could say that there is (or should be) a "right to silence except when it's a password", for example. there's no prima facie reason why rights should be simple. but there is a strong practical reason why rights should be simple: they need to be simple so that they are easy to understand, easy to defend, and easy to use. again, this is because rights - real rights - are critical, might-be-needed-to-save-the-world things. and that is also why there should only be a few of them.]

Re: DOJ: We can force you to decrypt that laptop

#38

Post by anonymous246 »

djackson wrote: post #20
andrewcooke wrote: post #14

Earlier quoted context omitted.

rights are rights because they allow you to do what would otherwise be illegal. for example, there's no need for a right to free speech if you're only going to say things that everyone thinks should be said. rights exist because some things are so important they are worth the cost of abuse. At first blush it may be thought surprising that one should have a right to do that which one ought not. Is it not better to con…

Nobody has the right to avoid a reasonable search in the United States. You are protected by the fourth amendment from unreasonable searches, but you aren't going to convince me that a detective has no right, with a warrant in hand, to search a suspect's home for a murder weapon. Similarly, you aren't going to convince me that a prosecutor, warrant in hand, has no right to search a computer for evidence of credit car…

I think you're missing the conflict between allowing reasonable search and the right against self-incrimination when the thing being searched is an encrypted laptop.

At least agree that there is a conflict here; otherwise you're just being dense.

AFAIK the govt. cannot compel (legally) anybody to reveal the combination to a ticking time-bomb; or the location of a murder weapon etc. How the hell is asking for a passphrase any different? Do you really not understand the nuance here?

The other point is that AFAIK the govt. has never asserted the right to compel a handwritten note to be deciphered. The govt. doesn't assert the right to systematically read people's mail (even postcards); but they do so wrt electronic comms. I think we can safely state that almost all comm. is going to be electronic in the future. That's why this is important. This is yet another example of the govt. trying to trim back rights that the hoi polloi have enjoyed for a couple of centuries.

As to why this is important: you might have read the quote that six lines by any man's hand are enough to hang him.

Sorry, I meandered a little there.

Re: DOJ: We can force you to decrypt that laptop

#39

Post by roc »

kenjackson wrote: post #18
roc wrote: post #5

The truly interesting bit, will be when a case of (real or alleged) multiple hidden encrypted volumes is publicized. If the government feels the information they want is on a laptop, the laptop's owner would suddenly find themselves forced to prove a negative (there are no more hidden volumes), lest they be held in contempt. If they can seemingly compel you to reveal something they can't proven even exists and lock y…

If the government feels the information they want is on a laptop, the laptop's owner would suddenly find themselves forced to prove a negative (there are no more hidden volumes), lest they be held in contempt. I think it will still be a requirement for the gov't to show that there's cause. In the same way that the gov't can't hold you if they suspect you know where a kidnapped victim is held, unless they have evidenc…

Suppose someone uses my wifi connection to hack into, say, a Sony server and retrieve a database of credit card information.

The government would have evidence and reason to believe I have that data. So, naturally, they'll get to seize my laptop and apparently can compel me to unlock it and allow them arbitrary access.

It seems to me that they don't know the stolen data resides on that laptop any more than they know whether I have a hidden volume that contains the data they're searching for. So if their evidence is good enough to compel me to produce a password, why would it not be good enough to insist a hidden volume contains the data and that I'm withholding the sought-after data?

If someone can simply say "nope, no hidden volumes here" and that's the end of it, it would be trivial to defeat a digital investigation.

In short, I'm skeptical about what defines the reasonableness of an investigation and this apparent power to compel arbitrary access to documents.

Re: DOJ: We can force you to decrypt that laptop

#40

Post by bhousel »

naner wrote: post #24
bhousel wrote: post #19

Earlier quoted context omitted.

An obstruction of justice charge, probably. Here's a pretty decent page about the charge: http://www.federalcriminallawyer.us/2011/01/12/federal-law-o... tl;dr: "18 USC 1503 is a felony offense for which the sentence can be 10 years imprisonment."

That seems to be imply that she is lying, though. What if she actually doesn't know the password? For example if it isn't her laptop or the password was written down and lost or it is an old encrypted volume which she doesn't use anymore, etc.

Federal investigators and prosecutors aren't dumb. For all of those scenarios that you mentioned, it would be easy to tell whether or not this was a laptop that she used frequently.

Where did she get it from? (or from whom? - she should be able to say.) In what condition was the laptop found, on her desk? opened? screen saver on? or powered down? in a pile, covered in dust? any fingerprints or other signs of use? Any removable media present? They can look in her office for passwords written down. They can check her mobile devices for password managers and compel her to unlock those.

Understand for the case to even proceed to indictment (which happened last year), they have done all of this work to make sure that their case is pretty solid. There are pretrial hearings, and depositions and other things which lawyers do to answer all these questions about whether they can prove that she really should be able to provide the password.

Post reply on HN