Isn't this one of the things TPMs are designed to defend you against? The TPM only releases the encryption key after the right password is entered, some number of wrong passwords cause a reset, and perhaps a single duress code instantly causes a reset? Once the TPM is erased, who's to tell if it wasn't just broken to begin with.
Judge: Americans can be forced to decrypt their laptops
51–60 of 190 posts
Re: Judge: Americans can be forced to decrypt their laptops
#52A bit torn on the issue and don't have a strong opinion either way. I slightly lean towards they shouldn't have to hand over the password, but I really thing courts should try to be flexible (is that even possible?) and go case by case.
Will be looking towards hearing more opinion on the issue.
Re: Judge: Americans can be forced to decrypt their laptops
#53This is an interesting case. From a civil liberties, card-carrying ACLU member standpoint, I'm all for the "anti" side of this - keep the gov't out. On the other hand, there's a decent case made that establishing this kind of precedent would basically mean that if criminals are smart enough to use PGP, then that data can never be used against them. Since you can be compelled to turn over a physical key via due proces…
My understanding of existing case law regarding safes is that you can be compelled to give up a key, as it is just physical property to which the state has right to request, but can not be compelled to give a combination, as that is just memory and would violate the fifth amendment. Just because cryptographers use the term "key" doesn't mean the should be treated as real keys. It seems obvious that a key/paraphrase is perfectly analogous to a safe combination.
Re: Judge: Americans can be forced to decrypt their laptops
#54This should be cause for serious concern. There's often no way to prove that someone knows a key or pass-phrase. If a personal computer I've used for years has TrueCrypt at boot, perhaps a reasonable argument[1] could be made that I know the password. That's not true of a flash drive or an encrypted file on a shared computer.
If someone plants a safe in my house, I may be held in contempt for a while while it's drilled open. Properly encrypted data might withstand attacks for a lifetime or more.
[1] Best I can tell, it's possible for me to TrueCrypt encrypt your computer with only physical access. You wouldn't notice until next boot.
Re: Judge: Americans can be forced to decrypt their laptops
#55A stupid idea: what if we passed a law making, say, knowing an encryption key illegal, with a $0.01 penalty per year? Then asking you for your encryption key would be asking you to provide self-incriminating testimony.
You don't need to do that - there's a decent argument to be made that forcing you to decrypt a drive is already forcing you to testify against yourself, in violation of the 5th Amendment.
Re: Judge: Americans can be forced to decrypt their laptops
#56This should be cause for serious concern. There's often no way to prove that someone knows a key or pass-phrase. If a personal computer I've used for years has TrueCrypt at boot, perhaps a reasonable argument[1] could be made that I know the password. That's not true of a flash drive or an encrypted file on a shared computer. If someone plants a safe in my house, I may be held in contempt for a while while it's drill…
>This should be cause for serious concern.
Just like using an IP address as identification of a person.
Re: Judge: Americans can be forced to decrypt their laptops
#57Personally I think this is reasonable, provided that requests for decryption keys are handled with the same level of respect for law & privacy afforded to physical keys.
There is a thornier issue though: stenanography + encryption. What if the encrypted data aren't visible in the first place? Or, what if the data aren't provably encrypted data?
I can imagine a case where someone languishes in jail for contempt of court, after being ordered to produce something that doesn't actually exist.
Re: Judge: Americans can be forced to decrypt their laptops
#58You can be compelled to produce a physical key to a safe. However what if the contents of the safe are paper with text written in an invented language, known only to you?
Can you be compelled to translate them for the court?
What if they just contained numbers? Could you be forced to explain what the numbers mean?
I would conclude that such an action would violate the 5th ammendment.
Forcing her to decrypt the hard drive is the same thing.
Given a warrant, the police have the right to search her hard drive. If they can't understand what it says, she should not have to explain it to them.
Right now, they have no evidence. She is being compelled to produce evidence against her self.
Providing a physical key produces no evidence. It produces a key.
Providing a decrypted version of the data on the laptop is producing information. The contents of the laptop are such that they exhibit a high level of entropy. By definition, they are not information. If they did contain information, they would by definition not be encrypted.
Thus, the request is for the defendant in a criminal trial to replace something that is not information with something that is information. That is clearly a violation of the 5th ammendment.
Re: Judge: Americans can be forced to decrypt their laptops
#59Earlier quoted context omitted.
TrueCrypt supports Hidden OS partitions much like its normal hidden containers and it asks for these passwords at boot. You could enter one password and have it boot into a boring Windows XP environment while the true password would boot to your actual environment with all your secret files.
There's the file time problem, though. Okay, let's say you're Joe Randomguy and you keep two XP partitions. One that you actively use and might have all manner of contraband on it, and another "boring" one for showing any would-be snoopers. It's Jan 2012. What do you think is going to happen when they see that the one you gave up the code to hasn't been touched since July 2011? Does Truecrypt have an option to not re…
Truecrypt does have an option to disable file time updates on file volumes. Also for ext at least, you can mount with nomtime, noatime, noctime and completely disable file times.
Re: Judge: Americans can be forced to decrypt their laptops
#60I wonder about this: What if the key to the encryption is written on a dozen seemingly random notes on yellow sticky notes in your office full of yellow sticky notes? Or, it is composed of the last letter on each page of a series of innocuous looking documents, such that the government might seize the documents but naturally in the process of doing so, scramble the documents order rendering the password irretrievable. Or its some combination of words from a book, or some other innocuous piece of material that they'd simply ignore and that would be thrown out after they left. The one FBI raid I'm directly familiar with involved them seizing the computers and even the phones, but not the desks or the phone books, etc.
In this case the passphrase existed in the location where the laptop was seized but in the intervening months, or in the act of seizing it, the phrase was destroyed. Thus it is the responsibility of the cops who seized it that the passphrase is no longer retrievable, and thus it is the government's fault the data is impossible to decrypt.
I'm sure there's an even better way to accomplish something similar that I'm not thinking of, where the phrase is kept handy, but only obvious to you so that you know how to derive it, but the simple act of serving a search warrant will eliminate the phrase by rearranging the key elements.
Then in court you can testify honestly to exactly how you looked up the phrase, but the government would have no way to recreate it.