Teenager jailed for refusing to hand over computer password • Hacker News Board

Re: Teenager jailed for refusing to hand over computer password

#51

Post by dotBen » Wed, Oct 27, 2010, 8:53 PM UTC

A few random thoughts:

1) While it is true to say you are protected under First and Fifth Amendment rights from having to disclose a password here in the US, it doesn't cover border inspections (including airport custom/immigration, where it is considered you are in 'no mans land'). The legal issues of this are currently going through the courts based around the number of people who have had their laptops searched (passwords are requested at the time of the search if necessary). But even if this is resolved, it probably will only apply to US Citizens and not visitors.

2) The chap who has gone to prison for not disclosing his password will go back again for another term if he doesn't disclose the password when he is released. Someone mentioned "maybe it's better to server 90 days in prison for not disclosing the password then to be caught with something more incriminating on his hard drive". That is mitigated by the fact that each request is treated separately so he could be in prison indefinitely if he doesn't comply :/

3) I've always thought a great defense would be to have your password something like "gofuckyourself" or "obvious". That way if someone asks you for your password you can say "go fuck yourself" or "dude, it's obvious". When you go to court you can say "no, I fully complied. The password was 'gofuckyourself'"

Re: Teenager jailed for refusing to hand over computer password

#52

Post by daten » Wed, Oct 27, 2010, 8:54 PM UTC

evgen wrote: post #38

marze wrote: post #31

Earlier quoted context omitted.

Three weeks later and this fast food worker is still in jail. I guess in the UK there is no "innocent until proven guilty" and that's why some left to form the USA a while back. This story couldn't occur in the USA.

This story couldn't occur in the USA. Actually it can and does. If a judge compels you to turn over your password as a part of the discovery process and you refuse then you can be served with a contempt warrant and go straight to jail without trial and with limited possibility to appeal.

What you have said isn't true or accurate.

On December 17, 2006, defendant Sebastien Boucher was arrested on a complaint charging him with transportation of child pornography in violation of 18 U.S.C. § 2252A(a)(1). At the time of his arrest government agents seized from him a laptop computer containing child pornography. The government has now determined that the relevant files are encrypted, password-protected, and inaccessible. The grand jury has subpoenaed Boucher to enter a password to allow access to the files on the computer. Boucher has moved to quash the subpoena on the grounds that it violates his Fifth Amendment right against self-incrimination.

The district court held that Boucher could invoke the Fifth Amendment and refuse to comply.

http://cyb3rcrim3.blogspot.com/2007/12/court-upholds-using-f...

They later worked around it by requiring him to provide the decrypted contents of the drive instead of the password itself since a border agent witnessed some of the files on the drive and he wouldn't be providing new evidence.

http://cyb3rcrim3.blogspot.com/2009/03/5th-amendment-bummer....

Re: Teenager jailed for refusing to hand over computer password

#53

Post by sp4rki » Wed, Oct 27, 2010, 9:01 PM UTC

dotBen wrote: post #49

sp4rki wrote: post #37

Earlier quoted context omitted.

In this example your safe is the medium in which the data is stored. If the police get's a warrant to search my safe, they may do so, but when they find a notebook full of enciphered text or a tape with "noise" in it I'm not obligated to provide them with means to decipher them. Hell I could just say I forgot the key, how is anyone going to prove I'm lying? Personally I agree with you. My data is my data, and I shoul…

Hell I could just say I forgot the key I had the opportunity to attend a public gathering with Jack Straw during the public consultation of this bill (he was the MP who introduced this law). The issue of "what if you forget your password" is covered in the law, which basically says you have to know and keep control/ability to decrypt all encrypted media you own. Forgetting the password isn't a defense. (don't shoot t…

Oh no really I understand the implications and everything... but let's say you do forget the password, what can they do realistically? It seems highly immoral to throw you in jail because you forgot a password.

Now let's say you're in the middle of a murder case, and it is about to be thrown away because of lack of evidence. So they ask you to provide the key to your encrypted drive, but you've forgotten the key... So now do you go to jail on a life in prison sentence because of it? Do they let you go? Do they keep you in prison while they try to decrypt it which might take millions of years?

I can always say "I forgot, this whole ordeal has affected me psychologically and I can't seem to recall the key because of it". Then what happens? I go to jail for 4 months? Which might be a total injustice since there's a possibility it's actually true. Or maybe it's a loophole for a crook because he might have had to serve life in prison, and now he's only doing 4 months thanks to encryption.

A judge can easily send you to jail if there's proof you did something. The same way your girlfriend can easily send you packing because she has proof you cheated. The question is, can you send your girlfriend packing for cheating if you have no proof? If you have no proof then you're sending her packing because of an idea on your head (not real fact and you might be wrong), which is hardly fair and will probably be looked at with contempt and frowned upon by peers (read the rest of the world). Now can the state send you to jail because it thinks that you have child porn on your hard drive, without ever proving you have it?

What happens then when the state has the power to lock you up without proof?

Re: Teenager jailed for refusing to hand over computer password

#54

Post by Natsu » Wed, Oct 27, 2010, 9:05 PM UTC

dotBen wrote: post #49

sp4rki wrote: post #37

Earlier quoted context omitted.

In this example your safe is the medium in which the data is stored. If the police get's a warrant to search my safe, they may do so, but when they find a notebook full of enciphered text or a tape with "noise" in it I'm not obligated to provide them with means to decipher them. Hell I could just say I forgot the key, how is anyone going to prove I'm lying? Personally I agree with you. My data is my data, and I shoul…

Hell I could just say I forgot the key I had the opportunity to attend a public gathering with Jack Straw during the public consultation of this bill (he was the MP who introduced this law). The issue of "what if you forget your password" is covered in the law, which basically says you have to know and keep control/ability to decrypt all encrypted media you own. Forgetting the password isn't a defense. (don't shoot t…

> The issue of "what if you forget your password" is covered in the law, which basically says you have to know and keep control/ability to decrypt all encrypted media you own.

Heh. Would love to see them take that at face value. "But officer, I need this list of Blu-Ray disk keys. Otherwise, I can't decrypt all my movies the way I'm legally required to!"

And that would explain why I heard of people emailing him encrypted documents / random bits. I'm sure he knows how to decrypt those.

So you're right, it is crap.

Re: Teenager jailed for refusing to hand over computer password

#55

Post by kgermino » Wed, Oct 27, 2010, 9:13 PM UTC

RiderOfGiraffes wrote: post #15

Same story from three weeks ago with many, many comments. http://news.ycombinator.com/item?id=1760700 It's very likely that any comments here will cover the same ground, so if you're interested in might be worth reading the comments there first.

My bad. I should have searched first. Thanks for pointing it out.

Re: Teenager jailed for refusing to hand over computer password

#56

Post by ojilles » Wed, Oct 27, 2010, 9:30 PM UTC

Some really good PDF on how this works in Europe, the Netherlands and comparisons to US law. (I took me quite some time to find something looking authoritative enough to actually read.)

"If Alice has stored her key on a diskette or a smart card, and if Polly is certain of its existence and Alice’s possession of them, she can summon Alice to deliver it – at least, in the United States she can, and also in European countries, according to the European Court’s decision in Saunders. In the Netherlands, article 107 paragraph 1 DCCP, however, prohibits Polly from commanding delivery from suspects."

Further on (page 11) goes on to state that a key that doesn't exist in the physical plane might be considered admission, and therefore protected. That is unless it is demonstrated that the suspect used the same key (elsewhere) recently -- in which case it's already "admitted" by the suspect and the s/he needs to deliver the key.

http://rechten.uvt.nl/koops/THESIS/cryptocontroversy-ch08.PD...

Re: Teenager jailed for refusing to hand over computer password

#57

Post by WildUtah » Wed, Oct 27, 2010, 9:36 PM UTC

sp4rki wrote: post #53

dotBen wrote: post #49

Earlier quoted context omitted.

Hell I could just say I forgot the key I had the opportunity to attend a public gathering with Jack Straw during the public consultation of this bill (he was the MP who introduced this law). The issue of "what if you forget your password" is covered in the law, which basically says you have to know and keep control/ability to decrypt all encrypted media you own. Forgetting the password isn't a defense. (don't shoot t…

Oh no really I understand the implications and everything... but let's say you do forget the password, what can they do realistically? It seems highly immoral to throw you in jail because you forgot a password. Now let's say you're in the middle of a murder case, and it is about to be thrown away because of lack of evidence. So they ask you to provide the key to your encrypted drive, but you've forgotten the key... S…

I understand the implications and everything

I don't think you do.

I can always say "I forgot[...]" Then what happens? I go to jail for 4 months?

No, you go to jail for a few months and then they take you back to court to see if your memory has improved. If you don't have the key or if you produce a key that doesn't reveal the data they wanted it to, you go back to jail for longer.

If you can't produce the data the state demands, either because it isn't there or never existed, or because you really forgot, then you can stay in jail the rest of your life.

That is the purpose, goal, and implication that so-called law enforcement wished for and got from data investigation rules.

Re: Teenager jailed for refusing to hand over computer password

#58

Post by aplusbi » Wed, Oct 27, 2010, 10:02 PM UTC

WildUtah wrote: post #57

sp4rki wrote: post #53

Earlier quoted context omitted.

Oh no really I understand the implications and everything... but let's say you do forget the password, what can they do realistically? It seems highly immoral to throw you in jail because you forgot a password. Now let's say you're in the middle of a murder case, and it is about to be thrown away because of lack of evidence. So they ask you to provide the key to your encrypted drive, but you've forgotten the key... S…

I understand the implications and everything I don't think you do. I can always say "I forgot[...]" Then what happens? I go to jail for 4 months? No, you go to jail for a few months and then they take you back to court to see if your memory has improved. If you don't have the key or if you produce a key that doesn't reveal the data they wanted it to, you go back to jail for longer. If you can't produce the data the s…

I'm pretty sure that there is a limit to the amount of time you can spend in jail for that (only a few months), at least for criminal cases.

I remember reading about a guy who was basically given an indefinite jail sentence in a civil case because the judge didn't believe that he really lost all his money is poor investments.

However I remember that the article highlighted the distinction between criminal and civil cases.

Re: Teenager jailed for refusing to hand over computer password

#59

Post by aplusbi » Wed, Oct 27, 2010, 10:16 PM UTC

sp4rki wrote: post #50

aplusbi wrote: post #42

Earlier quoted context omitted.

The medium verses transformation is a really interesting argument. I wonder how the law will see it when that day comes. I have a feeling that the transformation argument may fall pray to the "color of bits" problem but perhaps not. I think it may even come down the choice of algorithm - if I use a publicly available encryption algorithm then it might be considered a medium, whereas if I invent my own language maybe…

If the law sees it as anything other than what it is, a separation between what my data is and the fact that it belongs to me, in contrast to where it is stored, it will probably open a a big ass can of worms. Might as well change the name of the USA to North Korean States of America. My opinion: If I write a poem in a notebook (hard drive) using a cipher (encryption) for which only I know the key, the law is able to…

This is sort of why I think it may come down to your choice of algorithms. For example, let's say I buy a hypothetical external hard drive. This external drive has built in encryption, and I have to enter a password using a keypad on the drive before I can mount it. Should I be legally compelled to enter the combination?

Re: Teenager jailed for refusing to hand over computer password

#60

Post by ColinDabritz » Wed, Oct 27, 2010, 10:18 PM UTC

dotBen wrote: post #49

sp4rki wrote: post #37

Earlier quoted context omitted.

In this example your safe is the medium in which the data is stored. If the police get's a warrant to search my safe, they may do so, but when they find a notebook full of enciphered text or a tape with "noise" in it I'm not obligated to provide them with means to decipher them. Hell I could just say I forgot the key, how is anyone going to prove I'm lying? Personally I agree with you. My data is my data, and I shoul…

Hell I could just say I forgot the key I had the opportunity to attend a public gathering with Jack Straw during the public consultation of this bill (he was the MP who introduced this law). The issue of "what if you forget your password" is covered in the law, which basically says you have to know and keep control/ability to decrypt all encrypted media you own. Forgetting the password isn't a defense. (don't shoot t…

Wow, that's an interesting point of view (as enshrined in law). For example, I own some DVDs or say Blu-Ray discs. Shouldn't the company provide me the key to decrypt them in case the police want to decrypt them? I suspect those companies wouldn't appreciate that.

Also, since encrypted data, if done properly is very hard to distinguish between random noise, and people often use writes with random noise as a secure erasure technique, it could also be that you erased that data? That is a thorny issue as well.

Is "I erased the data on that drive securely using random bits" a valid defense?