Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ: We can force you to decrypt that laptop

news.cnet.com

Post reply on HN
Print view View original

61–70 of 128 posts

Re: DOJ: We can force you to decrypt that laptop

#61

Post by tedunangst »

someone13 wrote: post #29
naner wrote: post #24

Earlier quoted context omitted.

That seems to be imply that she is lying, though. What if she actually doesn't know the password? For example if it isn't her laptop or the password was written down and lost or it is an old encrypted volume which she doesn't use anymore, etc.

This is one of the reasons that I find the Fifth Amendment to be important. Without it, the DOJ could simply ask any murder suspect to reveal where they stashed the body and murder weapon, charging them with obstruction of justice or contempt of court if they didn't answer. This, of course, would be a serious problem if the accused didn't actually commit the crime.

There is a difference between the DOJ asking you to provide access to information and asking you to provide the information itself.

Re: DOJ: We can force you to decrypt that laptop

#62

Post by burgerbrain »

SoftwareMaven wrote: post #56
roc wrote: post #39

Earlier quoted context omitted.

Suppose someone uses my wifi connection to hack into, say, a Sony server and retrieve a database of credit card information. The government would have evidence and reason to believe I have that data. So, naturally, they'll get to seize my laptop and apparently can compel me to unlock it and allow them arbitrary access. It seems to me that they don't know the stolen data resides on that laptop any more than they know…

I think that's where forensics would come in: "This is a 2TB drive. All the data on the drive amounts to 1.5TB. QED, there is 500GB of data missing." More interesting, IMO, would be how alleged steganography would be handled.

Thankfully that is not how truecrypt works. The volume would be reported as the full 2TB (or however large the container is), it is up to you to not use all the space (which you could do, it will just silently start overwriting the hidden volume. They would have nothing to go on other than you didn't fill the disk (who does?).

Re: DOJ: We can force you to decrypt that laptop

#63

Post by cbs »

JohnsonB wrote: post #55
bhousel wrote: post #40

Earlier quoted context omitted.

Federal investigators and prosecutors aren't dumb. For all of those scenarios that you mentioned, it would be easy to tell whether or not this was a laptop that she used frequently. Where did she get it from? (or from whom? - she should be able to say.) In what condition was the laptop found, on her desk? opened? screen saver on? or powered down? in a pile, covered in dust? any fingerprints or other signs of use? Any…

None of those are reasonable or reliable indications that he/she is lying about having forgotten a password. There are fingerprints or signs of use? What if the defendant has been actively trying to remember the password, or has just done something as simple as moved the laptop's location to get it out of the way? Removable media present? What if it was left in there from when they did have use of the password and di…

>None of those are reasonable or reliable indications that he/she is lying about having forgotten a password.

I agree fully, forgetting passwords happens. My AD account at work has a short, random password with a forgiving lifespan. Even though I have to enter it a few dozen times a day, following the long weekend I had for the 4th it took me 5 minutes of sitting at my desk before I remembered enough to make a few guesses at it.

If I went more than a week or so without opening my encrypted partition, the password is long, complicated and changed frequently enough that I will most likely forget it. I currently only know it by muscle memory.

Re: DOJ: We can force you to decrypt that laptop

#64

Post by mahyarm »

SoftwareMaven wrote: post #56
roc wrote: post #39

Earlier quoted context omitted.

Suppose someone uses my wifi connection to hack into, say, a Sony server and retrieve a database of credit card information. The government would have evidence and reason to believe I have that data. So, naturally, they'll get to seize my laptop and apparently can compel me to unlock it and allow them arbitrary access. It seems to me that they don't know the stolen data resides on that laptop any more than they know…

I think that's where forensics would come in: "This is a 2TB drive. All the data on the drive amounts to 1.5TB. QED, there is 500GB of data missing." More interesting, IMO, would be how alleged steganography would be handled.

No, since people everywhere don't use the full capacity of their hard drives. Hidden volumes look no different from empty space so that doesn't prove anything.

Re: DOJ: We can force you to decrypt that laptop

#65

Post by TheCondor »

There is a certain romantic man against the world sort of idea where I support this kind of privacy. Some kind of 1984 like scenario.. I'm thinking like someone writes some particular brand fiction for his own enjoyment, somehow it becomes illegal and he's now a criminal for his private thoughts or the contents of his private writings. Or practicing an outlawed religion in private or something. The reality of the most recent cases regarding this stuff is you've got some fairly petty thefts, child porn, and similar crimes. An investigation reached the point where a computer was seized, they drew suspicion,crimes may have been observed and recorded, it's not like they were randomly going through customs or pulled over by a police officer and the contents of their computer were requested. Are there any cases of note where the suspect or defendant has some sort of cause to champion?

If we accept that this encrypted space is protected by the fifth amendment, then why won't we just regulate that encryption needs a "law enforcement access key" or make such encryption just illegal? You can make a very compelling case that it's not serving any public good if you can list off criminals and crimes that have gone free because of it. That would make the very use of encryption potentially becomes a crime regardless of the encrypted information content. Is that not the logical next step?

I'll assert what I've asserted many times, here and other places: if you're breaking the law for some ideological reason and keep encrypted electronic records of it, you're way better not going to court and not being on any police or prosecution's radar than just banking on the encryption holding. Pirating movies on bit torrent isn't exactly civil disobedience either, that would mean doing so openly and publicly.

Re: DOJ: We can force you to decrypt that laptop

#66

Post by mahyarm »

tedunangst wrote: post #61
someone13 wrote: post #29

Earlier quoted context omitted.

This is one of the reasons that I find the Fifth Amendment to be important. Without it, the DOJ could simply ask any murder suspect to reveal where they stashed the body and murder weapon, charging them with obstruction of justice or contempt of court if they didn't answer. This, of course, would be a serious problem if the accused didn't actually commit the crime.

There is a difference between the DOJ asking you to provide access to information and asking you to provide the information itself.

There is a difference between the DOJ asking you to provide access to / the location of the body and asking you to provide the body itself.

Re: DOJ: We can force you to decrypt that laptop

#67

Post by asciilifeform »

This is why you must give out the password.

The one that sets off the thermite, that is.

You will still be imprisoned, but it will be a sentence of known length, rather than "at the king's pleasure."

And be sure to compare the penalty with the one you were originally trying to escape from.

Re: DOJ: We can force you to decrypt that laptop

#68

Post by kenjackson »

pyre wrote: post #60
roc wrote: post #39

Earlier quoted context omitted.

Suppose someone uses my wifi connection to hack into, say, a Sony server and retrieve a database of credit card information. The government would have evidence and reason to believe I have that data. So, naturally, they'll get to seize my laptop and apparently can compel me to unlock it and allow them arbitrary access. It seems to me that they don't know the stolen data resides on that laptop any more than they know…

I think what it amounts to is: * The government 'knows' that you have a bunch of digital data, therefore it must be stored on a digital device. Therefore, all your digital devices are reasonably suspect. * The government can't search your laptop without full access to files. If you have full-drive encryption (or even just homedir/per-user encryption), the government can reasonably claim that you haven't given then fu…

I think the govt would have to use the same means it would use to prove that you know the whereabouts of a missing person.

They can't hold you forever (except maybe in enemy combatant like scenarios), much like if you picked up a girl from a club at midnight, and no one ever saw her again. Your claim is you dropped her off at her apartment at 3am, but there's no evidence of it. They can ask you what they want, but w/o more evidence they can't just lock you up forever.

But with more evidence, for example, if they find IMs where you mention that you've hidden something in hidden volumes, they may have more options open to them.

I guess my point is that this seems to fall into standard practice, more than this being a one off rule specific to hidden volumes.

Re: DOJ: We can force you to decrypt that laptop

#69

Post by [deleted] »

SoftwareMaven wrote: post #56
roc wrote: post #39

Earlier quoted context omitted.

Suppose someone uses my wifi connection to hack into, say, a Sony server and retrieve a database of credit card information. The government would have evidence and reason to believe I have that data. So, naturally, they'll get to seize my laptop and apparently can compel me to unlock it and allow them arbitrary access. It seems to me that they don't know the stolen data resides on that laptop any more than they know…

I think that's where forensics would come in: "This is a 2TB drive. All the data on the drive amounts to 1.5TB. QED, there is 500GB of data missing." More interesting, IMO, would be how alleged steganography would be handled.

[deleted]

Re: DOJ: We can force you to decrypt that laptop

#70

Post by cbs »

sorbus wrote: post #53
evilduck wrote: post #41

Earlier quoted context omitted.

You still make the assumption that the prosecuted knows the password and is implicitly guilty. Imagine for a second that I was less technically minded and didn't use encryption and I purchased a used laptop from someone who did, I then get caught up in the legal system (guilty or innocent for the charged crime, it doesn't matter, but I did not use encryption) and some prosecutor has a warrant to compel me to unlock t…

You would have explained the origin of the encrypted data on the laptop, and they would either drag the person who was the origin into the case as a defendant or have him testify. It's really quite simple; they're not just asking "what is the password?" and ignoring any answer that isn't the password, as you seem to think. If you were to refuse to give the password under the grounds that someone you refuse to identif…

You would have explained the origin of the encrypted data on the laptop, and they would either drag the person who was the origin into the case as a defendant or have him testify. It's really quite simple

Assuming the original owner can be identified (I've bought a laptop off of craigslist with no way to find the previous owner even a day later), found (contact data is still valid, person is willing to cooperate with the investigation), is willing to corroborate your story (what if the laptop was, unbeknownst to the buyer, stolen property or the seller pleads the 5th and/or lies about the encrypted files), and that the prosecution is willing to believe the both of you.

It is simple, but relies on a WHOLE lot of faith in the system.

you would rightly be considered to be lying because that's the most plausible case for that behavior.

If you're going to be held in contempt (as the GP seems to be discussing) just for something that is the most plausible of options kind of destroys the judiciary's position of dealing with the complex unforeseen circumstances that arise in law. The most plausible situation is that OJ killed his wife, but we don't carry out justice with such imprecision.

Post reply on HN