DOJ: We can force you to decrypt that laptop • Hacker News Board

Re: DOJ: We can force you to decrypt that laptop

#71

Post by SoftwareMaven » Mon, Jul 11, 2011, 6:30 PM UTC

djackson wrote: post #52

pielud wrote: post #31

Earlier quoted context omitted.

Do you think the government should have subpoena power in order to collect evidence? Do you think they should be able to search a murderer's home for the weapon? Of course they should. But that's no the issue here. The issue at hand is whether or not the government can compel you to give them information. Consider this. You have a box, buried in the Mojave desert, with some documents in it. You've memorized the gps c…

I don't think you understand what a subpoena is. A subpoena is a compulsory order to produce all documents related to a matter, whether the government knows they exist or not. So yes, if you believe in subpoena power, you agree that you should have to produce that box.

And you are failing to understand the 5th Amendment. You do not have to give up that information, if it is only in your head, regardless of the subpoena. That is the entire point of the 5th. You can't stop the government from doing its search, you can't actively hide it, but you don't have to give them the information if it will incriminate you.

Re: DOJ: We can force you to decrypt that laptop

#72

Post by raganwald » Mon, Jul 11, 2011, 6:47 PM UTC

jergason wrote: post #57

I thought this quote by the DOJ was pretty ridiculous: Public interests will be harmed absent requiring defendants to make available unencrypted contents in circumstances like these. Failing to compel Ms. Fricosu amounts to a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) I don't like how they bring out the bogey-men of…

Laying aside the emotional rhetoric, the point being debated is whether public interests will be harmed or not. What's clear is that prosecutorial interests will be harmed, but the entire point of constitutional rights is that sometimes there is conflict between the interests of those who prosecute crimes and the public interest.

For example, you could easily argue that having a lawyer present during interrogation harms public interests for exactly the same reasons: Child molesters, terrorists, and just plain naughty people will clam up and not give investigators information that could lead to a conviction.

We had that discussion, and south of the border you decided that public interests were harmed by not allowing a lawyer to be present and were further harmed by not warning suspects of their rights.

(Canada takes a different view with respect to the right to a lawyer for complex reasons.)

Re: DOJ: We can force you to decrypt that laptop

#73

Post by palish » Mon, Jul 11, 2011, 6:57 PM UTC

bhousel wrote: post #48

roc wrote: post #23

Earlier quoted context omitted.

Then how can they compel someone to unlock a laptop to enable arbitrary access? Wouldn't they be limited to requesting specific documents?

Every case is a little different, but investigators do need probable cause to search a laptop. This is a mortgage fraud case involving years of criminal activity, so I'm guessing that it's probably not too hard for the prosecution to produce witnesses who can say "yes, she sold me that crappy mortgage and used her laptop when I went to meet with her.", or direct information of her internet usage (ISP, or logs from ca…

So the moral of the story is, conduct your criminal activity via software running on an external server on a TrueCrypt partiton, and always interface with it via Tor?

Then they can't prove it's "your server" and thus order you to reveal the key.

(For example, if you have access to a credit card not in your name, you can set up an EC2 micro instance for free for a year. Then install TeueCrypt and be on your merry criminal way. What could the DOJ do?)

Re: DOJ: We can force you to decrypt that laptop

#74

Post by pyre » Mon, Jul 11, 2011, 7:01 PM UTC

kenjackson wrote: post #68

pyre wrote: post #60

Earlier quoted context omitted.

I think what it amounts to is: * The government 'knows' that you have a bunch of digital data, therefore it must be stored on a digital device. Therefore, all your digital devices are reasonably suspect. * The government can't search your laptop without full access to files. If you have full-drive encryption (or even just homedir/per-user encryption), the government can reasonably claim that you haven't given then fu…

I think the govt would have to use the same means it would use to prove that you know the whereabouts of a missing person. They can't hold you forever (except maybe in enemy combatant like scenarios), much like if you picked up a girl from a club at midnight, and no one ever saw her again. Your claim is you dropped her off at her apartment at 3am, but there's no evidence of it. They can ask you what they want, but w/…

Yea. Your point is that they can't lock you up forever based on the suspicion of a hidden volume. My point is that it would likely to be hard to them to reasonably assert a hidden volume, and even if they could assert a hidden volume, if you unlocked one but had several, they wouldn't be able to reasonably convince a judge of suspicion of several hidden volumes.

Then, having several is difficult since they all have to nest, and can't reside in parallel (i.e. the second hidden volume has to be inside the first hidden volume, it can't reside along side the first hidden volume within the top-level volume).

Re: DOJ: We can force you to decrypt that laptop

#75

Post by cookiecaper » Mon, Jul 11, 2011, 7:03 PM UTC

Again, the best analog is a document handwritten in a made-up cipher. If someone finds a paper in a notebook that looks like it contains useful information but the actual glyphs used are unreadable to the masses, or the order of the letters are scrambled, or whatever other personal encryption scheme the defendant used when he wrote that note, can the government compel the defendant to reveal the key to his personal cipher? Can the government compel the defendant to not hand over the key to the cipher but provide a decoded interpretation of the message?

That is the correct analogy for this situation much more than safes or doors. Computer encryption is the same thing, just uses a common cipher and the information is encrypted millions of times faster than a human could crypt by hand.

Re: DOJ: We can force you to decrypt that laptop

#76

Post by pyre » Mon, Jul 11, 2011, 7:12 PM UTC

TheCondor wrote: post #65

There is a certain romantic man against the world sort of idea where I support this kind of privacy. Some kind of 1984 like scenario.. I'm thinking like someone writes some particular brand fiction for his own enjoyment, somehow it becomes illegal and he's now a criminal for his private thoughts or the contents of his private writings. Or practicing an outlawed religion in private or something. The reality of the mos…

  > it's not like they were randomly going through customs
  > or pulled over by a police officer and the contents of
  > their computer were requested

That happened in one case. The problem with that case, is that the guy unlocked the computer for customs, customs found child porn, they turned off the computer, and later on the guy refused to unlock the computer of them again. The issue with this is that the border agent already saw that there was incriminating evidence in the encrypted volume, which muddies the waters a bit. Granted, if he mentioned child porn in passing to the border agent, they couldn't force him to testify against himself and make that same statement later on (e.g. in court, or on video).

Re: DOJ: We can force you to decrypt that laptop

#77

Post by marshray » Mon, Jul 11, 2011, 7:14 PM UTC

palish wrote: post #73

bhousel wrote: post #48

Earlier quoted context omitted.

Every case is a little different, but investigators do need probable cause to search a laptop. This is a mortgage fraud case involving years of criminal activity, so I'm guessing that it's probably not too hard for the prosecution to produce witnesses who can say "yes, she sold me that crappy mortgage and used her laptop when I went to meet with her.", or direct information of her internet usage (ISP, or logs from ca…

So the moral of the story is, conduct your criminal activity via software running on an external server on a TrueCrypt partiton, and always interface with it via Tor? Then they can't prove it's "your server" and thus order you to reveal the key. (For example, if you have access to a credit card not in your name, you can set up an EC2 micro instance for free for a year. Then install TeueCrypt and be on your merry crim…

The DoJ would simply get a judge to sign an order giving their forensics lab a snapshot of the virtual machine with the key sitting decrypted in RAM. Amazon would be under a gag order not to tell you that they even had it (not that Amazon would even care to tell you anyway).

If they wanted to pin it to you, they could easily show timing correlations between your client system activity and the VM activity. Probably they would also go to the person who lent you their credit card and threaten them with prosecution unless they fingered you.

Cryptography is not going to save you from prosecution if you do any noteworthy crime. There is no security "in the cloud" from any government with a jurisdictional or financial relationship with the provider. (Though Tahoe LAFS is an interesting project).

Re: DOJ: We can force you to decrypt that laptop

#78

Post by twalker » Mon, Jul 11, 2011, 7:22 PM UTC

Has anyone developed anything that would completely delete a disk when a decoy password is typed in, whilst displaying a fake OS instance filled with a legit looking my docs, internet history etc?

In that case you give them the decoy password and they clear your machine for you

Re: DOJ: We can force you to decrypt that laptop

#79

Post by marshray » Mon, Jul 11, 2011, 7:22 PM UTC

asciilifeform wrote: post #67

This is why you must give out the password. The one that sets off the thermite, that is. You will still be imprisoned, but it will be a sentence of known length, rather than "at the king's pleasure." And be sure to compare the penalty with the one you were originally trying to escape from.

I suppose you were referring to the thermite used to burn up the documents in high-security safes rather than as a general bomb.

That's not a plausible scenario with general-purpose computer parts. The lab would obviously have made backup copies of the drive first.

Re: DOJ: We can force you to decrypt that laptop

#80

Post by nodata » Mon, Jul 11, 2011, 7:26 PM UTC

d0ne wrote: post #17

IANAL ( Edit to include a reference for my opinions[1] ) The general argument for forcing someone to turn over the key to a door once compelled by the court is that it is commonly known there are other reasonable means by which to access the content the door protects that do not require the key: 1) Locksmith 2) Break the door down 3) Use a different door if one exist These are reasonable methods as neither of them ta…

I think this was discussed here the other day (can't find the link, sorry). The thinking went something like this: a passphrase is equivalent to a combination wall safe and not to a lock with key: one requires a physical thing to open it, the other requires something within your head. The something within your head is equivalent to testimony.