Judge: Americans can be forced to decrypt their laptops

Bl8ckr0uter

Judge: Americans can be forced to decrypt their laptops | Privacy Inc. - CNET News

Wow did anyone talk about this?

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

demonfurbie

ive had laptops that were considered evidence with encrypted drives and the users had to decrypt the drive or face hindering charges.

its not decrypted by the defendant its often decrypted in the crime lab by a state tech and a tech that is hired by the defense.

tpatt100

I'm not seeing what the controversy is??

coty24

tpatt100 wrote: »

I'm not seeing what the controversy is??

Many people see it as a violation of the Fifth amendment, but the workaround is persons of interest really don't have to "say" anything. So that technically wouldn't be covered by the "right to remain silent". It's seems a little in the grey area to provoke someone to decrypt their hdd; I think the problem is how it isn't an "illegal search and/or seizure". I think it is infringing on someone rights to do so, guilty or not. This kind of thing could open the floodgates for other types or crap to happen as well. Here's a possible scenario,"We believe you stole $1000 and put it in your bank. We order you to log in to your bank and let us check." How do they know the evidence is on that PC?

I don't know the background on all of it, but it seems like they didn't have enough evidence to do anything to her so they made something. Maybe it's just me, but I don't like it.

WafflesAndRootbeer

tpatt100 wrote: »

I'm not seeing what the controversy is??

It involves the concept of self-incrimination if you are forced to give up personal knowledge that would otherwise be completely inaccessible because it resides only in your mind.

coty24

WafflesAndRootbeer wrote: »

It involves the concept of self-incrimination if you are forced to give up personal knowledge that would otherwise be completely inaccessible because it resides only in your mind.

Exactly what I was thinking and a couldn't say it, hehe

tpatt100

WafflesAndRootbeer wrote: »

It involves the concept of self-incrimination if you are forced to give up personal knowledge that would otherwise be completely inaccessible because it resides only in your mind.

But how is that different than a search and siezure with a warrant of your property? If you have a key code on your house locks and the police have a search warrant, are you not forced to unlock your home to let the police in?

RobertKaucher

WafflesAndRootbeer wrote: »

It involves the concept of self-incrimination if you are forced to give up personal knowledge that would otherwise be completely inaccessible because it resides only in your mind.

The evidence does not reside in your mind. The password or private key is not evidence in itself. You are not being asked to provide evidence against your self, you are being asked to produce what is equivalent to a key.

tpatt100 wrote: »

But how is that different than a search and siezure with a warrant of your property? If you have a key code on your house locks and the police have a search warrant, are you not forced to unlock your home to let the police in?

Exactly. I don't think this is a case of government over reaching, but of competing mental models of what encryption and hard drives are.

vinbuck

tpatt100 wrote: »

But how is that different than a search and siezure with a warrant of your property? If you have a key code on your house locks and the police have a search warrant, are you not forced to unlock your home to let the police in?

A judge has to be presented enough evidence to have probable cause that a crime has been committed to issue a warrant that will hold up under the scrutiny of an appeal. Officers have to find clearly recognizable contraband or evidence of illegal activity in order to proceed with criminal charges subsequent to search of the premises authorized by a warrant. The problem with digital evidence is that a laptop found in a house it isn't any indication of illegal activity in and of itself. There are very strict procedures that have to be followed in order to process digital evidence. This seems like an attempt to speed that process up...not sure if I agree with it or not, but usually a good digital evidence team can get to the data anyway, it just takes a little longer without someone ponying up the encryption keys, passswords, etc.

I think where this falls legally, is that if a warrant has indeed been issued to search someone's home, then by law they must legally provide access to the home by unlocking the door and allowing law enforcement to enter and search or risk forced entry - this is within the bounds of the warrant, and you can't refuse access to the premises based solely on the fact that you might incriminate yourself by permitting the police in - hence the warrant. The same rules will probably apply here - if a warrant is issued to search a computer for evidence, then there is already a reasonable belief that a crime has been committed, so the individual will be required to provide access to the computer via passwords or encryption keys (just like unlocking the door for a premises search) to determine if a crime has been committed.

I work in Law Enforcement part-time and saw a case where a judge issued a warrant to sieze drugs based on Facebook photos because there was enough probable cause to believe that a crime had been committed based on the detail of the photos and certain other details they revealed.

Bl8ckr0uter

But if the information leads to "evidence" then what's the difference?

I just hope she used a truecrypt hidden volume:
TrueCrypt - Free Open-Source On-The-Fly Disk Encryption Software for Windows 7/Vista/XP, Mac OS X and Linux - Hidden Volume

RobertKaucher

Bl8ckr0uter wrote: »

But if the information leads to "evidence" then what's the difference?

I just hope she used a truecrypt hidden volume:
TrueCrypt - Free Open-Source On-The-Fly Disk Encryption Software for Windows 7/Vista/XP, Mac OS X and Linux - Hidden Volume

A lot. They should already have evidence that a crime has been committed and enough evidence to get a warrant. If an officer serves a warrant asking to search your car, you are expected to open it. Same for your home and any rooms with in. Could that not lead to evidence? The 5th amendment is designed to keep you from bearing witness against yourself, not allowing you to prevent law enforcement from doing their jobs.

Bl8ckr0uter

RobertKaucher wrote: »

A lot. They should already have evidence that a crime has been committed and enough evidence to get a warrant. If an officer serves a warrant asking to search your car, you are expected to open it. Same for your home and any rooms with in. Could that not lead to evidence? The 5th amendment is designed to keep you from bearing witness against yourself, not allowing you to prevent law enforcement from doing their jobs.

IMO a computer is a little bit more "personal" than a household. I also found this case interesting:

http://docs.justia.com/cases/federal/district-courts/michigan/miedce/2:2009mc50872/241276/4/0.pdf?1269990661

I think this opens up a whole new can of worms considering how flakey some warrants have been in the past (especially in this area). Of course in the next NDAA I wouldn't be shocked if the military will be allowed to force someone to decrypt their information if they suspect they are a terrorist.

vinbuck

Bl8ckr0uter wrote: »

I think this opens up a whole new can of worms considering how flakey some warrants have been in the past (especially in this area). Of course in the next NDAA I wouldn't be shocked if the military will be allowed to force someone to decrypt their information if they suspect they are a terrorist.

That would violate Posse Comitatus unless the National Guard was doing it under state orders from the Governor and would be almost impossible to legislate aorund. More likely it would be the charter of the FBI with assistance from Homeland Security and/or NSA.

erpadmin

coty24 wrote: »

Many people see it as a violation of the Fifth amendment, but the workaround is persons of interest really don't have to "say" anything. So that technically wouldn't be covered by the "right to remain silent". It's seems a little in the grey area to provoke someone to decrypt their hdd; I think the problem is how it isn't an "illegal search and/or seizure". I think it is infringing on someone rights to do so, guilty or not. This kind of thing could open the floodgates for other types or crap to happen as well. Here's a possible scenario,"We believe you stole $1000 and put it in your bank. We order you to log in to your bank and let us check." How do they know the evidence is on that PC?

I don't know the background on all of it, but it seems like they didn't have enough evidence to do anything to her so they made something. Maybe it's just me, but I don't like it.

I think the Fourth Amendment is more applicable here.
The Fourth Amendment (Amendment IV) to the United States Constitution is the part of the Bill of Rights which guards against unreasonable searches and seizures, along with requiring any warrant to be judicially sanctioned and supported by probable cause. It was adopted as a response to the abuse of the writ of assistance, which is a type of general search warrant, in the American Revolution. Search and arrest should be limited in scope according to specific information supplied to the issuing court, usually by a law enforcement officer, who has sworn by it.

The Fifth Amendment (Amendment V) to the United States Constitution, which is part of the Bill of Rights, protects against abuse of government authority in a legal procedure. Its guarantees stem from English common law which traces back to Magna Carta in 1215. For instance, grand juries and the phrase due process (also found in the 14th Amendment) both trace their origin to Magna Carta.

Bl8ckr0uter

What are your thoughts ERP?

Zartanasaurus

Not the first time a case like this has come up.
The Volokh Conspiracy - District Court Overturns Magistrate Judge in Fifth Amendment Encryption Case:

ptilsen

As even the article mentions, the defendant can and should claim to be unable to decrypt the drive. It would be nearly impossible to prove that the defendant can decrypt the drive. If the defendant "forgets" the password or the password "doesn't work", the court has no recourse against the defendant.

Personally, I believe SCOTUS would likely consider a defendant providing the password to an encrypted hard drive containing incriminating evidence as being a "witness against [oneself]" and as such not something the court can compel under the Fifth Amendment. Just because AG "authorized" this doesn't mean it's going to hold water with SCOTUS.

Regardless of the law itself, I believe the intent of the Fifth Amendment is to provide Americans with the right to not incriminate themselves, directly or indirectly. I believe in this principle, and do not think the court made the right decision.

powerfool

The point that the justices made is that it isn't self-incriminating and therefore the Fifth Amendment doesn't apply. For instance, if they issue a subpoena for your firearms to perform ballistics test, you must comply, but you don't have to say anything about it... and they are applying the same logic here. I understand their perspective, but I disagree. For instance, if they ask you if the gun was you in the act of a crime, you can plead the Fifth... which is the same logic I apply to revealing a key. On Slashdot, they suggested making the key or keyphrase into an incriminating statement, therefore you could legitimately plead the Fifth because the key itself would be incriminating.

There are plenty of things that can be done in these cases, as well. For instance, you can have a separate key that decrypts a different part of the hard drive that has different contents.

vinbuck

ptilsen wrote: »

As even the article mentions, the defendant can and should claim to be unable to decrypt the drive. It would be nearly impossible to prove that the defendant can decrypt the drive. If the defendant "forgets" the password or the password "doesn't work", the court has no recourse against the defendant.

Sure they do, it's called contempt of court and perjury and i've seen it happen plenty of times in court - if the Judge believes you're being dishonest or impeding the process, he will toss you in the can until you decide to cooperate.

Personally, I believe SCOTUS would likely consider a defendant providing the password to an encrypted hard drive containing incriminating evidence as being a "witness against [oneself]" and as such not something the court can compel under the Fifth Amendment. Just because AG "authorized" this doesn't mean it's going to hold water with SCOTUS.

Providing access to property that is believed to have been used in the commission of a crime isn't bearing witness against yourself - You only have the right to remain silent for so long, usually until you can see an attorney - it doesn't give you the ability to stand in front of the judge and not say a peep.

Regardless of the law itself, I believe the intent of the Fifth Amendment is to provide Americans with the right to not incriminate themselves, directly or indirectly. I believe in this principle, and do not think the court made the right decision.

This has to do wth access to personal property that a warrant has been issued for - it's a fourth amendment issue.

vinbuck

powerfool wrote: »

The point that the justices made is that it isn't self-incriminating and therefore the Fifth Amendment doesn't apply. For instance, if they issue a subpoena for your firearms to perform ballistics test, you must comply, but you don't have to say anything about it... and they are applying the same logic here. I understand their perspective, but I disagree. For instance, if they ask you if the gun was you in the act of a crime, you can plead the Fifth... which is the same logic I apply to revealing a key. On Slashdot, they suggested making the key or keyphrase into an incriminating statement, therefore you could legitimately plead the Fifth because the key itself would be incriminating.

There are plenty of things that can be done in these cases, as well. For instance, you can have a separate key that decrypts a different part of the hard drive that has different contents.

Apples and Oranges...other than providing the weapon for examination, nothing else needs to be done to be able to access it for ballistics tests. Questions about an alleged crime with the weapon have nothing to do with being able to have access to it. Providing a password in no way is any admission of guilt or confession to a crime, it's merely providing access.

veritas_libertas

Bl8ckr0uter wrote: »

Judge: Americans can be forced to decrypt their laptops | Privacy Inc. - CNET News

Wow did anyone talk about this?

Defendants have been forced to give up their password for quite a while now. You could use something like TrueCrypt that allows for plausible deniability.

Edit: I guess you have already mentioned TrueCrypt.

RobertKaucher

II. CONCLUSIONS OF LAW
The Fifth Amendment provides that “[n]o person . . . shall be compelled in any
criminal case to be a witness against himself.” U.S. CONST. Amend. V. Nevertheless,
“the Fifth Amendment does not independently proscribe the compelled production of
every sort of incriminating evidence.” Fisher v. United States, 425 U.S. 391, 408, 96
S.Ct. 1569, 1579, 48 L.Ed.2d 39 (1976). Instead, “the privilege protects a person only
against being incriminated by his own compelled testimonial communications.” Id., 96
S.Ct. at 1580.

vinbuck wrote: »

Apples and Oranges...other than providing the weapon for examination, nothing else needs to be done to be able to access it for ballistics tests. Questions about an alleged crime with the weapon have nothing to do with being able to have access to it. Providing a password in no way is any admission of guilt or confession to a crime, it's merely providing access.

I have to agree. I do find the strategy of making the key incriminating kind of funny. I would like to see how that would be treated in court.

swild

She provides the password and there is evidence of the crime: up to 20 years, give or take.
Say she doesn't cooperate and they can't decrypt it: she gets contempt of court, possibly Obstruction of Justice, unknown sentence, up to the judge.
Say she doesn't cooperate and they can decrypt it: up to 20 years, give or take.

Can't say that I would be able to remember my password given all the stress and whatnot.

vinbuck

RobertKaucher wrote: »

I have to agree. I do find the strategy of making the key incriminating kind of funny. I would like to see how that would be treated in court.

The interesting thing is that if you read the article, the prosecutor told her that they didn't even need the actual password itself, they would be satisfied with her typing the password in so they could access the contents of the computer. Given those details, then the "incriminating" password would have no relevance in court because the whole issue falls under the fourth amendment and is merely access to property. I have no doubt they are taking that approach to keep it solely in the fourth amendment realm. You can retain your right to remain silent and still comply by typing in the password or decryption sequence.

erpadmin

Bl8ckr0uter wrote: »

What are your thoughts ERP?

On this?

If there is a legally obtained search warrant, then yeah, that laptop should get decrypted. My whole thing is before it ever got that far, if you're gonna go through the trouble of encrypting a laptop, you should go the extra mile and perform some sort of unrecoverable wipe in case you must decrypt, in which case I can guarantee you that that's what gonna end up happening. The only thing is that that has to get done before the judge issues the order to decrypt or else you could be held for contempt of court. But if it was done prior, then no harm, no foul.

colemic

The difference between providing physical access such as unlocking your door to let the po po's in, versus a password to decrypt the drive - if you don't unlock your door, they will kick it in, thus providing themselves access. This is an interesting case. I imagine she will claim the password doesn't work, and if she was tossed in the clink, it wouldn't be for long once her lawyer appealed. I cannot see a sustained contempt sentence based on the fact that she cant remember a password from 6 months or two years ago, whichever the case may be.

WafflesAndRootbeer

Note to self: Encrypt data, memorize password | InSecurity Complex - CNET News

Court agrees with my opinion on this. No surprise there given that I have a law degree.

Forsaken_GA

RobertKaucher wrote: »

I have to agree. I do find the strategy of making the key incriminating kind of funny. I would like to see how that would be treated in court.

Pass phrase:

1 sh0t a m4n 1n r3n0, ju5t t0 w4tch h1m d1e!