Man jailed 16 months, and counting, for refusing to decrypt hard drives

https://arstechnica.com/tech-policy/2017/02/justice-naps-man-jailed-16-months-for-refusing-to-reveal-passwords/

by doener • 9 years ago

667 471 9 years ago

The people who do this now will become old and helpless to, and it is our purpose to forget nothing and make sure their final years are thoroughly ruined.

2bluesc• 9 years ago

Which people? Those instituting the policies or those accused of the crimes?

guard-of-terra5• 9 years ago

You see, 35 years ago you signed this order on d'tention over hard drive 'ncryption?

That's unconst'tutional, you know. Here we've got the relevant law. So now we have to w'draw a 35 years worth of pay that you received aft'wards. That's the law that say that, too. We'll start by taking your house 'way.

Also we our records show you gave $100k to your daughter 15 years ago. I'm 'fraid we have to put a debt on her for that sum, with 'nterest. Here's the rel'vant court order.

ghurtado4• 9 years ago

Why do you do that with apostrophes? It makes your comment harder to read and doesn't add anything to it.

coldtea12• 9 years ago

How's that different than "revenge fantasy" fiction?

Slim chances of anything like that happening. Besides, there are such people in every generation. They just change what they target (after all it's about the control and the profit, not about particular victims. E.g. now they can afford to play it non-racist, since why should they care much about suppressing blacks in particular, when they can now fuck the whole population?).

dang• 9 years ago

You've posted plenty of uncivil comments to HN and we've given you plenty of warnings. If you continue to do this we are going to ban you.

BigChiefSmokem3• 9 years ago

Let him go then.

sokoloff2• 9 years ago

What about the possibility that this guy (or someone else similarly situated) might legitimately not have the password to unlock the volume?

I have old hard drives and computers in my basement for which I'm quite sure I don't recall the root password.

Edited to add: I'm not coming out pro-child-pornography, but I think the EFF has it 100% correct here.

From the article: The Electronic Frontier Foundation told the court in a friend-of-the-court brief (PDF) that "compelled decryption is inherently testimonial because it compels a suspect to use the contents of their mind to translate unintelligible evidence into a form that can be used against them. The Fifth Amendment provides an absolute privilege against such self-incriminating compelled decryption."

BigChiefSmokem3• 9 years ago

Then his lawyer can argue that, but instead they are arguing the Fifth Amendment. The question is rather, does the Constitution render the court order illegal?

tajen• 9 years ago

Most people don't realize that child pornography is "any visual depiction of sexually explicit conduct involving a minor". Under a bad cop, any sexually explicit pic of a person can be deemed "under 18 years of age", unless you have the actor's ID on file.

And there are many, many underage actors. Even if you buy legal porn which claimed actors were above 18, you are guilty. Especially if you've bought it. Here's how: https://en.wikipedia.org/wiki/Age_fabrication

In other words, I've ceased to believe people convicted of child pornography were paedophiles. The condemnation is simply unrelated to the moral standards of the person.

Hence, if he has any picture on this hard drive, he's right to plead the 5th.

dleslie2• 9 years ago

Doesn't America have some rule against being compelled to provide evidence of your guilt?

personjerry• 9 years ago

It's mentioned right in the article - Fifth Amendment

dleslie2• 9 years ago

Ah, that's what that is. The amendments are not recognizable to me by number alone.

mhurron• 9 years ago

There are limits to that and the Government keeps attempting to increase the limits of the 5th amendment in regards to electronic documents.

https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

Above is another article on the same case.

ZoFreX2• 9 years ago

Yes, with exceptions. One exception being the "foregone conclusion doctrine".

danbruc4• 9 years ago

This is probably a lot less black and white then it might seem at first. If there is sufficient evidence, one can obtain a search warrant and this forces you to possibly act against your own best interest by allowing the police to search your home. On the other hand you can usually not be forced to testify against yourself.

So this becomes the question where decrypting a hard drive lies on this spectrum. Is it more like testifying against yourself or is it more like allowing the police to search your home? Assuming one agrees with the way testifying against yourself and searching your home is currently handled by the law.

parhurs• 9 years ago

Obviously the former. The home search is analoguous with handing the hard drive to the police (they're free to search it). Giving the key is analogous to voluntarily digging up a secret stash in your back yard. And I disagree with it not being black and white, if you didn't already notice that. Rights are rights.

danbruc4• 9 years ago

As I just wrote in other replies, I was probably wrong with regard to search warrants. Therefore my argument that sometimes you already have to act against your best interests falls apart unless someone can point at a better example than a search warrant.

Rights are rights.

But we make up those rights. If there is a right to not to incriminate oneself that applies in all circumstances, then I am of course with you, you should not be forced to decrypt the hard drive.

My point was that I am not sure if such a right applying in all circumstances exists and I thought the search warrant scenario proved that to not be the case but that turned out to be wrong.

skrause• 9 years ago

one can obtain a search warrant and this forces you to possibly act against your own best interest by allowing the police to search your home.

In Germany you never have to actively help the police even if they come with a warrant. They can't even compel you to open the door of the house or a physical safe. They will of course come in anyway and send you the bill for the locksmith, but it's your perfect right to just sit there and do nothing.

So with the hard disk encryption it's actually exactly the same: You don't have to help in any way, but of course the police can still take the drive and try to decrypt it. If they can't decrypt, well, bad luck. Not your problem, you don't have to help.

danbruc4• 9 years ago

You made me realize that I was probably wrong here, i.e. you do not have to allow the the police to enter your home acting against your own best interest, and as far as I can tell this also applies to the USA.

This raises the question if there is any other situation where you have to act against your own best interest, otherwise my initial argument falls apart and it seems unreasonable to try to force someone to decrypt his hard drive.

Another question is, how far can I push the search warrant scenario? Am I allowed to use force against the police to prevent them from entering in the same way I may use force against burglars? Am I allowed to shoot at the police? Not that it would buy you much, it is pretty unlikely that you can hide at home forever, but from a purely theoretical standpoint?

hrehhf• 9 years ago

A search warrant does not really require the target to 'allow' the police to search; the target could choose not to cooperate and police would break into the home, for example. As far as I can see, it is lawful to the target to do this. Similarly, in Rawls's case, the government is free to attempt to bruteforce the passphrase without Rawls's cooperation.

danbruc4• 9 years ago

The comments here made me realize that I was probably wrong about the required cooperation in case the police shows up with a search warrant.

planetjones• 9 years ago

As expected on HN I am not surprised to see people defending one's right to privacy and encryption. However, what's the solution then ? If all the "bad guys" who distribute illegal material do so encrypted volumes and refuse to give up the decryption key then what do we do ? It's a different world now; the police can't just take a drill out and open the safe.

remotebug• 9 years ago

Gather evidence instead of hoping you can convict someone of evil-doings based on their own records?

iamdave2• 9 years ago

If all the "bad guys" who distribute illegal material do so encrypted volumes and refuse to give up the decryption key then what do we do ?

"Bad guys" still have fifth amendment protection. You prosecute, satisfy the burden of proof and hope a jury convicts. That's what you do.

Outside of that, if you really want this changed, petition your representative to repeal the fifth amendment, I suppose?

jordache• 9 years ago

need to stop thinking from an american centric perspective.

AnonymousPlanet• 9 years ago

There is no god given right that demands to upturn every stone. Live with the fact that there is no solution that lets you look into the drives. Period.

coldtea12• 9 years ago

As expected on HN I am not surprised to see people defending one's right to privacy and encryption. However, what's the solution then ? If all the "bad guys" who distribute illegal material do so encrypted volumes and refuse to give up the decryption key then what do we do ?

Why do we care for people distributing "illegal material" in the first place?

And how come this "illegal material" doesn't ever get decrypted? Catch them then.

throwanem23• 9 years ago

Why do we care for people distributing "illegal material" in the first place?

Is "distributing child pornography should not be a crime" really the hill you want to die on?

michaelmrose6• 9 years ago

They can hack his computer before nabbing him, grab tons of his data from connected providers, get a warrant to sneak in and plant one of several type of bugs that would allow them to aquire his pass phrase. Burst in while the machine is on and aquire the unlocked data or get the key from ram.

Failing that they can convict him based on other evidence or at least convince him that they can and cut a deal for access.

In the vital cases which are normally cited as examples of why we must allow cops to violate our right options abound.

What's left is petty crap and police incompetence which serve as poor justification for giving up our rights.

terminado• 9 years ago

  "bad guys" who distribute illegal material

Honestly, I fail to see how or why this should be a problem, considering that no actual injuries are inflicted in the storage or possession of ones and zeroes.

Sure, that's an obtuse abstraction, but honestly, the buck stops there. At the end of the day, they have a circuit encoded in a given state. Magnetic media that can be arbitrarily degaussed.

It's not real.

Stop prosecuting it.

So, okay, you wanna argue. Let's get more specific.

Bad things people can "have" encoded on their digital storage media:

  1. stolen economic identifiers, such as credit 
     card numbers, and other mechanisms of fraud

  2. raster graphics and audio depicting nudity, 
     or evidence of events that have since transpired, 
     and prove culpability, via direct participation
     rather than simply the hoarding of collectible
     media files of whatever persuasion

  3. preferences and settings that can correlate 
     identity in other crimes, subscriber information
     such IMEI numbers and MAC addresses, and more

  4. classified information restricted from being
     leaked among state actors or the general public

  5. intellectual property that translates directly
     to business opportunities, insider trading,
     corporate espionage and other white collar 
     crimes

  6. copyrighted music and movies, oh noes!

Listen. If it can fit onto a credit card sized device, it's already too late. So nothing is being stopped by this sort of search.

The demand for relinquishing data, in any such situation is not unlike demanding all the things that people write on napkins and envelopes. Every scrap of paper in someone's pocket. Movie tickets, dry cleaning stubs, match books, and so on. Evidence of a crime? Possibly. Is everyone guilty until proven innocent? Gee, I don't know. Maybe we should just make everyone empty their pockets, and take pictures, just in case.

The fact of that matter is that these are essentially fishing expeditions for item #3.

It's not about "illegal data" at all, nothing is ever going to divert ones and zeroes as contraband. That simply doesn't happen, and doesn't work. It's about coming up with reasons to harass people, as vectors into prosecuting other crimes. Smoking out the paranoid, so that they crack under the pressure of getting sweated down in the hot seat.

Paul-ish3• 9 years ago

If it is all 1s and 0s, I am curious how you feel about the NSA having a good deal of your personal information stored on their drives?

godelski4• 9 years ago

As I see it, the root question is "Would we rather guilty men go free or innocent men be condemned?" We can't have a perfect justice system, so which direction are we going to choose?

Qantourisc• 9 years ago

Well if it's encrypted, how will you get a warrant for unknown data. And if you do have proof, then why do you need the data ? In these cases I think the only reliable and best way is to obtain the data by infiltration.

It's a bit like asking a burglar to break in. You either have enough proof, or you catch them in the act.

mirimir8• 9 years ago

I see these assholes as canaries. I don't mean to defend them in any way. But if they're vulnerable, so are we. At least potentially.

AckSyn• 9 years ago

He shouldn't have to decrypt his hard drives, and I support his decisions.

The problems with this are numerous.

First of all no one has any duty to provide the police with evidence as a 5th amendment protection. It's not a "right" for the police at all to have.

Imprisoning someone for failure to disregard their constitutional rights is absurd.

They have no evidence to hold him period.

BigChiefSmokem3• 9 years ago

But I bet something led police to the hard drive in question in the first place. I wonder what "that" something was. In the U.S. you can be arrested and held for Reasonable Suspicion (or Probable Cause)

michaelmrose6• 9 years ago

Not indefinitely

onion2k• 9 years ago

Whatever that was it clearly wasn't a criminal act or he'd have been charged for whatever it was. No further evidence has come to light after 16 months. That's far beyond "reasonable suspicion."

If the police can't find evidence of a crime then this guy should be released, even if he's the reason they can't find it.

grogenaut• 9 years ago

Not indefinitely

al_chemist• 9 years ago

Article mentions Freenet traffic detected at his computer. AFAIR Freenet is like BitTorrent, except nobody knows what you are downloading.

coldtea12• 9 years ago

First of all no one has any duty to provide the police with evidence as a 5th amendment protection.

Apparently all these amendments are open to all kinds of BS interpretation by courts, with loopholes like "you don't really expect privacy when you send snail mail", "some random gun freak is the same as a well armed militia", "corporations are people" and other such shenanigans.

pmoriarty• 9 years ago

Yes. That's the problem with the whole "this is a government of laws, not men" idea. The laws are always, always interpreted by men. They are enforced (or not) by men, at their discretion.

It's much like the "thou shalt not kill" commandment in the Bible. It's there in black and white, and about as clear and simple as you can get. Yet plenty of Jews and Christians kill, and often do so eagerly and joyfully, even thinking they are doing God's work. As the old saying goes, "Praise the Lord and pass the ammunition." Or "Onward, Christian soldiers!"

briHass2• 9 years ago

The examples you chose are interesting, not only because they reveal an obvious bias.

I think the correct interpretation of the various amendments is to view them in conjunction with the ninth. That is, the default should be to argue in good faith about what rights the amendment is attempting to preserve, not nit-picking them to find technicalities that the state can use to limit or restrict someone's rights.

Your hint at the 2nd Amendment is one such example: it's clear from reading other writings by the Founding Fathers that the 2nd Amendment was written to allow an individual to own firearms. Likewise, the 5th Amendment should be interpreted to allow an individual to refuse anything a court orders him to do that would force him to reveal evidence or testimony that could be used to incriminate him. I would argue that the entire point of that part of the 5th is to prevent exactly what is going on here: torture (involuntary imprisonment without conviction) used to coerce a confession.

Hopefully this issue is decided properly, as we are rapidly approaching a time where it may be possible to do a fMRI-like scan of someone's brain to determine guilt/innocence. Should we allow a court, with only a search warrant, the ability to scan our brain and possibly uncover other evidence of crimes?

droithomme2• 9 years ago

"no one has any duty to provide the police with evidence as a 5th amendment protection"

I like that idea. However, the 5th amendment's protection is something different: "No person shall be compelled in any criminal case to be a witness against himself."

Consider the case of someone running a drug lab or counterfeiting press in their residence. Police show up with a warrant based on probable cause to search the residence. The person is required to unlock the door and let the police in because the police have a warrant. The person is not testifying against themselves, they are unlocking the lock to allow a warranted search. If they do not unlock the door after being presented with a warrant then that is a new crime they can be charged with, and the police will come in anyway.

In these cases with encryption the courts have consistently been finding that the password is comparable to unlocking the door to a house to which the police have a search warrant.

It has also been counterargued that speaking or writing down a password is a form of testimony, one that can be self-incriminatory, and therefore is protected by the Fifth. Most courts have not been sympathetic to this argument, though there has been one exception.

In this case the man is in possession of a lawful order from a judge to facilitate a search and he is refusing to cooperate. Thus the judge jails him until he decides to cooperate with the lawful order from the judge. This is how it is done.

baobrain• 9 years ago

In these cases with encryption the courts have consistently been finding that the password is comparable to unlocking the door to a house to which the police have a search warrant.

I thought it was the exact opposite, where things such as a lock combination or a memorized password could not be compelled, whereas things like a fingerprint or a key can be since they are physical possessions.

_DISCLAIMER_ (IANAL and above is IIRC)

Edit: clicked some links in the article

[0] https://supreme.justia.com/cases/federal/us/530/27/case.html

[1]https://www.wired.com/2012/02/laptop-decryption-appeal-rejec...

So it's a mixed bag. [1] was never enforced because authorities got the password from elsewhere.

jakeogh4• 9 years ago

Now extend that thought line to embedded brain chips. I don't like where it goes.

mnm12• 9 years ago

The difference is, one doesn't have to cooperate with a search warrant. The idea of encryption being a lock like on a locked door is ludicrous and downright dangerous. Using a fantasy metaphor in place of actual reality is incredibly misleading and outright manipulative.

The difference between a lock and encryption is that all locks in the physical world can be broken by outside parties. If someone doesn't want to open the door for a search warrant, the cops can bust it down. That can't be done with encryption. The only metaphorical equivalent to breaking encryption would be to brute force it which, given proper encryption, is unlikely to succeed. So now we have an innocent person being held indefinitely based on some metaphor the courts decide must hold up in the real world that has no real world basis in reality. Instead of the courts logically following up their own thinking, they now expect the defendant to do the police and prosecutor's work.

If it's a lock, the police/prosecutor should break it after obtaining a warrant. It's not the defendant's job to testify and give them the information they need to break it. If they are incapable of carrying out their job, why should the innocent defendant be compelled to do it for them?

Why should the innocent defendant be made to languish in jail indefinitely because the police/prosecutor are inept and incapable of doing their job without reverting to unconstitutional tactics?

beezle2• 9 years ago

A few points -

Devils advocate, travel back to the 1950s. The government searches your home and takes a letter or other document that is clearly written in code. Can/would they jail you as in the current case until you decode it? And without even charging you with any other crime first?

At what point is "I used a one time pad" or "I don'remember" sufficient? I'm sure all of us have at least once (probably many) times forgotten a password, even for something relatively important.

The 'lock' interpretation also fails. It is obfuscation, they have executed their search warrant and they possess the obfuscated data. Can they force you to translate your documents written in some obscure language because they can find nobody else willing to do so for them?

Re: Orin Kerr - his argument fails as the government can execute their own search warrant to take documents they believe you to have - they need not rely upon you to voluntarily provide them at their request.

jliptzin• 9 years ago

And what happens if he actually forgot the password? Then what?

imh2• 9 years ago

I have a technical question about this comparison. In the locked door example, is the warrant an allowance for police to enter the area without the owner's permission, or is the warrant an order for the owner to give permission and assist?

iopq8• 9 years ago

In these cases with encryption the courts have consistently been finding that the password is comparable to unlocking the door to a house to which the police have a search warrant.

What proof do they have that he has the password to the harddrive?

derekp72• 9 years ago

Now consider, what if the police find nothing after executing the search warrant? "Hey, we know you have a counterfeit press somewhere -- give us the address where it is located".

Natanael_L9• 9 years ago

Giving them the harddrive is like opening the door. Not my problem they can't read the documents they found.

MertsA5• 9 years ago

The person is required to unlock the door and let the police in because the police have a warrant.

Is this true? The person is required to not do anything to hinder police but is the subject of a warrant ordered to assist them with the search? IMHO the difference between a key and a combination to a safe, which is the whole premiss behind being compelled to produce a decryption key being a violation of the 5th amendment, would seem to be at ends to that interpretation. Obviously if the door is unlocked when the warrant is served then the subject can't lock the police out but if there's an interior door that's locked, can the subject be compelled to provide the combination to unlock it? That's no different than being compelled to provide the combination to a safe so that would imply that the subject of a search warrant doesn't have to assist the police, just not actively impede the execution of the warrant.

mildbow• 9 years ago

What happens if he says he doesn't remember his password anymore?

ie: sits down, and seemingly tries to decrypt, but tries 1( or 50 times) and says "Oh shucks, I forgot"?

mattnewton• 9 years ago

That's a real concern after 16 months, assuming the password was obscure enough. And I doubt a judge would be amused, raising the specter of indefinite detention without trial.

angry_octet3• 9 years ago

Any significantly genuine attempt to remember the password will reduce the entropy to such an extent that your rpi could crack it. The fact that in our brain the fragments are hopelessly jumbled and you forgot if you added 1999! or 1990? to the end does not mean a computer cannot achieve a significant shortcut.

In fact I cracked one of my own filevault v1 passwords, from a Powerbook G4, using this technique. I had a muscle memory for part of the password, and that was enough to make it tractable. Cf vilefault, https://github.com/libyal/libfvde

sjy10• 9 years ago

That's precisely what happened, and the judge didn't believe him, partly because he declined to say on oath that he had forgotten the password.

JumpCrisscross• 9 years ago

Can he appeal this judge's decision to imprison him? Or is he trapped given the lack of a conviction?

nikdaheratik2• 9 years ago

They are appealing, but it's not on any rushed schedule so the appeals court is just leaving him in there.

Kostchei3• 9 years ago

I think the idea of 16 months for contempt is legally ridiculous. However, they have some evidence. I presume their de-construction of freenet will have given them some insight. The technical issue that concerns me, and I'm not sure if they have addressed, is how freenet stores data and whether the material they allege is his or a 3rd party's. Last time I looked into freenet it was doing the equivalent of storing chunks of other people's data, encrypted of course, on your machine. Like being a torrent server and storing some of the actual data the torrents refer to. A peer to peer data network, not just a reference library. Yes that sounds crazy, but that was the state a few years ago. No wonder it ran like treacle.

brokenmachine2• 9 years ago

Yes, it's a bit crazy the way Freenet works, like mad scientist crazy.

Freenet not only transmits data between nodes but actually stores them, working as a huge distributed cache.
While users can insert data into the network, there is no way to delete data. Due to Freenet's anonymous nature the original publishing node or owner of any piece of data is unknown. The only way data can be removed is if users don't request it.

https://en.wikipedia.org/wiki/Freenet#Distributed_storage_an...

You allocate a certain amount of space on your machine to an encrypted cache, that you can't even decrypt yourself or even know what it contains.

So there's no way to prove that someone even accessed a certain chunk of data, unless they saved it unencrypted to their machine, which I guess is what the Feds need to prove.

jonathanstrange3• 9 years ago

Your reasoning is perfectly fine and in line with most jurisdictions word-wide. This is just one of many cases where people elsewhere shake their heads in disbelief. How the US and UK deal with this matter is a big exception and considered both immoral and illegal in much of the rest of the world.

These two countries are 'special' in many regards, and you cannot and ought not take their sense of morality and their system of law as a basis for anything.

spaceboy4• 9 years ago

I thought the U.S had better key disclosure law[1] than other countries? Personally I would rather not self-incriminate myself by revealing a key, no matter how draconian and lengthy the sentencing was. Why, you ask? Well I consider all my own personal data likened to an extension of my own mind, and revealing a key is like slicing a thin part of my brain and attempting to pick its contents. Never a gentlemanly thing to do in any circumstance.

In terms of being stopped and searched when traveling, I just carry a TailsOS bootable live USB. My laptop doesn't have a hard-drive and boots entirely from my TailsOS USB stick. I did not enable any persistent storage and any bookmarks I need to remember, I simply remember them by rote, like in that movie The Book of Eli[2]. My threat model is such that I don't want anybody knowing my business when traveling. The intrusiveness should only go so far as one question, like "Business or Pleasure?" and that's all.

[1] https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat...

[2] https://en.wikipedia.org/wiki/The_Book_of_Eli

hdhzy• 9 years ago

Very interesting. You don't have any need for persistent storage that exceeds the amount of information that can be remembered? (E.g. work artifacts, photos, passwords)

ryan-c4• 9 years ago

Remote storage is an option.

Zombieball• 9 years ago

I don't want to assume on spaceboy's behalf, but I think all you need is to remember a master password to some sort of (online) password manager. From there you could use cloud services (eg. Dropbox) to access such documents.

Securing cloud hosted documents is obviously another discussion.

kybernetikos2• 9 years ago

If you need to cross a border, you will find that the border agents think they have the right to compel you to boot your laptop, including entering any secret or attaching any device required to do so. I doubt that they could ultimately stop you returning to your own country if you held out, but they could stop you leaving, and they could certainly make your life pretty miserable.

In my opinion you'd be much better with a laptop that booted to windows and looked like it had some simple things installed under a password you don't mind giving them. Then they'll probably never get around to asking you about the usb stick your tailsOS is installed on.

You can now get extremely large usb sticks in very small form factors. I have been toying with the idea of creating something that looks exactly (and nonsuspiciously) like a usb 'charging cable' but with built in memory. Ideally if it's plugged into power or a laptop, it just appears as a normal usb cable, but if the microusb end is not plugged in, it shows as a large memory stick you could also boot from.

spaceboy4• 9 years ago

There's nothing about TailsOS that could arouse suspicion if there's nothing persistent on it that could arouse suspicion, or draw more attention to you. TailsOS is strictly a utility like a wrench or a screwdriver. Providing you exit TailsOS properly and watch the screen as it's wiping the memory to ensure it has infact wiped. TailsOS can prove to be an innocuous O.S after you unload it from memory. They might ask questions, but they have nothing on you.

Bringing a Windows OS is stupid as Windows doesn't clean up properly after shutting down and leaves a forensic footprint which is difficult to cleanup unless you use something like Bleachbit[1] or CCleaner after using Windows. You typically want to offload cleaning up to the O.S level and avoid using such tools such as CCLeaner in the first place (Keep in mind, since this is Windows, there are issues with free space on the drive that leave deleted files remaining on the hard-disk, even after explicitly stating they should be deleted).

With TailsOS, In other words, you can browse freely and with peace of mind that you won't leave a forensic footprint behind, giving you an upper-hand over other passengers who have to self-censor their browsing for fear of scrutiny at a later date from border officers.

[1] https://www.bleachbit.org

[2] https://www.piriform.com/CCLEANER

yAnonymous• 9 years ago

Or just make GRUB invisibly boot to a default Windows install unless a key is pressed. They'll never see the other OS. A Tails install on a USB stick might raise questions if they bother to look at it.

intrasight• 9 years ago

Why don't they let him out on bail until the court is able to hear the case?

kabdib• 9 years ago

He might encrypt something again! :-)

It's a contempt-of-court thing; he's been order to take an action, and hasn't. (He might not remember the encryption passphrase, in which case the question is really, "Does he rot?" and so far the answer appears to be "Yup").

externalreality4• 9 years ago

Not sure what the man's crime is here. Does he even remember his keys after sixteen months in the slammer? I don't even remember my Gmail password after 16 days of vacation. Basically, like the article says, it like not opening a safe for an inquisitor: you are damned if you do, you are damned if you don't. Encryption is nothing new people, you are just putting your data in a safe.

We have a tendency to misconstrue, willfully misinterpret, or altogether ignore the law when it comes to prosecuting individuals who we believe to be standing on much lower moral ground. We do so because we want so badly to punish the accused that we are willing to reduce or eliminate greater good that some privacy laws are aiming to provide (i.e. Trumps silly travel ban which is based on his hatred of Muslims built upon imaginary news stories and personal exaggerations of particular recent events -- all laws out the window)

mirimir8• 9 years ago

This was pretty much inevitable :(

Encryption is nothing new people, you are just putting your data in a safe.

Well, you could also be held indefinitely for refusing to provide the combination for a safe. If there were safes that could keep them out indefinitely, anyway.

I suspect that they nailed him using ICAC's Black Ice app. It's a hacked version of the Freenet client that logs peer IPs, and tracks hashes that they handle. So his mistake was assuming that deniability was adequate, and failing to hit Freenet via Tor.

Edit: 2016-05-26 - Police department's tracking efforts based on false statistics: https://freenetproject.org/news.html#20160526-htl18attack

slantaclaus• 9 years ago

Thanks for the background, but somebody has to say it: his failure was looking at child pornography.

morgante2• 9 years ago

Well, you could also be held indefinitely for refusing to provide the combination for a safe.

Is there case law supporting that? Traditionally I think the combination would be considered forced testimony.

headShrinker• 9 years ago

Encryption is nothing new people, you are just putting your data in a safe.

I know this is an old argument, but what if I put the contents in a paper shredder, in the safe? It's still the data, it's just that it went through the shredder. Why is ok for the government to compel you to change the state of the data from encrypted to unencrypted? They couldn't compel Apple write software to decrypt a phone. Why can they compel me to write an encryption key to decrypt data.

Discloser all of my data is encrypted, and if the government asked I would really be torn about giving them keys.

nyolfen• 9 years ago

They couldn't compel Apple write software to decrypt a phone.

no, they didn't compel apple

derekp72• 9 years ago

Or, what if you had a paper in a safe that was written in an invented language? They may be able to compel you to open the safe (i.e., provide a BIOS password), but can they compel you to teach them how to read that invented language?

vivekd4• 9 years ago

His crime is disobeying a court order, which is a crime that you can go to jail for. Just like if you had the key to a safe, and the court orders you to open the safe, you would go to jail if you refuse to do so. If he forgot the keys he could have told the court that and the court would evaluate his credibility.

*edited changed from key to combination because combination locks are protected by the 5th amendment and keys are not.

externalreality4• 9 years ago

Some are arguing that the court has no right to order him to do so. 5th amendment and some case rulings are mentioned.

Programmatic3• 9 years ago

The courts can compel you to turn over something that you have. Something that you know is protected by the fifth amendment, in particular for combination locks.

https://supreme.justia.com/cases/federal/us/487/201/case.htm...

"""

JUSTICE STEVENS, dissenting.

A defendant can be compelled to produce material evidence that is incriminating. Fingerprints, blood samples, voice exemplars, handwriting specimens, or other items of physical evidence may be extracted from a defendant against his will. But can he be compelled to use his mind to assist the prosecution in convicting him of a crime? I think not. He may in some cases be forced to surrender a key to a strongbox containing incriminating documents, but I do not believe he can be compelled to reveal the combination to his wall safe -- by word or deed.

"""

dclowd9901• 9 years ago

What about the 5th amendment? I think we can agree without too much of a stretch that our storage data is just an extension of our mind (verily, suppose someone had illegal data stored on their drive and an idedic memory? Destroying the data on the hard drive wouldn't destroy the data in their mind), and thus just as protected by our right not to testify against ourself?

naasking10• 9 years ago

His crime is disobeying a court order, which is a crime that you can go to jail for.

Sure, but isn't the question whether he should go to jail indefinitely? If defying a court order is a crime, then perhaps it should have a well defined jail term.

jonathanstrange3• 9 years ago

His crime is disobeying a court order, which is a crime that you can go to jail for.

That's not his crime, or as the subtitle below the story's headline states: "He's not charged with a crime." He's held in custody, not serving a sentence for a crime of which he has been convicted. He has never been convicted of any crime by any jury. That's a huge difference, both legally and morally.

libertymcateer5• 9 years ago

Not sure what the man's crime is here.

He didn't commit a crime. He is being held in jail for contempt of court. This is how the system works. This is no different than if a judge demanded that you turn over any other form of evidence - it should not be so shocking that you can be held in contempt for refusing to obey a court order.

It is bad, however, that he is being let to rot indefinitely. That is the problem here - not that he was jailed for contempt in the first place.

int_19h• 9 years ago

I would dare say that the really bad part is that there's no way to know for sure if he can even comply with that order. As I understand, he claims that he has forgotten the password. Obviously, it's a convenient excuse, but it's not something utterly improbable. What if he actually did forget the password? Why is the word of the judge alone sufficient to assume otherwise? There seems to be an obvious lack of checks here.

naasking10• 9 years ago

He didn't commit a crime. He is being held in jail for contempt of court.

The problem is that contempt isn't classified as a crime and so it doesn't have a fixed term. There are moral hazards with having fixed terms like this, but the moral hazards of not having them, like this case, seem worse.

zhemao2• 9 years ago

The difference is that the authorities can crack open a safe without the suspect cooperating. But it's virtually impossible to decrypt something without the receiving the key.

hysan3• 9 years ago

Unless it's something akin to a Da Vinci cryptex that destroys the contents when forced open. Just scaled up to modern day encryption levels.

ust• 9 years ago

Professor Orin Kerr has wrote about this exact case extensively, and provides a good insight into all legal aspects. I think it is well worth a read, especially the part about the 'forgone conclusion'.

https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

Kostchei3• 9 years ago

Right. Well that changes things. There is some evidence of the contents. I wonder if there are hash values for those 20,000 CEM files and if they are still on freenet. If so LE could aquire, via the hashes, from the network, and prove, without opening the drives, what the contents are. At least it becomes a strong circumstantial case. If you were relying on a single file you could claim the odds of hash collision etc, but after a few hundred I think you are well past that. There is a pattern of behaviour here.

*edit - aquire not require..

iopq8• 9 years ago

If so LE could aquire, via the hashes, from the network, and prove, without opening the drives, what the contents are.

Except those files may have been deleted already. You can't prove that you will find anything incriminating on that drive.

EGreg2• 9 years ago

This is a good reason to have TrueCrypt hidden volumes and other forms of steganography. You can decrypt and still have more stuff that looks like random junk. No one can be sure you decrypted everything.

The best idea however is to have sensitive stuff stored encrypted on freenet, and log in using incognito browser sessions.

ryan-c4• 9 years ago

No one can be sure you decrypted everything.

What exactly do you think they're going to do if they don't believe you've decrypted everything?

EGreg2• 9 years ago

No idea.

They don't know anymore if ANYONE decrypted everything.

They would do whatever they do right now when they don't know things - about anyone.

Elijen• 9 years ago

"I forgot the password"

Problem solved.

Spivak2• 9 years ago

"I'm sorry sir, as personal encryption is classified as a munition there is a legal requirement that you must take proper care to ensure that you are able to respond to all lawful requests for decryption. This carries a penalty of 2-5 years in prison and a fine of $10,000."

gojomo• 9 years ago

Being charged, convicted, and sentenced in that way could be a preferable result – compared to indefinite detention without charges or trial!

michaelmrose6• 9 years ago

This is a terrible precedent people don't always throw away old computers and are bad at remembering passwords

jakeogh4• 9 years ago

Surprisingly easy to do. I have a LUKS laptop drive that I doubt I will ever get back into. Went on vacation and that was it. All I could remember is it's strong, random, >15chars and started with a S.

rfrey• 9 years ago

Don't take it across a border.

brokenmachine2• 9 years ago

You expected to be able to remember a >15char random password?

Or did you have it in some kind of password store that you no longer have access to?

curun1r• 9 years ago

That was the answer the man in the case gave. The judge believes he's lying. His 16 months of imprisonment show that his problem is far from solved.

The better answer is to have a second encrypted volume on the disk. Perhaps put a few pirated movies on it or some personal documents as a justification for why it's encrypted. That way, when they ask you to enter your password, you enter that one and unlock the volume that's mostly not incriminating. The way that TrueCrypt and other encryption programs work, it's impossible to prove that there is a second encrypted volume.

donovanm• 9 years ago

Seems a bit harsh to be detained for 16 months because a judge thinks you're lying.

ddebernardy• 9 years ago

Worse is: never knew my password, and lost my keychain. Happens. :-(

geuis• 9 years ago

Laws protecting the worst of us protect the rest and best of us.

godelski4• 9 years ago

From what I understand our legal system was designed to fail "open". Or rather that we are willing to let a guilty person go free rather than an innocent person go to jail.

I know everyone wants to have a perfect justice system but we have to ALSO decide which direction we would like it to fail until that time comes (never). In essence cases like this are more about this question. When the system fails, which direction do we want it to fail in?

godzillabrennus• 9 years ago

That was before the for profit prison industry became a cancer that incentivized keeping non-violent people in prison.

e40• 9 years ago

I think that's most of it, but I also think there's been some weird shift in the way police and prosecutors behave over the last decade. Much has been written how we now effectively have debtor's prisons. People are fined and imprisoned because they can't pay the fines.

The crazy part for me is that this has all happened while the crime rate has been steadily going down, so there's not even a justification for it (from a crime standpoint).

jamessb• 9 years ago

As a starting point, see the Wikipedia article on Blackstone's formulation [1]: "It is better that ten guilty persons escape than that one innocent suffer". It refers to an interesting article, "n Guilty Men" [2].

[1] https://en.wikipedia.org/wiki/Blackstone%27s_formulation

[2] http://www2.law.ucla.edu/volokh/guilty.htm

godelski4• 9 years ago

Thanks, these are interesting reads.

bluejekyll3• 9 years ago

You have an interesting point. I think the struggle that I see as a layperson, is that the system fails hard when it fails.

Let me ask a question, is jail the appropriate sentence for a contempt of court charge? This is not the first time, reporters have been jailed for many months bc of contempt of court charges. Is this the appropriate sentence for the crime of not complying with a court order?

I don't know what the alternative would be... also, on the question of guilt vs. innocence. I can see myself agreeing with you that since the state has such a high burden of proof to meet, that the defense has a an implicit advantage, the issue is that the statistics are showing a far greater issue of a imbalance of justice being applied at different levels of society. There is no good reason that I can see where an innocent poor person goes to jail because of a bad defense, vs a guilty rich person who gets off because of a great defense.

Justice is supposed to be blind.

godelski4• 9 years ago

Well I would consider myself a layperson and welcome anyone with actual experience to help educate me on the subject matter. I'm saying this because I'm just offering my own opinions.

In reference to your question I'll pose another question: "Should this be counted as being in contempt of court?"

As to the innocent people going to jail because of bad defense, I think this is why we need to fail in the direction of the innocent. I'd personally rather guilty men go free than innocent men be imprisoned. I think if we're going to figure out the limitations of the 5th Amendment in the digital age we need to decide which direction the system is going to fail. I think many on HN will agree with me, but I'd be interested to know what the country as a whole believes (if anyone has that info).

cortic3• 9 years ago

I've always been confused by this proposition; If there is an innocent person convicted of a crime, then there also has to be a guilty person that has gone free.. so it seems the ultimatum has to be

"are we are willing to let a guilty person go free rather than let a guilty person go free and an innocent person go to jail."

Which has a much more obvious answer..

iopq8• 9 years ago

Let's say you have 200,000 suspected criminals, some % of which are criminals. How many of them are you willing to put in prison? If it's looking that most likely around 30% are guilty, do you put 60,000 in prison and say "oh well, some false negatives, some false positives, whatever"

or do you just put 30,000 in prison to prevent most innocent persons from going to jail? Then you are letting half of the guilty people go free

It's a question of how many innocent people you are willing to jail to catch more real criminals

morgante2• 9 years ago

That's assuming a hypothetical crime actually happened in the first place. In many cases it's possible that no crime ever happened. (For example, if the man in the article never actually had child porn that doesn't mean someone else did.)

sologoub2• 9 years ago

Modern encryption isn't that much difference in basic concept to a cipher, such that it takes data in readable form and makes it unreadable.

In Apple/Gov dispute on the San Bernardino iPhone case, Gov brought up the Burr case from 1807, arguing that a 3rd party could be compelled to decipher the contents, provided there was no self-incrimination (Apple argued Burr did not apply): http://www.macworld.com/article/3046095/legal/burrs-cipher-s...

Does anyone know if there has been an attempt to equate decryption to deciphering in US courts?

enneff• 9 years ago

Aren't decrypt and decipher synonyms? What is their distinction, if any?

sologoub2• 9 years ago

Not sure from the mathematical point of view.

Not a lawyer, but the Burr case seems to imply that the secretary could be compelled by court to translate the cipher (literally decipher) the letter, provided in doing so he was not going to incriminate himself.

If translating a cipher and decrypting a drive is held equivalent, then the subject of this article is likely protected, irrespective of how reprehensible the alleged crime is...

ommunist• 9 years ago

Humanity is really close to produce tech that quite literally reads minds. Since those are not easily encrypted, what prosecution awaits judges so much obsessed with illicit topics, like the one discussed in this article? Either we'll have an orwellian "thoughtcrime" to become reality, or we change the legal system. For the moment, it is obvious that American legal system and basic information technology are quite different worlds.

jwatte2• 9 years ago

"My hard drive contains only the finest random bytes. There is nothing to decrypt. Please prosecute me for lying if you can prove otherwise."

Jillboy• 9 years ago

I'm assuming when they boot up (their copy of) the hard drive, it prompts for a passphrase, and if you type an incorrect one it'll tell that it's incorrect (as opposed to simply outputting garbage). That's the most common case anyway.

If that's the case, and it likely is, then that's pretty concrete proof that there IS something to decrypt.

edit: Actually, the article says that the hard drive was encrypt with Apple's FireVault, so there you go.

payne92• 9 years ago

If he were being forced to divulge the physical coordinates of a hidden thumb drive, it's highly likely he'd get Fifth Amendment protection.

But being forced to divulge the virtual coordinates of his hidden data is somehow different...

thescriptkiddie• 9 years ago

I like that metaphor. Encrypting data isn't so much like locking it in a safe as it is hiding it somewhere in the key space. The safe metaphor breaks down because you can drill a hole in the safe to see if there is anything inside. But you can't prove that some encrypted data exists any more than you can prove that a particular item is sitting around somewhere on Earth.

megous• 9 years ago

Why don't they sue him based on what they already have. They have to have something strong enough to justify holding him for more than a year already, so wtf?

cdevs2• 9 years ago

We should jail oj until he tells us he did it?

cdevs2• 9 years ago

We need John ham in that black mirror Christmas episode..

ioquatix• 9 years ago

Good to know that File Vault actually works.

dwaltrip• 9 years ago

I have a related, seemingly analogous situation that I'm curious about.

If a suspect might have physically buried important evidence hundreds of miles of way in the middle of nowhere, such that it is effectively impossible to find, can the courts "compell" the suspect to give up any knowledge of this, in a similar fashion as the man in the article?

anigbrowl• 9 years ago

No. But proximity carries a great deal of weight for purely practical reasons - when you already know you have the goods then it's maddening to not know how to access them.

Not an endorsement of the reasons for the guy's drive being impounded, which I'm ignoring completely for this example.

realo• 9 years ago

I have a question...

Suppose the suspect Alice only has a portion of the key. Someone else (Bob...) has the remaining key bits.

Alice is busted, and 'compelled to give the key', and DOES provide her portion of the key.

Bob is never found.

Then Alice would be indefinitely imprisoned, even if she would have actually complied with the court order.

It seems unethical, to me.

Bonus question: Alice pretends that Bob exists, but actually he does not, but police cannot prove that. What then?

A possible answer to the first question: Alice is not compelled to provide the key. She is compelled to decrypt the drive. Obviously she can't do that without Bob. Alice is screwed and will spend the rest of her life in prison.

Seems harsh.

saycheese• 9 years ago

Using the same two-key method, attorney–client privilege might be of use, though not sure:

https://en.wikipedia.org/wiki/Attorney–client_privilege

gresrun• 9 years ago

IANAL, but it would fail to meet the basic criteria, as the communication was not for the purpose of securing legal advice and, the prosecution would argue, the communication was made for the purpose of committing a crime.

externalreality4• 9 years ago

Doesn't this boil down to the "I am willing but unable" situation? The man in this case was the "unwilling but able" situation. My question is wouldn't the man be shifted into the former situation if he just claimed to be now willing but to have forgotten his keys.

Filligree• 9 years ago

He did claim he'd forgotten the keys. Maybe he changed his mind on that later, but I haven't seen any statement of the sort.

branchless• 9 years ago

The one bright spot is this leads me to hope they can't decrypt at will via some non-public method.

zik• 9 years ago

Not just unethical. Illegal. Indefinite detention without charge is against the law.

adventured• 9 years ago

What's the current status on §§ 1021-1022 from the 2012 NDAA bill? [1] Did that become law as it was written, and is it still active? It made provisions for the US military to indefinitely detain US citizens without due process. I've found these things difficult to keep track of frankly, with so many egregious laws from just the last ten years.

[1] https://www.aclu.org/news/president-obama-signs-indefinite-d...

libertymcateer5• 9 years ago

A possible answer to the first question: Alice is not compelled to provide the key. She is compelled to decrypt the drive. Obviously she can't do that without Bob. Alice is screwed and will spend the rest of her life in prison.

Yes, and in this scenario she would not be held in contempt, so your hypothetical does not apply.

You can only be held in contempt for refusing to comply with court orders, not for the failure of a desired outcome.

Let's put it another way: you are totally misunderstanding why this fellow is in jail. It is not because the hard drive remains encrypted - it is because he defied a court order to decrypt it. Granted, if the drive were decrypted by other means he would likely be let out of prison because the point of holding him for contempt would be frustrated - but that does not mean that he was put into jail because the drive was not decrypted. Contempt is solely about defying court orders.

If Alice gave over her half of the key, she would have complied with the order, therefore, there would be no grounds for contempt.

dangerlibrary• 9 years ago

From the article: "Rawls, the government argues, (PDF) "repeatedly asserts that the All Writs Act order requires him to divulge his passcodes, but he is incorrect: the order requires no testimony from [Rawls], and he may keep his passcodes to himself. Instead, the order requires only that [Rawls] produce his computer and hard drives in an unencrypted state.""

cwilkes• 9 years ago

How far can court orders go? Let's say he was a crooked accountant and the police couldn't understand his spreadsheet. Is he obligated to show him what he was doing?

To me this is what the disk encryption is like. The cops can't understand how to read the disk. Is he obligated to help them? What if the pictures in there are encoded using a weird format? Should he be forced to produce a program to read them?

ArchD• 9 years ago

There's no observable difference between inability to produce a result and refusing to produce a result. How do they know he didn't just forget the password? Or that the password was recorded somewhere that he no longer has access to? After sitting in jail for many months, it is very easy to forget a password that you no longer use regularly.

elif• 9 years ago

I wonder if he had an encryption scheme that deleted the data in the event of n password failures and also something of legal value like bitcoins on the drive. Perhaps, then he could argue that knowingly attempting to log in using potentially incorrect passwords constitutes undue harm.

0x445442• 9 years ago

What if the fellow made a sworn statement he doesn't remember his credentials? It happens to me on a regular basis.

IIRC, the I don't recall defense has worked wonders for others in the past.

belorn• 9 years ago

I co-authored a project that works on Debian that do unattended reboots of encrypted disk drives which allows for scenarios where Alice don't know any part of the key. Every time the machine boots up bob get a request on the network and he can chose to approve or deny. Bob in turn could be in a different country which would make coercion a bit hard.

(Project called Mandos)

dijit• 9 years ago

I think I remember you giving a talk about this at SmashTheStack in Malmo, Sweden.

I believe I asked then about maybe having support for non-debian systems and eventually something like Windows in the distant future.. What kind of support would you need for it to be worthwhile investing in that?

MertsA5• 9 years ago

Alice pretends that Bob exists, but actually he does not, but police cannot prove that. What then?

Well it's pretty obvious what happens then. The police claim Alice is lying and hold her in contempt indefinitely. The man from the article claims that he doesn't remember the passwords anymore and can't possibly comply, he's still being held in contempt even though there's nothing concrete to show that he still knows the password.

elcct• 9 years ago

Alice has created a file containing random data. Authorities think it is an encrypted volume and wants Alice to give up the key. Alice has no way to prove it is just a file with random data and is imprisoned indefinitely for essentially having a file with random data =]

triplesec• 9 years ago

Alice is able to switch the tracks on a trolley hurtling towards the encrypted only copy of the rest of her key towards a track where Clive, the only person who knows the key to that secondary encryption, is tied...

amelius3• 9 years ago

So typing the simple command

    cat /dev/random > filename

can actually get you imprisoned. Good to know.

heptathorp• 9 years ago

Mallory has created a file containing random data and planted it on Alice's drive. Then Mallory phones in an anonymous tip to the police...

pdpi2• 9 years ago

Interesting thought experiment, but ultimately flawed. For this to make any sense, you first need to answer a question: Why are the authorities looking at Alice's computer in the first place?

Also, it's extrapolating a lot from a case that's actually a fair bit less sinister than what you're suggestion. Facts of this particular case here are that:

  1. The guy was a suspect to begin with, and they had
     enough evidence of him doing something wrong (from
     the Usenet side of the operation) that they got a
     warrant to search his computer.
  2. The disks are encrypted with off-the-shelf OS-provided
     full-disk encryption, which is relatively easy to verify,
     rather than some "purely random data that might or might
     not be encrypted".
  3. At no point has he denied having access to the keys (at
     which point it would essentially stop being a 5th amendment
     case).

Now, I'm actually of the opinion that he should _not_ have to decrypt those disks, but that's strictly a fifth amendment thing, rather than the more convoluted scenario you're suggesting.

amelius3• 9 years ago

Alice can also just embed the message into the noise of a JPEG file. A noisy image can be used for plausible deniability.

amelius3• 9 years ago

Or Alice can just claim that the random file is the key to another encrypted file :)

Zikes• 9 years ago

Is the ACLU not at all involved in this case? Shouldn't they be?

TheBobinator• 9 years ago

There's a burden of proof here the court needs to meet before holding the defendant in contempt.

For starters, it's reasonable to assume the defendant owns the hard drives in question if they're in their possession, irregardless of their testimony otherwise.

Given that piece of information:

1: The court has to prove the disks are actually encrypted. It is not merely enough for the cops to pick up the disks, see some garbled data, and determine it's encrypted. Now if you're using a file level encryption protocol that leaves enough un-encrypted stuff on disk that you can identify the filesystem and the file encryption, then you've met the requirement. If you are using full disk encryption, especially something designed to hide the data and filesystem from anything but a forensics package and even a forensics package see's garble, then there's effectively no way to tell the disk is actually encrypted or with what.

AND

2: They have to prove the defendant, at some point, had the encryption key. That requires proving the method of encryption and key generation. With a door lock, you know there's a key. With a safe combo, you know the combo could be 12 digits and broken up between a dozen people. With an encryption system, any combination of things you know, are, or have could be part of the key. Compelling the defendant to reveal all of that is absolutely a violation of their 5th amendment rights.

Example:

Lets assume we're using windows EFS. Lets further assume analysis of EFS indicates the user named "YOU" owns the account. Furthermore, lets assume there are files that have date modified dates within the end users folder that indicate they had logged in the day prior to the search warrant being served.

You give the court the "I don't remember" line.

In that case, forgetting the password is destruction of evidence, not contempt. If a key escrow is used and they can prove it, same deal, destruction of evidence.

GTP2• 9 years ago

With an encryption system, any combination of things you know, are, or have could be part of the key. Compelling the defendant to reveal all of that is absolutely a violation of their 5th amendment rights.

In the article is stated that he could actually compel to the order by decrypting himself the hard drive without telling the key to anyone. Could you please read my other comment about this topic? I need further explanation about the legal basis for a different behavior when is involved a physical key or a combination.

ZoFreX2• 9 years ago

It's encrypted with FileVault, so #1 is satisifed. I suspect #2 is as well (I'm guessing using FV leaves "tracks" on the computer?).

Also, compelling them to decrypt doesn't necessarily mean compelling them to hand over the key.

Esau• 9 years ago

To me, this is incredibly perverse: no one should be forced to assist the government in their own prosecution.

keithnz• 9 years ago

Seems to me the 5th should protect him. Question is, is that a good thing?

Should law enforcement have a right to search through court orders? In a world of unbreakable locks it seems very hard to get justice unless the law can do proper searches. If we end up in a world of unbreakable encryption everywhere, seems to me, criminal activity will have huge benefits. If we can't control crime, we can't have a just society. We can't protect a individuals rights if they are undermined by criminals. Of course, it's also hard if the state has too much power to protect and individuals rights. But somewhere we need pragmatic compromises.

9mit3t2m9h9a3• 9 years ago

If the only trace a criminal activity leaves is on a single encrypted drive, is it important if it gets prosecuted or not?

The police does parallel construction to avoid admitting access to illegally collected evidence, civil forfeiture to punish people for things police doesn't like without having to prove anything, etc — incentives for police to step over the rules are a larger problem than unbreakable encryption right now.

orbitingpluto• 9 years ago

I have problems remembering a password if I don't use it for a month or two. After 16 months, I'd probably have no idea.

upofadown• 9 years ago

"...Instead, the order requires only that [Rawls] produce his computer and hard drives in an unencrypted state."

This language makes it sound like the government is specifically asking the defendant to take an affirmative action to produce the evidence required to incriminate himself. That would be the same thing as issuing an order with the intent to compel an accused murder to tell the police where the body is. I really don't understand how a court could issue an order based on such an argument.

krick3• 9 years ago

Just yesterday [0] someone (multiple people, actually) was claiming fingerprint locking on phones is unsafe based on fact the 5th amendment doesn't protect your fingerprints, but does protect your right to not reveal your password.

[0] https://news.ycombinator.com/item?id=13622684

victor9000• 9 years ago

It seems like the state is holding the accused captive for failure to produce unencrypted hard drives. But how can the state prove that the accused has the ability to fulfill this request?

Miner49er• 9 years ago

They can't. He told them he doesn't know the keys for the drives, and the judge doesn't believe him.

downandout• 9 years ago

I'm curious why he doesn't just claim that he forgot the key. There's no way to prove conclusively that he's lying, and a judge cannot jail someone for disobeying a court order that they have no way of obeying. If he's told them he knows it and just won't give it to them, then this bridge is probably burned, but it's probably his only shot. Absent a ruling from the Supreme Court on this issue, they can and will hold him until he complies, dies, or has already served the maximum possible sentence for the crimes he is suspected of committing.

fred_is_fred• 9 years ago

Don't doubt that a judge can't or won't hold you indefinitely if they think you are lying. This guy was held for 14 years because the judge was convinced he was hiding assets in a civil case (divorce):

https://en.wikipedia.org/wiki/H._Beatty_Chadwick

I mention this because there are parallels. In each case the man would say "I don't have the (key|money)" and in each case the judge can effectively sentence them to indefinite jail.

m-j-fox• 9 years ago

My idea is to just hand over the password, which is 'asdf'. If the password fails it's because whoever is in possession of the computer has already logged on and changed the password -- no longer my responsibility.

hysan3• 9 years ago

What happens if the drives develop bit rot over those 16 months preventing them from ever being decrypted? Based on the wording of what he is in contempt of, it sounds like he would sit in jail until death. To me, it sounds like the prosecution is trying to play a word game to get around 5th amendment protections.

digler9994• 9 years ago

investigators image drives, they dont work with the originals.

hysan3• 9 years ago

I know that, but read the exact wording they used to define why he is in contempt and what he has to do. That's the important part.

But I'll play along with your pedantic game. First, the wording says to give over his computer and hard drives. What if those hard drives failed? He can't handover the literal hard drives anymore.

Ok, you say it can be any hard drive then. The court will provide replacements and the disk images. If investigators providing those materials is allowed as a means to allow Rawls to complete said task, that means Rawls is allowed access to materials the court (or prosecution or him or some other entity) deems necessary. Not a big deal, right? Wrong. Going down that rabbit hole can lead to a slippery slope where courts can abuse the power of the wording to indefinitely contain anyone given that they assign them a task that "can" be completed with the given materials. However, the feasibility of the task may or may not be reasonable.

It's the twisting of the law through evasive language that is the problem here. They are deliberately avoiding the 5th Amendment by deploying language that skirts the letter of the law and ignores the intention/spirit of it.

INTPenis• 9 years ago

Speaking from experience of 1 month vacation I'm not sure I'd be able to decrypt after 16 months of not touching a keyboard.

My most important passwords (passphrases for gpg used by password managers and luks) are in my head and muscle memory.

When I update passwords I tend to have them written down until I've typed them enough times.

So after a months vacation I often struggle to remember my work password for example. While using phrases makes all this easier these days, 16 months is a long time to presumably spend without your keyboard.

yellowapple• 9 years ago

"The authorities say it's a 'foregone conclusion' that illicit porn is on those drives. But they cannot know for sure unless Rawls hands them the alleged evidence that is encrypted with Apple's standard FileVault software."

Then it ain't a "foregone conclusion". If it was, they wouldn't need him to unlock the drives; they could prosecute him with the evidence they used to arrive upon that "foregone conclusion".

GTP2• 9 years ago

I don't reside in the USA and I don't know the US law. After reading a certain amount of comments seems that the heart of the discussion is the fifth emendament. I agree that if the 5th emendament protects you from giving the combination of a safe logically follows that the same applies for encription passwords. But I don't agree with the root of this argumentation: if a court has a valid reason to think that a safe contains evidence that is relevant for the lawsuit, why should make any difference if the safe is locked with a physical key or with a combination? Somebody who has a different opinion could please explain me his point?

Zelmor• 9 years ago

Here we have an example of a forceful, totalitarian state. Where they cannot keep up their laws due to technological progress, they threaten you with violence and boredom (boredom as in sitting in a cage as long as you refuse to comply). In communist era Eastern Europe, secret police used to send in beautiful prostitutes and/or agents to deal with people held in captivity. Get a man to erect his penis. When that happened, strong men stormed the room, grabbed the victim, and inserted a glass rod into his penis. Then smashed it. I would not like to go into details on what they did to women. You can look that up.

Land of the Free - as long as you do not encrypt your shit, that is

mtgx• 9 years ago

Remember when Obama passed the law that allows for indefinite detention without charge? And how his supporters said "Yeah, but it's not like he would use it"?

I think it's already used all the time across the country now. A law that "is not supposed to be used" should not exist. If it exists, then it will be used. I'm sure this is some kind of Murphy law or something.

sjy10• 9 years ago

This case is about a federal statute that dates back to 1789.

ohstopitu• 9 years ago

We seriously need self destructing time based keys.

Once a device does not have a password in a time defined by the user - all of it is wiped.

It goes without saying that this should be off by default but definitely a good feature.

iUsedToCode• 9 years ago

Police could just make a backup of a snapshot.

smokedoutraider• 9 years ago

Are we just ignoring that he is a pedo, and likely has incriminating garbage on his laptop?

digler9994• 9 years ago

what's being ignored is the constitution. which is an even more grave injustice than child abuse.

stillsut2• 9 years ago

I really hate to be writing this but it seems like the only solution...

Doesn't this whole situation and the threat thereof go away for 99.9% of the population if we decriminalize possession / "viewing" of child pornography? [Note: you could still be severely prosecuted for making it]

There doesn't appear to be anything else in the digital realm that can get you in such legal trouble. The only other thing I could think of is national defense espionage, or rogue WMD plans. And on these counts, 99.9% of people are going to be very difficult to put a plausible frame job for these crimes. Sure the 0.1% with security clearance could be framed here, but as far as I understand, that's a personal decision and risk each person go to make for themselves.

If you deny the prosecution the ability to use reasonable suspicion of CP to search, or compel a decryption of your digital files, it's going to be a long time before another case like this.

sean22• 9 years ago

No, plenty of other stuff is illegal; just off the top of my head: Possession of copy-righted material Possession of hacking tools Evidence of hacking Data from corporate espionage Accounting fraud Fraud (e.g. fake credit info) Evidence of other crimes (e.g. account books of drug deals) Plans to commit other crimes

The list goes on. It just so happens the FBI is obsessed with CP, but if you decriminalize that, we'll have the same problems with other crimes.

stillsut2• 9 years ago

This is a helpful brainstorm. But let me explain why I think these are far less worrisome.

Take corporate espionage: sure proprietary files from my employer could end up on hard-drive. But that would mean the FBI is willing to in addition to frame me, pay someone to go in and steal from my company. That's the type of thing that get's someone's boss's boss canned.

Do you see how high the conspiracy is going here? And do you know how messy this type of action gets when you need all these different nefarious actors executing FrontPageHeadline news if caught.

As far as the Drugs.xls, or the MobsterAccountPayable.xls, there already exists much legal room to disqualify a one-off document, without some kind of physical evidence - e.g. a guy wearing a wire says "Hears the money to pay Tony the Muscle" and you say "cool" or the guy who runs a storage facility says thats the guy who came in two months ago and rented that locker where the drugs were found. That's why the police are so obsessed with getting these type non-digital evidence: because a conviction on pure digital grounds is almost impossible with a halfway decent lawyer.

The thing about CP it doesn't have to be congruent with any other aspect of your life or be verified by anything physical or any witness. Even the motive/rationale is he had disturbing sexual impulses deep in his heart and its common sense that he wouldn't revel these to anyone so let's just assume he does.

data4science• 9 years ago

So much for my plan to:

1. Reformat a hard drive with DBAN

2. Name the new drive: the_art_of_the_deal_2_from_future

3. Start a LLC named Marty McFly

4. Mail said drive from said entity to the White House

Man jailed 16 months, and counting, for refusing to decrypt hard drives

Related Stories