Teenager jailed for refusing to hand over computer password

http://www.itworld.com/legal/123153/teenager-jailed-refusing-hand-over-computer-password

by kgermino • 16 years ago

57 66 16 years ago

>> originally arrested for another alleged offence last May. It would be interesting to know the nature of this crime. Was it technology related, or was the computer ceased for less direct relationship with the crime?

moxiemk1• 16 years ago

I don't know if a law compelling you to reveal encryption keys to the government/police/courts is valid in the UK.

I do, however, know that such a law is morally reprehensible. Quite frankly, it is in the interest of the people to ensure encryption tools are entirely useable by criminals, gangsters, and terrorists, because that ensures they are entirely useable by lawful citizens as well.

Unlike guns (something possible to "defend liberty" as well as commit crime with), encryption has no victims, has no negative consequences. It can hide negative things, but it merely provides automation for knowing something you refuse to tell.

Edit: spelling

citricsquid• 16 years ago

Let's say I have a hard drive full of illegal material, the police suspect it and have enough evidence to obtain a warrant, should I not then be obligated to show the contents of the hard drive? Much like a warrant for a home or business premises, why should it not be enforceable for digital things too?

lutorm• 16 years ago

But if you've written notes in your notebook that are comprehensible only to you, should you be compelled to explain to the authorities what they mean?

gst• 16 years ago

"Much like a warrant for a home or business premises, why should it not be enforceable for digital things too?"

In most (democratic) countries you do not have to cooperate with the police if they have a warrant. So they are allowed to search your house, they are allowed to break your lock/door, but you are not obligated to give them the key to your house.

It's already the same with digital things: The police can get a warrant and is then allowed to try to crack my password. But I'm not obligated to give them the key.

oiuhjygtfghjnmk4• 16 years ago

Because it's more like the police being given a warrant for you to tell them everything you know.

In most countries the police don't get a search warrant for your head - except where you are wearing an orange jumpsuit and having water poured down your throat.

ax0n4• 16 years ago

It is valid, and it is morally reprehensible. In the US, the Fifth Amendment protects us from such travesties.

oiuhjygtfghjnmk4• 16 years ago

Assuming your congressman visits you while you are being secretly held in a Syrian prison

gunzler• 16 years ago

Has there been a case where the Fifth Amendment protected someone from disclosing a password? I'm not sure that giving up your password is analogous to being forced to testify against yourself.

Edit: Indeed there has been a case, and so far the Fifth Amendment is holding strong: http://cyb3rcrim3.blogspot.com/2010/04/passwords-and-5th-ame...

aplusbi6• 16 years ago

Not necessarily. For example, let's say I have a safe, and I've hidden the key. The police get a warrant to search my safe. I am then legally obligated to allow them to search my safe, which means that I am legally obligated to reveal the location of the key.

In the case of the safe, if I refuse they'll just break it open. Strong encryption is not so easily broken so it may not be in my best interest to cooperate (whereas with the safe, it probably is).

Personally I think encryption passwords should be protected by the 5th amendment, but I understand the logic in saying it's not.

smokeyj• 16 years ago

"It can hide negative things, but it merely provides automation for knowing something you refuse to tell."

Encryption doesn't hide negative things, people hide negative things. Almost like guns don't kill people, people do.

eru2• 16 years ago

Bullets do.

jws2• 16 years ago

✓ Old story (October 6th).

✓ Original article omits context.

✓ US Constitution does not cover the British.

✓ Already covered. http://news.ycombinator.com/item?id=1760700

No discussion required.

jws2• 16 years ago

Downvotes, what on earth for? Is it the checkmarks?

Edit: not meaning to complain, I was trying to sort out if it was the Unicode, the tone, the list format, or the "no need to discuss" which is probably a bit rude.

I was hoping to make a quickly read mark that would let people know HN had already been over this ground and there was nothing new in the article, but I failed miserably.

robg• 16 years ago

It's worse to complain. Just point to the original thread and everyone will be happy.

talbina• 16 years ago

Word War II:

✓ Old story (September 1, 1939).

✓ Thousands of articles likely omitting full context.

✓ US Constitution does not cover the British.

✓ Already covered. http://news.ycombinator.com/item?id=1507526

No discussion required.

eru2• 16 years ago

I agree without irony.

marze2• 16 years ago

It is an ongoing story, the man is still imprisoned.

If he had been released and nothing further had happened, maybe you could say "No discussion required".

gstar• 16 years ago

If Moore's Law keeps working, this is a ticking time bomb for him. If the police stay interested and crack his crypto, he'll do more time for whatever he's concealed on his computer (if anything).

ax0n4• 16 years ago

As MC Frontalot raps: "You can't hide secrets from the future with math."

sp4rki7• 16 years ago

Who knows what he does have in that hard drive. Maybe 4 months in prison is significantly better to what might happen if they do get to his data. Hell 4 months in jail because he refused to give a password sounds a lot better than a sexual offender conviction for 4 years.

In any case, if I was him I wouldn't worry about them decrypting the data in my lifetime. Do you know how many millions of years would it take to decrypt a 50 random char pass phrase decent encryption. Lots of those. So unless there is a breakthrough on computing power several magnitudes bigger than what we have experienced and the money to dedicate millions of computers to the cause, or someone finds a loophole in the encryption algorithm (highly unlikely if using any type of military grade encryption), his data won't be decrypted.

proexploit• 16 years ago

And yet, I'm surprised by technological advancement every day. If you'd asked me several years ago if I thought we'd have artificial limbs controlled by thoughts, I'd have said it was far far away.

It's a race between the statute of limitations and encryption/computing technology. (I do agree it seems unlikely).

kgo2• 16 years ago

Back-of-the-envelope math:

50 characters x 8 bits = 400 bits of entropy

Even if you account for not having backspaces and linfeeds in the password, he could still easily have 256 bits of entropy.

Even with Moore's law, a strong algo like AES-256 is generally considered to be uncrackable, assuming the algorithm and the implementation don't have any flaws.

marcusbooster• 16 years ago

The crypto doesn't have to outlast his lifetime, only the statute of limitations for the alleged crime.

RiderOfGiraffes2• 16 years ago

Same story from three weeks ago with many, many comments.

http://news.ycombinator.com/item?id=1760700

It's very likely that any comments here will cover the same ground, so if you're interested in might be worth reading the comments there first.

marze2• 16 years ago

Three weeks later and this fast food worker is still in jail. I guess in the UK there is no "innocent until proven guilty" and that's why some left to form the USA a while back. This story couldn't occur in the USA.

RiderOfGiraffes2• 16 years ago

I'm not going to argue the rights and wrongs of the law, that's a different question. What is certainly true is that he has broken the law regarding providing the password when requested to do so by officers of the law following due process.

I repeat that I'm not arguing that the law is right. I'm merely pointing out that he is not innocent of the charges for which he is imprisoned.

I'm also pretty sure there are similar or analogous breaches of what one might call natural justice in the USA - I'm sure someone can provide examples.

evgen• 16 years ago

This story couldn't occur in the USA.

Actually it can and does. If a judge compels you to turn over your password as a part of the discovery process and you refuse then you can be served with a contempt warrant and go straight to jail without trial and with limited possibility to appeal.

kgermino• 16 years ago

My bad. I should have searched first. Thanks for pointing it out.

eiji• 16 years ago

This brings up an idea for TrueCrypt.

Why not have two passwords: "foo" and "bar".

If I type in "foo", I get my stuff. If I type in "bar", it may selfdestruct the data, but at least it will show a different content.

So I create a 100GB container, and reserve 10GB as dummy content, maybe 1 mio. copies of the constitution, which will show up with "bar" as password. So I have a password for the police, and everybody is happy.

kgo2• 16 years ago

Already in there...

I think they call them shadow volumes...

yummyfajitas• 16 years ago

http://www.truecrypt.org/hiddenvolume

dot-sean• 16 years ago

I think the point here is that this Teenager thinks that the punishment for not handing over the password can't be as long as the punishment for proving a crime using the evidence stored on his harddrive. I didn't go to the link, but from what I remember, he's accused of possessing child porn. In US, it would be as easy as saying, I've been under so much duress because of all this, that I forgot what the key is and where I kept it. I mean, they can't keep him locked up forever, right.

Dylanlacey• 16 years ago

And that's the magic phrase right there. Along with "Terrorism", "Drugs" and "Rape", "Child Porn" is a bogeyman which many people feel justifies a reduction in rights of a serious nature.

Are they right? Well, that's not something I'm going to speculate on, but I believe the judicial system will push as hard as people expect/will permit them too. If the encrypted data was stolen e-books, I doubt they'd be so very harsh.

I think it's bollucks, however. I think you should have no punishment for refusing to help convict yourself, regardless of what you may have done.

olegkikin• 16 years ago

1) Plant an encrypted file on somebody's computer.

2) Call the police.

3) ???

jinushaun• 16 years ago

Doesn't sound like much of a story. He's jailed for obstruction of justice. His password was requested because he was already arrested and under investigation for something else. The fact that it's a computer password doesn't make this a 21st century "Big Brother" issue.

dotBen3• 16 years ago

A few random thoughts:

1) While it is true to say you are protected under First and Fifth Amendment rights from having to disclose a password here in the US, it doesn't cover border inspections (including airport custom/immigration, where it is considered you are in 'no mans land'). The legal issues of this are currently going through the courts based around the number of people who have had their laptops searched (passwords are requested at the time of the search if necessary). But even if this is resolved, it probably will only apply to US Citizens and not visitors.

2) The chap who has gone to prison for not disclosing his password will go back again for another term if he doesn't disclose the password when he is released. Someone mentioned "maybe it's better to server 90 days in prison for not disclosing the password then to be caught with something more incriminating on his hard drive". That is mitigated by the fact that each request is treated separately so he could be in prison indefinitely if he doesn't comply :/

3) I've always thought a great defense would be to have your password something like "gofuckyourself" or "obvious". That way if someone asks you for your password you can say "go fuck yourself" or "dude, it's obvious". When you go to court you can say "no, I fully complied. The password was 'gofuckyourself'"

ojilles• 16 years ago

Some really good PDF on how this works in Europe, the Netherlands and comparisons to US law. (I took me quite some time to find something looking authoritative enough to actually read.)

"If Alice has stored her key on a diskette or a smart card, and if Polly is certain of its existence and Alice’s possession of them, she can summon Alice to deliver it – at least, in the United States she can, and also in European countries, according to the European Court’s decision in Saunders. In the Netherlands, article 107 paragraph 1 DCCP, however, prohibits Polly from commanding delivery from suspects."

Further on (page 11) goes on to state that a key that doesn't exist in the physical plane might be considered admission, and therefore protected. That is unless it is demonstrated that the suspect used the same key (elsewhere) recently -- in which case it's already "admitted" by the suspect and the s/he needs to deliver the key.

http://rechten.uvt.nl/koops/THESIS/cryptocontroversy-ch08.PD...

ax0n4• 16 years ago

If he was using Truecrypt Deniable Filesystem with FDE (and the proper protocols), we wouldn't even be having this conversation.

Teenager jailed for refusing to hand over computer password

Related Stories