Judge: Child porn suspect doesn't need to decrypt files today

http://news.cnet.com/8301-13578_3-57587670-38/judge-child-porn-suspect-doesnt-need-to-decrypt-files/

by ars • 13 years ago

71 60 13 years ago

news.cnet.com

BuschnicK• 13 years ago

How do hidden volumes, as for example TrueCrypt provides them, play into this? If the defendant doesn't give them up voluntarily the prosecution will have a hard time proving they exist, no?

Also, if they do find evidence for their existence - does the defendant then have to give them up?

dalore• 13 years ago

If they don't have to decrypt known encrypted contents why would they have to give up unknown encrypted contents?

fuzzbang5• 13 years ago

It is not that difficult to prove that a hidden volume exists. The TrueCrypt implementation of hidden volumes means that the "hidden" partition is all allocated at the end of the visible partition. If you have a 20G TC volume with a 4G hidden volume, the file system in the non-hidden volume will never allocate a block beyond 16G. This shows up as very anomalous file system layouts at the block level. Simple visualization of the block allocations will show a clear delineation where the hidden partition starts. The TC implementation of hidden volumes is definitely not robust as plausible deniablility.

The police forensics investigators know to look for this already. It is in their recommended best practices for how to handle TrueCrypt volumes.

The safest way to use a TrueCrypt hidden volume is:

  * Create the largest regular volume that you can. 
  * Create the smallest hidden volume that you can.
  * Never mount the hidden volume as "protected"

The idea is that your sparsely populated cover volume won't create enough block allocations to have an obvious "end", and additionally, that those blocks will have a low likelihood of being allocated inside your hidden volume and overwriting your secret data.

simias• 13 years ago

I think the point of TrueCrypt is simply "plausible deniability". They can suspect with a very high degree of confidence that there's an hidden volume, but how do they prove it?

biff2• 13 years ago

That's how it does hidden volumes huh? I always thought it was something sneakier, like flag a handful of files that exist in the regular volume for it to build its hidden volume out of.

venomsnake• 13 years ago

Well ... a normal PC can have up to 10-12 TB of storage these days . It is more than normal for 1 or 2 to be left empty. You just create the hidden volume there.

hackinthebochs2• 13 years ago

I'm pretty sure this isn't true. You cannot prove the hidden volume exists. In fact hidden volumes are completely useless without plausible deniability. The file system of the outer volume will happily overwrite your hidden volume if you tell it to. The point is that you know its there so you intentionally don't write more than 16G on your 20G volume. But the "unused" space looks just like random data so you can't prove there is anything meaningful there.

300bps2• 13 years ago

This would not be the best argument. It's possible to prove you're lying. If on the other hand you merely state you forgot the password, it's impossible to prove you're lying.

lambda• 13 years ago

Hidden volumes aren't all that great for hiding porn. Generally, porn takes up a large amount of space. Hidden volumes are great for hiding a small amount of data (passwords, launch codes, bank statements, etc) among a large amount; not so great for hiding a large amount of data.

akama• 13 years ago

Although I have feelings about how I would like the case to be decided, I suspect that it will be precedence in 10 years to be forced to hand over passwords. I see the similarities that it has with a safe, the only difference being that you can memorize the key. You are not actually admitting to wrongdoing when saying the key, so it might not even be covered under the fifth amendment.

300bps2• 13 years ago

With a safe, the government can defeat the protecion by cutting or drilling into it.

The proper analogy is that the government is welcome to get a warrant and attempt to break the protection provided by encryption. Since the defendant in a criminal case has an absolute right to remain silent they cannot force them to speak or otherwise convey any information that might incriminate them.

If the government cannot break the encryption then that is an unfortunate side effect of preserving people's rights.

rayiner2• 13 years ago

1) With a warrant the government doesn't have to break the safe--the court can compel you to hand over a key.

2) In the U.S., there is no "absolute right to remain silent." The 5th amendment says: "No person shall be... compelled in any criminal case to be a witness against himself." This is a somewhat narrower protection. For example, someone can be compelled to give authorization to a third party to search property of the defendant in the possession of the third party.

How the 5th applies to encrypted volumes is still up in the air. On one hand, reciting a key could be seen as testimonial speech. On the other hand, it could be seen as analogous to handing over the key to a safe, which is not considered testimonial speech subject to the 5th amendment.

josscrowcroft• 13 years ago

Blackstone said "It is better that ten guilty men go free than that one innocent man be convicted."

I'd say that applies..

biff2• 13 years ago

It doesn't strike me as a good road to go down to require judges to guess as to whether or not a defendant is being honest about whether or not he or she can remember a password on an encrypted volume.

Especially considering that it's possible to be wrong about a volume being encrypted.

kijin• 13 years ago

I don't think the defendant is claiming to have forgotten the password in this case.

Nonetheless, I agree with you that every once in a while, FBI would seize a hard drive that is (a) not encrypted but filled with random-looking bytes, or (b) encrypted but the owner has forgotten the password.

When I sell a used hard drive, I usually fill it with random data. Sometimes I do this by creating a TrueCrypt volume that takes up the entire drive. (This destroys all the data on every partition, as well as the MBR, so the drive appears unformatted to the buyer.) But suppose the FBI suspects me of downloading CP and buys my drive as part of a sting operation. They'll think my drive contains CP. After all, it has the typical signature of a TrueCrypt volume! But guess what, I wasn't intending to store anything on that drive, so I threw away the password as soon as I typed it into TrueCrypt. How do you prove that I cannot possibly remember the password? With a physical safe, at least it's possible to prove that I don't have the key in my possession.

alan_cx• 13 years ago

"With a physical safe, at least it's possible to prove that I don't have the key in my possession."

Immediate, on the person, maybe. But you cant prove you cant get hold of it. That's the old proving a negative thing.

In fact, even if they search you, all it proves is that they didn't find it, not that you don't have it.

When governments start expecting us to prove we didn't do or don't have something, you might as well give up. Its a line no one should be able to cross, not least governments.

fosap• 13 years ago

>After all, it has the typical signature of a TrueCrypt volume!

TC tries to avoid a "typical signature". TC volumes do not have any header. The only signature is high entropy.

stuckintraffic• 13 years ago

This is exactly what worries me, especially if the government legislates this and makes the do-you-remember issue an affirmative defense, which shifts the burden of proof onto the defendant. I recently forgot the very complicated passphrase I used on a months-old encrypted USB thumb drive. And I'm a doctor (implying that I should generally be good at remembering stuff).

In many criminal cases, months or years pass between evidence seizure and the criminal trial. Seems very easy to forget the decryption key. Or not have access to the 2-factor token anymore. Lot's of edge cases with very serious side effects.

mhurron• 13 years ago

Wouldn't exercising your 5th amendment rights remove the need for you to lie about not remembering?

rlx0x• 13 years ago

Sounds like a great Idea, the court can imprison for contempt indefinitely, is there a limit? I don't think so. That sounds like a great way to get rid of someone, just write a luks header somewhere on his harddrive and call the cops. He will die in prison. Then again the US courts have probably killed thousands of innocents. At least there is no death penalty for contempt of court (yet).

contingencies• 13 years ago

The grim reality facing our country today is one where we currently have a percentage of our population behind bars that surpasses even the heights of the gulags in Stalinist Russia

Best quote.

sageikosa• 13 years ago

To be fair to Stalinist Russia, the mortality rate tended to keep the Gulag population down.

talmand2• 13 years ago

The guards usually didn't have it much better as well.

vaadu• 13 years ago

No one should be compelled to help prosecute themselves.

millerm• 13 years ago

It's not that no one "should" be compelled. The constitution states that no one "can" be compelled. Huge difference. "Should" implies choice. There is no choice here. I hope the court sees this as a circumstance where the person is being compelled to be a witness against himself. I like laws that protect individual citizens (and I mean actual living, breathing entities and not that BS 'businesses are people, my friend').

So, I agree with you... Just a bit more firm and by the book. :-)

rayiner2• 13 years ago

Says who? The historical practice, at least in the U.S., allows for some level of compulsion to help the prosecution. For example, there are cases (in connection with fraud and tax avoidance) holding that defendants can be forced to give written authorization to overseas banks to release financial records to prosecuting authorities.

AdrianRossouw• 13 years ago

"Banner said agents did find evidence that suggested Feldman was using a peer-to-peer program called eMule to exchange files with titles suggestive of child pornography."

Someone paranoid enough to encrypt 20tb worth of hard drives is dumb enough to use eMule to transfer highly illicit material?

Unless of course it was emule over something like Tor or I2P, which I wasn't even aware worked. If that was the case, I'm more curious about how they tracked him to his actual IP through those services, than the actual drives.

Was it the same way they got that anonymous hacker a few months back, where they camped outside his place and sniffed his wifi for the packets to start flying?

Judge: Child porn suspect doesn't need to decrypt files today

Related Stories