But At Least We Don't Live In A Police State

[roo_ster]

Encryption and the Fifth Amendment Right Against Self-Incrimination

http://volokh.com/2012/01/24/encrytion-and-the-fifth-amendment-right-against-self-incrimination/

Who says you can't testify against yourself?  Feral Federal judges, that's who.



Comment:
"Indeed much of the court’s time, as I see it described here and in so many others posts, are exercises in rationalizing doing whatever the *expletive deleted*ck the judge wants to do."

[longeyes]

And they wonder why there are outlaw hackers.  Where things are going is palpable enough.

[zahc]

"I find and conclude that the Fifth Amendment is not implicated by requiring production of the unencrypted contents of the Toshiba Satellite M305 laptop computer,"

The above copied here purely so that we can marvel at its raw, pure nonsense.

 "requiring the production of the unencrypted contents of the Toshiba Satellite M305 laptop computer" :

this
1. assumes the computer belongs to the accused, and requires the accused to essentially admit that
2. assumes the computer has data on it which is cyphertext for some imagined/alleged plain text. There is no way to prove this. If such ciphertext exists, the court is requiring the accused to admit they had knowledge of it.
3. assumes the accused knows the passphrase for said alleged data, even if the accused knows of its presence.

There are probably more I am missing.

The big thing that keeps coming up in these cases is this:

Prosecutors in this case have stressed that they don't actually require the passphrase itself, and today's order appears to permit Fricosu to type it in and unlock the files without anyone looking over her shoulder. They say they want only the decrypted data and are not demanding "the password to the drive, either orally or in written form."

I don't see what they are doing there. They are stressing that they don't require the accused to hand over the (supposedly existent) passphrase, but that they only want the accused to hand over the (supposedly existent) plaintext data. I don't see how this distinction matters. If the court can compel the accused to hand over possibly incriminating (supposedly existent) data, then why couldn't they compel them to hand over the passphrase? How is the alleged passphrase more incriminating than the alleged plaintext? If anything, asking for the plaintext is a harsher demand because it requires the accused to do the (admittedly minimal) work of decrypting the data for the accusers.

I know that courts can compel people to produce documents. But I just don't see how they can get around the fact that they are asking for

--a passphrase which they assume exists, and which they assume the accused knows, but they can't prove either,
--to decrypt plaintext that they assume exists, but which they cannot prove exists

[lupinus]

Sooooo if this was a safe and she wouldn't give the combo? If they think there's things on there get a warrent and treat it the same.

[dogmush]

As I understand it, LE would drill the safe for you if they had a warrant but no combo, and are butthurt they don't have the skills needed to force break an encrypted HD.

[zahc]

It's different than the safe analogy. It's more like the police found a sheaf of papers with random numbers on them. They don't like the fact that it's legal to possess papers with random numbers on it.

The government can already access all the information on the hard drive, the defendant is being forced to provide information that will interpret the data in a way that will satisfy the government...obviously in an way which produces incriminating information. I can't think of a more blatant way to require the accused to incriminate himself.  

The Government’s forensic expert was unable to conduct a search of the computer’s contents because the contents were password-protected.

Note carefully, people: this is false; an untruth. The forensic expert was able access every byte of, probably every magnetic domain of the hard drive. And the did not find incriminating information! Then they compelled the accused to produce incriminating evidence. The incriminating evidence was not "on the hard drive" waiting to be unlocked. They got it directly from the accused. The fact that they didn't find what they wanted when they searched the hard drive explains why they pressed forward with compelling the accused to provide information, but the whole safe analogy is just wrong.

[Nick1911]

Agreed.  Without the password, the information in question doesn't actually exist.  The information they need is in the head of the suspect; which should be protected by the 5th amendment. 

[Tallpine]

Would be nice to have the encryption set up so entering a certain non-password causes an automatic deletion of all data 

[Strings]

That was my thought too, Tallpine.

Anybody capable of rigging that? Rev?

[Fitz]

Yes it's possible.

Unfortunately, that would likely get some bogus charges thrown at you. In addition, a PROPER wipe of a disk requires many passes and can take a lot of time.

Maybe there's a hardware device that can magnetically "brick" them.



At my work, if I enter my keycode on the door a certain number of digits "off", it summons the cavalry.

[Nick1911]

Sure.  Heck, there's even a disk maker that has a container of acid inside, with the right code, acid gets released, disk surface is totaled.

But, computer forensics never work on *your* PC.  First thing they do is take a copy of the disk through a "read only" widget - preserves the state of the evidence.  So, you'd just be scrambling bits on some tech's VM image.  Which they could then pull up another copy, and show the judge your code that's designed to destroy evidence.  bad juju.

Plus, you might inadvertently introduce a backdoor if you mucked with off the shelf code.  Best to use truecrypt, and leave it stock.  Maybe set up a hidden volume, so you can give them the "fake" password, which unlocks a sanitized OS for them to look at.  Mathematically impossible to prove any other OS instance exists, in that case.  Plausible deniability.

But no, I haven't thought about this at all.  Surly none of my machines are setup like this.

[Fitz]

Sure.  Heck, there's even a disk maker that has a container of acid inside, with the right code, acid gets released, disk surface is totaled.

But, computer forensics never work on *your* PC.  First thing they do is take a copy of the disk through a "read only" widget - preserves the state of the evidence.  So, you'd just be scrambling bits on some tech's VM image.  Which they could then pull up another copy, and show the judge your code that's designed to destroy evidence.  bad juju.

Plus, you might inadvertently introduce a backdoor if you mucked with off the shelf code.  Best to use truecrypt, and leave it stock.  Maybe set up a hidden volume, so you can give them the "fake" password, which unlocks a sanitized OS for them to look at.  Mathematically impossible to prove any other OS instance exists, in that case.  Plausible deniability.

But no, I haven't thought about this at all.  Surly none of my machines are setup like this.

I didn't even think about the hidden volume thing on truecrypt.

I think i'm going to rethink my home PC set up

[roo_ster]

I wish I had data worth truecrypting against possible gooberment snooping.

[Fitz]

I wish I had data worth truecrypting against possible gooberment snooping.

There will come a time where even threads like these will be grounds for arrest.

[longeyes]

That's why I'm changing my screen name to The Real Fitz.

[Balog]

There will come a time where even threads like these will be grounds for arrest.

1. Good luck trying to enforce that.

2. Your internet dealings are proved from a ISP level, not from the contents of your hard drive.

[Fitz]

That's why I'm changing my screen name to The Real Fitz.

I already reserved longeyes@imahomegrownterrorist.com for an email addy

 

[Fitz]

1. Good luck trying to enforce that.

2. Your internet dealings are proved from a ISP level, not from the contents of your hard drive.

lol....


1.) THey try to enforce all kinds of silliness now.

2.) I know. it was called drawing a parallel. I work in IT. I have the basics of teh interwebz and hard drivez down

[Balog]

lol....


1.) THey try to enforce all kinds of silliness now.

2.) I know. it was called drawing a parallel. I work in IT. I have the basics of teh interwebz and hard drivez down

1. Try, sure. Try don't equal do.

2. Wasn't trying to imply you don't. Just saying that if it gets to the point they're scouring your hard drive, there was probably a lot that preceded it. This was occassioned by roo-ster pointing out that he felt no need to secure his drives vs fed.gov, as there is nothing incriminating on them. Me, I'd be more worried about getting virtually flaked but I don't know how one could realistically prevent that.

[Balog]

No offense to anyone who does encrypt. It's a personal choice and I understand why one would. Just saying that someone chosing not to is not necessarily a foolish choice.

[Fitz]

No offense to anyone who does encrypt. It's a personal choice and I understand why one would. Just saying that someone chosing not to is not necessarily a foolish choice.

I don't think anyone made that assertion in this thread

[Perd Hapley]

All of this proves that I am a genious. Anything controverseal I've said here? Actualy just clever code for my actual opinions and anti-goverment plots. A code so complexive, even I don't know what I realy said.

[De Selby]

Agreed.  Without the password, the information in question doesn't actually exist.  The information they need is in the head of the suspect; which should be protected by the 5th amendment. 

This - the law is way, way behind the technology on this one.

What're the odds the Supreme Court justices have any realistic idea about how encryption works?

[red headed stranger]

What're the odds the Supreme Court justices have any realistic idea about how encryption works?

Probably about the same odds that they would care to learn.   

[zxcvbob]

I wish I had data worth truecrypting against possible gooberment snooping.

Think of it this way; it's funnier when .gov comes snooping if the hidden data truly is worthless.