×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Federal Magistrate Rules That Fifth Amendment Applies To Encryption Keys

Unknown Lamer posted about a year ago | from the but-the-nsa-has-quantum-computers dept.

Encryption 322

Virtucon writes "U.S. Magistrate William Callahan Jr. of Wisconsin has ruled in favor of the accused in that he should not have to decrypt his storage device. The U.S. Government had sought to compel Feldman to provide his password to obtain access to the data. Presumably the FBI has had no success in getting the data and had sought to have the judge compel Feldman to provide the decrypted contents of what they had seized. The Judge ruled (PDF): 'This is a close call, but I conclude that Feldman's act of production, which would necessarily require his using a password of some type to decrypt the storage device, would be tantamount to telling the government something it does not already know with "reasonably particularity" — namely, that Feldman has personal access to and control over the encrypted storage devices. Accordingly, in my opinion, Fifth Amendment protection is available to Feldman. Stated another way, ordering Feldman to decrypt the storage devices would be in violation of his Fifth Amendment right against compelled self-incrimination.'" If the government has reasonable suspicion that you have illicit data, they can still compel you to decrypt it.

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

322 comments

Last Sentence (5, Insightful)

steevven1 (1045978) | about a year ago | (#43537445)

Where did the last sentence in this summary come from? It seems to be completely contradictory to the main content. Elaborate?

Re:Last Sentence (5, Informative)

TyIzaeL (1203354) | about a year ago | (#43537511)

This is a close call, but I conclude that Feldman's act of production, which would necessarily require his using a password of some type to decrypt the storage device, would be tantamount to telling the government something it does not already know with "reasonably particularity"

I'm guessing this is the trick. The government doesn't know there is evidence on the storage device. It sounds like they are making the argument that compelling a password for discovery purposes is a violation, but providing one to give them what they know you have is not. At least, that's what it seems like they are saying to me.

Re:Last Sentence (5, Informative)

Anonymous Coward | about a year ago | (#43537667)

It's a wink-wink that they have to add "possession of child pornography" to the charges also in order to compel the keys.

Re:Last Sentence (5, Interesting)

Yebyen (59663) | about a year ago | (#43537739)

It reads differently to me. They do not know that he can decrypt the data (he could have destroyed the passphrase, or it was destroyed when left in the hands of an automated system and he was incarcerated), and compelling him to do so would be a) demanding that he prove that he could decrypt them, a "fact" about him that is not already known to be true (and could be incriminating.)

The last sentence in the summary reads like nonsense to me and does not seem to contribute anything.

They cannot compel you to do something they don't already know that you have the ability to do, and if it turns out later that they can decrypt the drive without your help, the fact that you were able to decrypt it would be the incriminating part (apparently) as much as whatever they had actually found on the drive. Even if they know there is illicit stuff on the drive (somehow) without having decrypted it, they do not know you have control over it (unless this was proven some other way.)

It's like those cops that ask, "do you have any illegal drugs on you" -- if you show them, you waived your right to be protected from unreasonable search and seizure. They did not violate it. You did. Has your fifth amendment right been violated? They could have asked the dog, and he would tell them, but putting dogs on you without probable cause is almost certainly illegal search violation. If you are threatened with contempt if you do not decrypt the drive, even when they haven't proven that you even can, it's much the same situation.

Re:Last Sentence (2)

NatasRevol (731260) | about a year ago | (#43538239)

Just curious since I seem to have missed this.

When did being compelled to decrypt a drive, even if there is known evidence there, skip around the fifth amendment ie avoiding self-incrimination.

Re:Last Sentence (4, Informative)

Yebyen (59663) | about a year ago | (#43538327)

We have to pass the bill to know what's in it...

The argument I've heard is that, when information is at rest, it's not considered testimony for the information to be read (but some other form of discovery). Therefore if it can be shown that you're in a position to decrypt the drive, and the drive is admitted in discovery and you refuse to facilitate discovery, you are standing in the way of the discovery and can be held in contempt of court.

If it has not been shown that the drive can be decrypted with information you have, or could reasonably be expected to have (say, it can be shown by inductive reasoning that the drive contains the log of your activities), or if for example the ownership of the keys or the drive and the encrypted data is in question, it's not reasonable to compel you to decrypt it under penalty of contempt. It hasn't even been shown that it's in your power to facilitate the discovery.

You can be similarly compelled to provide paper documentation, even if it was sent through the mail. It's not testimony. It's facilitating (or obstructing) discovery.

Re:Last Sentence (4, Interesting)

janeuner (815461) | about a year ago | (#43537967)

Incorrect. The government knows that the specified files are (or were) on the storage device at some point. What it lacks is evidence that the defendant is capable of accessing that storage.

Re:Last Sentence (5, Interesting)

Spazmania (174582) | about a year ago | (#43538217)

No, the trick is this:

The government hasn't proven that Feldman *has* the encryption key. Compelling him to turn over the encryption key would be compelling him to admit that he has the key. The compelled admission that he has the encryption key is the fifth amendment violation.

Had Feldman admitted that he had the key or if there was prima facie evidence that he possessed the key, the government could still compel him to provide it.

Re:Last Sentence (5, Informative)

MDMurphy (208495) | about a year ago | (#43537515)

It came from the linked article that references a rejected appeal in a bank fraud case concerning turning over an encryption key.

Re:Last Sentence (0)

spiritplumber (1944222) | about a year ago | (#43537517)

According to the quote block, it's editorializing by Virtucon rather than part of what the legal ruling was.

Re:Last Sentence (5, Informative)

SternisheFan (2529412) | about a year ago | (#43537791)

From the linked Wired article:

Just last year, for example, a federal appeals court rejected an appeal from a bank-fraud defendant who has been ordered to decrypt her laptop so its contents could be used in her criminal case. The issue was later mooted for defendant Romano Fricosu as a co-defendant eventually supplied a password.

Contrary to the Wisconsin child pornography case, however, the Fricosu matter was distinguishable because the authorities had evidence that her hard drive might contain evidence against her, meaning the court felt her Fifth Amendment rights were not at issue. That’s because the authorities had recorded a jailhouse conversation between her and a co-defendant, in which the laptop’s contents were discussed

Re:Last Sentence (2, Insightful)

Anonymous Coward | about a year ago | (#43537529)

I believe the distinction is that in Feldman's case, the act of decryption shows that he had access to and control over the storage devices. This, by itself, would apparently be incriminating.

Re:Last Sentence (0)

Anonymous Coward | about a year ago | (#43537533)

Its saying that the government cant say "Give us your keys so we can see what is there" but they can say "We suspect you are hiding evidence about crimes X, Y & Z give us the keys so we can check".

There is a very slight difference I guess.

Re:Last Sentence (5, Informative)

IndustrialComplex (975015) | about a year ago | (#43538129)

Not quite right.

The government is asking for information which would demonstrate that he had the capability to access the information in a device. Such an admission would be useful to the prosecution which must account for the custodial chain of the device and the data within it.

An example of a situation where you might require this sort of defense:

1. You buy a computer from Bob on Craigslist. You stick it in your garage to work on later.
2. Bob is busted for something, and when questioned about the computer, says he sold it to you.
3. The police arrive at your house, and with a warrant seize the computer from your garage.
4. It turns out that 'Bob' was selling CP or something similarly illegal. The prosecutor decides that YOU purchased the computer/HDD as part of a purchase of CP from Bob.
5. You claim that you have no idea what is on the machine, and the prosecutor demands that you provide the encryption key to decrypt the files for search.

At this point, if you were to provide the encryption keys, it would demonstrate that you DID have the ability to access the files on the computer, this would be providing evidence to the prosecution that you were part of the chain of custody.

In the case where the person WAS compelled to turn over the encryption key, the prosecution already had evidence that the person already could access the encrypted device/file. Therefore, by turning over the encryption key, the person was not providing any evidence that the prosecution did not already have.

So if in the example I provide above, you had made a statement that "Hey, Bob sold me a computer, and you wouldn't believe the nasty stuff he had on it in an encrypted file." That would mean that you could not plead the 5th as it would already be a fact that you could access the encrypted file, so providing the keys wouldn't be giving any evidence to the prosecution.

Re:Last Sentence (1)

SYSS Mouse (694626) | about a year ago | (#43537539)

By ordering to decrypt, the accused is compelled to tell the government what they are not already known, that is, the content of the encrypted drive that could be evidence against accused . Hence the 5th Amendment Violation

Re:Last Sentence (2)

gnasher719 (869701) | about a year ago | (#43537775)

By ordering to decrypt, the accused is compelled to tell the government what they are not already known, that is, the content of the encrypted drive that could be evidence against accused . Hence the 5th Amendment Violation

Wrong. They have the right to the information on the encrypted drive. What the government doesn't know is whether or not the accused is the one putting the encrypted data there. If he has the key, he is guilty - no need to decrypt the drive! If he doesn't have the key, he is innocent (all slightly exaggerated).

Re:Last Sentence (2)

hedwards (940851) | about a year ago | (#43537941)

Wrong, the government has the right to break into the data, but not to force somebody to interpret the data for them.

This would be a bit like if you had a secret crime lair where you kept all the evidence of your misdeeds. The government would have a right to search for it, but if they couldn't find it or couldn't figure out how to open it, they couldn't force you to open it for them or tell them where it is or acknowledge its existence.

What's more, they couldn't force you to incriminate yourself against other crimes that you might have committed by revealing that evidence to them.

The only exceptions I've heard about to the protection are cases where LEO already knew what was inside the container and had seen the materials prior to being shut out of it.

Re:Last Sentence (1)

gnasher719 (869701) | about a year ago | (#43538343)

This would be a bit like if you had a secret crime lair where you kept all the evidence of your misdeeds. The government would have a right to search for it, but if they couldn't find it or couldn't figure out how to open it, they couldn't force you to open it for them or tell them where it is or acknowledge its existence.

A better analogy: There are guns hidden in a locked cupboard. It is locked, but can be opened with brute force. The police ask you to unlock it.

The fact that you have the keys to unlock the cupboard is evidence against you. The police will get the guns with or without your help, but without your help, they find it much harder to prove that you owned the guns or knew about them. In this case, the fact that you can decrypt the drive can itself be evidence against you. Imagine the police lost the hard drive, buys an identically looking replacement, encrypts it, and asks you for the decryption key - just to get evidence that you had decryption keys for the original drive.

Re:Last Sentence (1)

Spectre (1685) | about a year ago | (#43537559)

In other words, if the law enforcement had a reasonable suspicion you have incriminating data of a particular kind (perhaps a list of the prostitutes you pimp for, whatever) and a reasonable person would assume that data is on the encrypted media, they could go through channels (subpoena, search warrant, some form of judicial writ) that would require you to decrypt the media for a search for that specific data.

If law enforcement merely thinks you are a criminal (because you are living "above your means") and wants to go searching through all of your data just looking for "something illegal" ... that would fall afoul of the fifth amendment.

At least, that is my interpretation.

Re:Last Sentence (1)

Anonymous Coward | about a year ago | (#43537681)

And this case is far far more specific. There is evidence far above normal business practices that he put a known illicit file on one of the two encrypted drives and yet they can't compel it; because they can't already prove he has access to the drives rather than some other person for which there is no evidence that he even exists.

Re:Last Sentence (0)

Anonymous Coward | about a year ago | (#43537565)

A case in Colorado, http://www.wired.com/threatlevel/2012/01/judge-orders-laptop-decryption/

Re:Last Sentence (1)

Anonymous Coward | about a year ago | (#43537573)

I'm no lawyer but I think the central issue here is providing access to the encryption key would establish a relationship between that content and the accused. A relationship that is not already established.

Somehow this is different than providing access to encrypted content of hardware you clearly own because it is not about compelling decryption it is about establishment of linkage between individual and encrypted content.

Re:Last Sentence (1)

Sulphur (1548251) | about a year ago | (#43538057)

I'm no lawyer but I think the central issue here is providing access to the encryption key would establish a relationship between that content and the accused. A relationship that is not already established.

Somehow this is different than providing access to encrypted content of hardware you clearly own because it is not about compelling decryption it is about establishment of linkage between individual and encrypted content.

Suppose the password is shared?

Re:Last Sentence (1)

zero.kalvin (1231372) | about a year ago | (#43537589)

I have the same question, but I think they meant that if they feel that you have data about something important going to happen. Like the Boston bomber if they had suspicion that his data contains information on more stuff to happen they can compel him to decrypt it. But I could be wrong.

Re:Last Sentence (0)

Anonymous Coward | about a year ago | (#43537653)

Can't find the link, has something to do with a jailhouse govt. recording with an accused and another inmate discussing alleged evidence on a computer.

Re:Last Sentence (0)

Anonymous Coward | about a year ago | (#43537695)

Can I just say one thing here? No one can 'compel' anyone to do anything. At best, they give you a choice to decrypt, or die. Perhaps it is time to remember, laws are just paper. (and we have swords :))

Re:Last Sentence (0)

Anonymous Coward | about a year ago | (#43537679)

OMG its /. and we can't RTFA.

Re:Last Sentence (1)

kwark (512736) | about a year ago | (#43537699)

Not a native english speaker, but to me compel sounds like:
Would you pleeeeeeeeeeaase decrypt, with lots of sugar on top. It's not like you having to hide, isn't it? So show us you are innocent.

Re:Last Sentence (1)

rtb61 (674572) | about a year ago | (#43538269)

They can compel you to try, they can not compel you to succeed ie this is what the password should be #V3ry@L0nG@Pa55W0rd# but it doesn't seem to be working, perhaps I entered the wrong key last time I changed it and all the stress of the prosecution is making me forget which special character, which capitals and actual phrase but I 'WILL' keep trying. I truthfully have forgotten quite a few passwords in my time and either lost the data or was forced to use other methods to access it. You only have to look around the internet to find all those "lost password/lost username" assists, pretty much every site that wants a log in. So forgetting your password is reasonable.

Re:Last Sentence (1)

gnasher719 (869701) | about a year ago | (#43537731)

Where did the last sentence in this summary come from? It seems to be completely contradictory to the main content. Elaborate?

In this particular case, whether the defendant knew the password or not was in itself something that could be used as evidence against the defendant. Even if the hard drive had been destroyed or lost, supplying the password could be used against him. In a different case, if it is known that there is encrypted data and it is known that you have the password, and there is no evidence in the password itself, then they can compel you to decrypt.

It has to do with foregone knowledge (4, Informative)

Okian Warrior (537106) | about a year ago | (#43537747)

It's a subtle point described in the judges decision.

If the government has knowledge of particular documents, they can force you to present them. This includes forcing you to open your safe or decrypting your hard drive.

If the government has no knowledge of the contents of the hard drive, no information from other sources that indicate that you have specific documents it wants, then it can't force you to decrypt your hard drive.

The judge's position was that since the government had no indication of whatever documents are on the hard drive, producing them tied the defendant to the documents - providing evidence of control and ownership. Since that evidence (control and ownership) was not available to the government beforehand, it would be compelled testimony.

I think this is also reasonable in light of the fourth amendment. If the government doesn't have knowledge of specific documents, it can't go "rummaging around" on your disk looking for things.

Re:Last Sentence (0)

Anonymous Coward | about a year ago | (#43537873)

If you read the ruling, you can see the circumstances in which the government MIGHT be able to compel you to decrypt the data on a storage device;however they didn't apply in this case. One case it mentions, the accused had a file with a title that served as a neon sign to kiddie porn (I won't say it flat out because its disgusting), and the accused stated that she was the only one with the password so then the government could compel her to use her password.

Face it, the government can suspect that you've committed a crime all they want, but they have to show cause. Asking someone for their password to a storage device is one way they can try to do it. It's like when they come into your home and ask to look through your bag on the floor. They might have a suspicion that you're carrying a gun, but you have to let them look (unless they can plainly see it). It's nice that a judge is keeping up with the times :)

Re:Last Sentence (1)

AdmiralXyz (1378985) | about a year ago | (#43537905)

It brings encryption keys to pretty much the same status as locked safes. The government can't just order you to open it on a whim, but they can if they have reasonable prior evidence that there is illegal material contained within. To illustrate:

Scenario 1: As a citizen, I step off the plane after getting back from a foreign country. Not knowing who I am, ICE goons randomly pull me aside and order me to give up the encryption key to my laptop. They have NO reasonable suspicion that doing so will yield illicit material or evidence of wrongdoing, so the Fifth Amendment applies.

Scenario 2: I'm a corporate officer cooking my books, and I brag to my friend that the feds will never catch me because all the incriminating evidence is encrypted. Unfortunately my friend has agreed to cooperate in a plea deal, and relays the details of this conversation. Now the government has reasonable suspicion (actually, at this point I think it's probable cause) that my encryption key is concealing material evidence, and they can probably force me to reveal it.

/. probably won't be happy with that last sentence, but IMO as long as judges interpret "reasonable suspicion" correctly (which is usually the case), it's probably the right call. The government always has been able to force you to open your safe deposit box if they have a warrant, after all. This is nothing new.

Re:Last Sentence (1)

janeuner (815461) | about a year ago | (#43537927)

It is explained in the ruling, explicitly.

Page 8: "But the following question remains: Is it reasonably clear, in the absence of compelled decryption, that Feldman actually has access to and control over the encrypted storage devices and, therefore, the files contained therein?"

Page 9: "I conclude that Feldman’s act of production, which would necessarily require his using a password of some type to decrypt the storage device, would be tantamount to telling the government something it does not already know with “reasonably particularity”—namely, that Feldman has personal access to and control over the encrypted storage devices."

Paraphrased:
> If the government has reasonable suspicion that illicit media exists, and can verify you have access to that illicit media, it can compel you to retrieve that media.
However,
> If the government has reasonable suspicion that illicit media exists, but can not verify you have access to that illicit media, it can compel you to retrieve that media.

Even if the government could access the media, it would still have to demonstrate that the defendant could also access the media. By accessing the illicit media, the defendent is demonstrating possession of the illicit media. This amounts to self-incrimination, which is protected by the Fifth amendment.

Re:Last Sentence (1)

janeuner (815461) | about a year ago | (#43538025)

Bleh, the second paraphrase should read:
> If the government has reasonable suspicion that illicit media exists, but can not verify you have access to that illicit media, it can not compel you to retrieve that media.

Re:Last Sentence (1)

FuzzNugget (2840687) | about a year ago | (#43537959)

In TFA, they state that, in the latter case, the accused was compelled to reveal his encryption key because he was recorded in a discussion where he talked about the encrypted [device] containing incriminating information.

In the former, the prosector's request was just a fishing expedition, so it was denied.

It is an unsettling distinction. Computers hold so much information about nearly every aspect of our lives, it really doesn't seem right that one piece of evidence allow that to be pried wide open.

Would a warrant be issued to tear apart your home if it was overheard that you had a doobie in your sock drawer or would they limit the search to your sock drawer?

Re:Last Sentence (1)

IndustrialComplex (975015) | about a year ago | (#43538267)

Would a warrant be issued to tear apart your home if it was overheard that you had a doobie in your sock drawer or would they limit the search to your sock drawer?

If the evidence was what you presented, and they searched your kitchen cupboards, a lawyer would probably get any cupboard evidence suppressed. If they found heroin in the sock drawer, they could use that evidence.

No faith (0)

MickyTheIdiot (1032226) | about a year ago | (#43537481)

When this gets to the old farts in the higher courts - the kind of people who dictate their emails and get confused by double clicking on icons - this will be overturned. The lack of any real world experience in concert with authoritarian attitudes will make sure this doesn't stay case law.

England (0)

Anonymous Coward | about a year ago | (#43537483)

I wish that were the case here. In England you can be imprisoned for up to two years for refusing to divulge your encryption key.

Re:England (3, Insightful)

click2005 (921437) | about a year ago | (#43537583)

Yeah sometimes we pass silly laws in the UK and other times they do in the States. Its like trying to figure out which pile of shit has the least offensive smell.

Re:England (0)

Anonymous Coward | about a year ago | (#43537893)

Note that this has never been tested to the full extent (i.e. appealed to the ECHR). Also, I believe the in cases where it has been used, the relevant defendant has admitted that they did know the key and refused to provide it.

If the defence was something like "I was messing with encryption for a test, I don't remember the key" and the court disbelieved you and convicted you of withholding the key, I think an appeal, (if necessary all the way to the ECHR), on the grounds of the violation of the right to a fair trial might suceed.
Firstly, the burden of proof is being reversed, i.e. you are being asked to prove you forgot (rather than the prosecution proving you knew the key), and secondly it's actually impossible for you to prove this even if true.

(ECHR= European court of human rights)

Re:England (2)

camperdave (969942) | about a year ago | (#43538009)

From what I understand, it doesn't even have to be your key. If someone slipped an encrypted flash drive into your pocket, you could be sent away for refusing to divulge the encryption key - even though you have no possible clue what it might be.

I'm sorry but... (1)

Nickodeimus (1263214) | about a year ago | (#43537513)

I don't know what you mean by encrypted. I never encrypted anything on my computer\laptop\tablet\phone, your honor.

What is the method / software used (1)

sageres (561626) | about a year ago | (#43537521)

I would like to know what is the method and software that is used to encrypt the hard-drive in such a way that FBI has no way of breaking a decryption, other than asking a judge to compel the discovery.

Re:What is the method / software used (1)

Saethan (2725367) | about a year ago | (#43537845)

TrueCrypt can do this easily with a properly chosen key. And some non-free options like the one my company uses to encrypt all employee mobile work devices(I don't have a work laptop so I can't recall what software they use)

Re:What is the method / software used (0)

Anonymous Coward | about a year ago | (#43538081)

One of the most common algorithms, AES256 *if implemented and used correctly*, is secure** against the entire computing power of this planet (and much, much more). The FBI has many abilities but breaking the laws of physics is not likely to be amongst them.

In practice, their best chance would be finding the key written down somewhere or accidentally stored plainly on a disc (e.g. in a paging file), or finding an error in the specific implementation.

**Or rather, believed secure by the finest minds in the field across the world, who of course could be all part of a worldwide conspiracy if you believe that sort of thing.

Re:What is the method / software used (3, Interesting)

ewieling (90662) | about a year ago | (#43538115)

Truecrypt. <URL:http://en.wikipedia.org/wiki/TrueCrypt>

The FBI has admitted defeat in attempts to break the open source encryption used to secure hard drives seized by Brazilian police during a 2008 investigation. <URL:http://news.techworld.com/security/3228701/>

Obligatory XKCD (5, Funny)

emddudley (1328951) | about a year ago | (#43537535)

Re:Obligatory XKCD (-1)

Anonymous Coward | about a year ago | (#43537673)

I knew some faggot would link to this one near the top of the comments page. It's not funny, and it's not original to link to it. Especially when it's so predictable. You and everyone else that links to it should be modded as redundant.

Oblig xkcd is wrong yet again (3, Insightful)

Anonymous Coward | about a year ago | (#43537921)

Bzzt. In this real life example, when the guys with the $5 wrench came along, the victim called his lawyer who brought in a judge who wields a $100 wrench.

And it all happened (he beat the $5 wrench guys) because he encrypted. If he hadn't encrypted, he might not have ever known he was under attack (well, ok, in this particular example he actually did; most of the time you don't), wouldn't have been confronted with the $5 wrench, and wouldn't have have had the recourse of getting the judge to come in with his $100 wrench.

Encrypt. More of than not, it results in you defeating your adversary. That's true whether the adversary is your government, someone else's government, a common thief, Google, whoever bought your refurbished drive after you RMAed it, or whoever.

You're stupid and knowingly negligently careless if you don't encrypt anything important. We're all going to point and you and laugh at the non-random misfortune that you consciously chose to experience.

Examples of what's important are: your shopping list, where you're having dinner tonight, mundane thoughts such as "yes, I'll have another beer" and nearly anything else. Anything you say can be used against you, and I'm not quoting Miranda; I'm quoting reality itself.

Forgive my ignorance... (5, Interesting)

fuzzyfuzzyfungus (1223518) | about a year ago | (#43537561)

Does the 5th amendment right to avoid self-incrimination apply only to the particular charges being brough in a given case, or does it cover any statement that could be incriminating, even if it were in a different proceeding, or if the record from Case A were to be used as evidence in Case B?

Say, in the case of an encrypted HDD, it's reasonably plausible that a broad spectrum of the suspect's electronic activities will be there. Common software tends to be a bit 'leaky' in terms of recording what it does(temp files, caches, search indexes, etc.) and most people don't have entirely separate computers for each flavor of crime they are engaged in.

If somebody were being charged for one crime that probably left evidence on the HDD(kiddie porn, say); would the fact that they know that there is evidence of CC-skimming(but, unlike the kiddie porn, the feds have no circumstantial evidence or other grounds for belief) justify a 5th-amendment refusal to decrypt the volume? Would the other potentially-incriminating stuff be irrelevant because it isn't among the charges(even if the court record could be used as evidence to bring future charges)? Would the suspect be compelled to divulge the key; but the prosecution only have access to material relevant to the charges being filed, with some 3rd party forensics person 'firewalling' to exclude all irrelevant material?

Re:Forgive my ignorance... (0)

Anonymous Coward | about a year ago | (#43538067)

IANAL: The 5th Amendment, as well as the 4th, was intended to prevent a person from having to contribute to any investigation or trial against themselves. Too often they are but variations on "fishing expeditions" and "witch hunts". IMHO it prohibits torture and should not have to be "invoked", not that the courts allowed much destruction to this right and legislatures put out what with stricter interpretation of the 5th should be deemed unconstitutional, but being just one citizen's opinion carries little weight and with too many overzealous citizens demands for their version of justice as well as government seeking power, things are as they are.

"Give me six lines written by the most honorable person alive, and I shall find enough in them to condemn them to the gallows"---Cardinal Richelieu

Am sure you have more then six lines on your computer.

Re:Forgive my ignorance... (1)

kscguru (551278) | about a year ago | (#43538117)

Does the 5th amendment right to avoid self-incrimination apply only to the particular charges being brough in a given case, or does it cover any statement that could be incriminating, even if it were in a different proceeding, or if the record from Case A were to be used as evidence in Case B?

No, it applies to all cases ... if you state something in case A, it can be used in case B. Which is the point of the protection: if you are on trial for jaywalking, and can "prove" that you were not jaywalking because instead you were robbing a bank across town, the law cannot compel you to state where you were (thereby confessing to some other crime). You can volunteer it / waive your right (and be an idiot), but the law cannot force you to confess.

If somebody were being charged for one crime that probably left evidence on the HDD(kiddie porn, say); would the fact that they know that there is evidence of CC-skimming(but, unlike the kiddie porn, the feds have no circumstantial evidence or other grounds for belief) justify a 5th-amendment refusal to decrypt the volume? Would the other potentially-incriminating stuff be irrelevant because it isn't among the charges(even if the court record could be used as evidence to bring future charges)? Would the suspect be compelled to divulge the key; but the prosecution only have access to material relevant to the charges being filed, with some 3rd party forensics person 'firewalling' to exclude all irrelevant material?

I didn't see the warrant specifically mentioned, but "normally" the search warrant has to specify exactly what is being searched, and is thus ONLY valid for what is being searched. For example, the search warrant would say "the file named kiddie_porn.jpeg", and thus only that file (and not ccfraud.txt) becomes evidence. That said, warrants can also be broad - the hard drives themselves were presumably seized because the search warrant said "any computers and electronic storage devices located at 123 Perpetrator Street". Fishing expedition warrants saying "all files showing evidence of kiddie porn" tend to get thrown out, but a warrant saying "all files under C:\kiddie_porn" backed up by evidence (a P2P log) showing that files in fact were placed within C:\kiddie_porn is probably valid - and a warrant backed up by a P2P log is almost certainly what the search warrant this judge is ruling about says.

Not being a lawyer, I can't tell you what happens if the person examining the encrypted contents happens to see evidence of some other crime. But the physical analogy is this: if the police show up with a warrant to search your house for "computers", they are obviously entitled to seize all computers. And if they walk through your house and see illegal drugs sitting on the table, that's admissible evidence ("in plain sight") (Interestingly, it cannot be seized because the warrant does not specify "drugs". But what happens is the cop calls the judge and says "I'm executing warrant A for computers and see drugs on the table, can I get warrant B to seize the drugs?" and the judge faxes over a warrant right away). But they are not allowed to rifle through all your drawers and closets - drugs found there are not admissible evidence because they are not "in plain sight". (Unless you give the police permission - and they WILL ask. Which is why lawyers always advise saying "I do not consent" - you cannot stop the search / seizure, but not consenting makes any evidence found without a warrant inadmissible and the police potentially liable for misconduct). It's difficult to guess how courts would apply this standard to searching a HDD, but they would do it by starting with the physical analogy and figuring out how it applies to electronics.

What's happening in this case is that the prosecution knows files with kiddie porn names were downloaded. But they still cannot prove the files contain actual kiddie porn. (Maybe this guy is sick and thinks naming his legal porn files with kiddie porn names is funny). So the prosecutor was hoping to compel this guy to hand over the encrypted files (whose names they knew), under a warrant that compels him to be truthful about their contents (by having a neutral 3rd party do the work). The judge decided that the prosecutor does not have enough evidence to prove this guy actually knew what was in the files (maybe he operates a repository with files stored on an encrypted disk, but does not himself have access to the files). The judge also implied that if the prosecutors DID have evidence of what was in the files (maybe 1 or 2 got left on unencrypted drives by the P2P program as intermediate files and the filenames matched?), he probably would authorize the warrant and require this guy to decrypt his drives.

Mountain out of a molehill (5, Interesting)

DNS-and-BIND (461968) | about a year ago | (#43537591)

This is all a big brouhaha over nothing. The Fifth Amendment has a remaining lifespan measured in years, not decades. There was already a call to give up on the Constitution [nytimes.com], naming the document "downright evil". Now we have Bloomberg saying that the Boston bombing will have to change the way we 'interpret' the Constitution. No, I'm not kidding, the Mayor of New York City really said these words:

"The people who are worried about privacy have a legitimate worry," Mr. Bloomberg said during a press conference in Midtown. "But we live in a complex world where you're going to have to have a level of security greater than you did back in the olden days, if you will. And our laws and our interpretation of the Constitution, I think, have to change. Look, we live in a very dangerous world. We know there are people who want to take away our freedoms. What we cant do is let the protection get in the way of us enjoying our freedoms. You still want to let people practice their religion, no matter what that religion is. And I think one of the great dangers here is going and categorizing anybody from one religion as a terrorist. That's not true ... That would let the terrorists win. That's what they want us to do."

Encryption keys? It's arguing about the wrong topic. These silly arguments about the Fifth Amendment will soon be about as relevant to our lives as the Austro-Hungarian Empire.

Re:Mountain out of a molehill (2)

Umuri (897961) | about a year ago | (#43537755)

Did you even read the quote you posted?

"The people who are worried about privacy have a legitimate worry," Mr. Bloomberg said during a press conference in Midtown. "But we live in a complex world where you're going to have to have a level of security greater than you did back in the olden days, if you will. And our laws and our interpretation of the Constitution, I think, have to change. Look, we live in a very dangerous world. We know there are people who want to take away our freedoms. What we cant do is let the protection get in the way of us enjoying our freedoms. You still want to let people practice their religion, no matter what that religion is. And I think one of the great dangers here is going and categorizing anybody from one religion as a terrorist. That's not true ... That would let the terrorists win. That's what they want us to do."

Emphasis mine. That quote states that our interpretation will change to PROTECT our freedoms against the fear-mongering people trying to increase security at the cost of it. I'm all for lambasting people for taking away one of the few documents that got this country on the right track, but at least pick quotes that backup the statement you're trying to make...

Re:Mountain out of a molehill (4, Insightful)

CanHasDIY (1672858) | about a year ago | (#43537909)

Hard to believe those are the words of mayor "You can't have a big soda, or smoke until you're 21, because I'm the government agent and I say so" Bloomberg...

Re:Mountain out of a molehill (1)

Anonymous Coward | about a year ago | (#43537939)

You mean just like they stated the Patriot Act would make us safer and not abridge our rights? Don't be such an obtuse fool -- politicians will spin whatever they say to get support. Bloomberg knows that changing the "interpretation" of the Constitution is a hell of a lot easier than actually changing it.

I for one don't feel like the government's "protecting" over the past decade has made me feel more free -- quite the opposite.

Re:Mountain out of a molehill (4, Informative)

Nidi62 (1525137) | about a year ago | (#43538005)

I love how the person who said the part you highlighted is the same person who banned the sale of sugary drinks over a certain size in restaurants as well as enacted the greatest restrictions on the 2nd Amendment, and wants to hide cigarettes in convenience stores among other things. Someone needs to teach him what the word "hypocrite" means.

Re:Mountain out of a molehill (5, Insightful)

Archangel Michael (180766) | about a year ago | (#43537861)

We just had a demonstration that most people are willing to live under Marshal Law, have their houses searched, in a violation of the 4th Amendment. We have the federal government actively campaigning for the abolition of the 2nd. People being sued for speaking their mind (1st Amendment), and so on. So what is to protect us from government taking the 5th away? Not to mention that the Federal Government has consistently violated the 9th and 10th.

IF we the people had any balls, we would be dragging President, most (if not all) of Congress into court and charged with treason. Problem is, who is able to arrest the President of the USA for Treason? Who is willing? Obama, GWB, Clinton ..... all are guilty. But stick a (D) or (R) after their name, and all of a sudden 1/2 the people will "like" what they are doing, say "It isn't that bad".

No, it isn't "That bad". It is worse.

Re:Mountain out of a molehill (0)

Anonymous Coward | about a year ago | (#43538227)

If they're willing to have their houses searched, then it is not a violation of the 4th amendment to search their houses. You can give permission to the police to search your house.
The Federal government just, um, failed to vote in favor of a gun control proposal. How is that "actively campaigning"?
Most people that are sued for things like libel and slander win.

What I read with the second paragraph was "IF we the people had any balls, we would be [conducting a kangaroo court then proceeding to execute our government so we could have a mini-French Revolution]". US presidents have been playing fast and loose with the Constitution since, well, the founding. Jackson and the Trail of Tears (which was horrid, by the way)? Check. Lincoln and habeas corpus? Check. Alien and Sedition acts? Check. At least two of these were specifically declared unconstitutional in courts, but we didn't charge those presidents with treason.

Re:Mountain out of a molehill (3, Insightful)

Anonymous Coward | about a year ago | (#43538295)

If they're willing to have their houses searched, then it is not a violation of the 4th amendment to search their houses. You can give permission to the police to search your house.

Yeah, "permission." They were showing up at houses with teams of something like six heavily armored SWAT members, banging on the doors, aiming automatic rifles at the home owners, and then asking to be "allowed" to look at home.

Want to say no? That's OK, they're backed by literal tanks and even more armed SWAT people, aiming through the windows at anyone they can see from their tank.

So, yeah, they were "consensual" searches. In the same way a mugging victim "consents" to having his wallet stolen in exchange for not being shot to death.

And all this ignores the social pressure to "consent." You're "helping" them catch a terrorist who isn't actually in that part of town! Do you want to refuse and "help the terrorists?" Do you?

This was armed thuggery, pure and simple. The people of Boston should be ashamed of their police and ashamed of their behavior.

Re:Mountain out of a molehill (0)

Anonymous Coward | about a year ago | (#43537869)

The latter half of what Bloomberg said actually sounds pretty reasonable to me. That is, this:

We know there are people who want to take away our freedoms. What we can't do is let the protection get in the way of us enjoying our freedoms. You still want to let people practice their religion, no matter what that religion is. And I think one of the great dangers here is going and categorizing anybody from one religion as a terrorist. That's not true ... That would let the terrorists win. That's what they want us to do.

Where did you get that Bloomberg quote? I'm wondering if there's more context, because the second half doesn't seem to jive with the first half. Do you know what he said after this?

Re:Mountain out of a molehill (0)

Anonymous Coward | about a year ago | (#43537895)

"We know there are people who want to take away our freedoms." Oooorrrr we have people who are sick and tired of being BOMBED and MURDERED around the world. This is a problem of our own making. We've antagonized and terrorized people across the globe for decades. Is it any surprise some of them want to strike back?

The dangerous world exists because our Government wants it to exist in order to justify its massive expenditures on the MIC. Lining the pockets of their friends and family is the ultimate goal.

"You still want to let people practice their religion, no matter what that religion is. And I think one of the great dangers here is going and categorizing anybody from one religion as a terrorist"
First sentence implies that some religions are inherently wrong or automatically linked with terrorism. Then immediately says that the thing he just said would let the terrorists win... Yes, the terrorists have won as evidenced by morons like this having power.

Re:Mountain out of a molehill (0)

Anonymous Coward | about a year ago | (#43537933)

This is all a big brouhaha over nothing. The Fifth Amendment has a remaining lifespan measured in years, not decades. There was already a call to give up on the Constitution [nytimes.com], naming the document "downright evil". Now we have Bloomberg saying that the Boston bombing will have to change the way we 'interpret' the Constitution.

Well, isn't this the thing that the gun-nuts say that they need the guns for? Let's see if anyone of the have the balls to stand up against the government or if they will applaud the removal of freedom and privacy on the way to a police state.

Re:Mountain out of a molehill (0)

Anonymous Coward | about a year ago | (#43538141)

All of these anti-constitutionalists can go jump in a lake (preferably at bayonet point). We did it once with the British as colonials, it may be time to do it again with those in favor of big government/brother.

Re:Mountain out of a molehill (1)

Anonymous Coward | about a year ago | (#43538299)

We know there are people who want to take away our freedoms.

yeah, they're in government, bloomberg included.

Attention! (-1)

Anonymous Coward | about a year ago | (#43537641)

I've just poured hot grits down my pants.

Thank you!

Makes fishing expeditions illegal (1)

OrangeTide (124937) | about a year ago | (#43537647)

And requires the police and DA to do some detective work before a conviction is possible.

As for leaders who are dissatisfied with the protections given in the constitution, use the democrat process that we have to amend the constitution. It's quite possible to change it. Don't like the 5th amendment, then propose something else. Ignoring the laws we have on the books isn't acceptable as then they will be inconsistently applied. Inconsistent justice is not justice at all.

Re:Makes fishing expeditions illegal (1)

Anonymous Coward | about a year ago | (#43537737)

Fishing expeditions were already illegal. It didn't make it so, it was just a judge applying common sense to the law.

Very little precedential value (0)

Anonymous Coward | about a year ago | (#43537707)

This is a decision by a Magistrate (not a full judge) at the District Court level. About as low as you can get within the federal judiciary.

Good decision, but as far as precedential value goes, there is almost zero unless this is upheld on appeal.

Wrong (0)

Anonymous Coward | about a year ago | (#43537753)

"If the government has reasonable suspicion that you have illicit data, they can still compel you to decrypt it."

Wrong. Wrong. And Wrong.

If the government has *probable cause* _AND_ can make a reasonable claim of exigent circumstances (i.e. the decryption of the data is required to prevent imminent and otherwise unavoidable casualty), then one can be compelled to decrypt data, but that data then may not be used against the person in a criminal case against them unless it can be shown that they were responsible for that imminent threat WITHOUT having the data that was decrypted, and also cannot use that data against them in any other unrelated criminal case (i.e. we need to decrypt this data to thwart an imminent terrorist attack, but we also found child pr0n, so let's charge him with pr0n - doesn't fly)

How did he encrypt it? (5, Interesting)

hawguy (1600213) | about a year ago | (#43537787)

What encryption algorithm did he use that's FBI-proof?

Re:How did he encrypt it? (2)

Virtucon (127420) | about a year ago | (#43538093)

Well, AES-256 is readily available but I guess only the Feds and the accused know what was used.

Anything that is worth it's salt (pun intended) will cause grief for any person trying to decrypt the data. There's lots of tools out there, just go look at a few.

I would recommend looking at TrueCrypt http://www.truecrypt.org/ [truecrypt.org] and OpenPGP http://www.openpgp.org/ [openpgp.org] first.

Re:How did he encrypt it? (1)

hawguy (1600213) | about a year ago | (#43538171)

Well, AES-256 is readily available but I guess only the Feds and the accused know what was used.

Anything that is worth it's salt (pun intended) will cause grief for any person trying to decrypt the data. There's lots of tools out there, just go look at a few.

I would recommend looking at TrueCrypt http://www.truecrypt.org/ [truecrypt.org] and OpenPGP http://www.openpgp.org/ [openpgp.org] first.

Yes, I know there's lots of tools out there, that's why I asked the question. I've looked at a few, but I don't know which ones are so difficult to crack that the FBI was willing to try to get the judge to compel the defendant to reveal the key and risk having the judge rule that the defendant is within his rights to not reveal the decryption key. It seems like if the FBI secretly had the ability to break the encryption, they would have done that instead of risking that the judge would rule in the favor of the defendant. Though I guess it's possible that they *did* break the encryption and know what's there, but were looking for a way to make the evidence known without revealing that they cracked it.

Re:How did he encrypt it? (1)

KeithJM (1024071) | about a year ago | (#43538283)

Another possibility, as the summary implies, they might be trying to get the defendant to provide the key just to prove that the defendant knew how to decrypt the hard drive and had access to the contents. That is a classic 5th amendment protection.

Re:How did he encrypt it? (0)

Anonymous Coward | about a year ago | (#43538165)

Yeah!
We crimin... drug... pirat... SECURITY EXPERTS want to know!

Re:How did he encrypt it? (4, Insightful)

hawguy (1600213) | about a year ago | (#43538273)

Yeah!
We crimin... drug... pirat... SECURITY EXPERTS want to know!

I think you mean "citizens".

There are lots of legitimate reasons a citizen may want to save information that they don't want even the US government to read. Just because I keep a diary doesn't mean I think some FBI agent should be privy to what I've written just because they suspect that I may have committed a crime.

Where we stand (1)

Synerg1y (2169962) | about a year ago | (#43537817)

There is a baseline to all of this and that's: does the government know what's on the encrypted drive?

If it does, such as in the case of the guy moving child porn across the border from Canada, the agents SAW the kiddie porn, so when ordered to decrypt the harddrive the government already knew what was on there.

If the government doesn't know what's on there and only suspects it thats when the 5th kicks in.

Make sense?

Re:Where we stand (1)

moeinvt (851793) | about a year ago | (#43538251)

"Make sense?"

Not to me. If the government agents want to swear under oath that they saw the material, their testimony could be used as evidence. I don't see why their supposed "knowledge" should make any difference in the matter of whether or not the accused needs to turn over their encryption keys.

what happens if it's cracked ? (0)

KernelMuncher (989766) | about a year ago | (#43537859)

I'm sure the FBI / NSA has some supercomputers that could crack his computer in very short order. If they did, would the evidence be permissible in US court ? Would this be considered unreasonable search and seizure ? Is a court order needed to use cracking software like this ? There are lots of legal technicalities that need to be resolved here.

Re:what happens if it's cracked ? (1)

Saethan (2725367) | about a year ago | (#43538189)

I'm sure it'd be permissible, but with a proper key, only without an understanding of how encryption works should you believe anybody has the computing power to crack the current encryption algorithms.

Re:what happens if it's cracked ? (0)

Anonymous Coward | about a year ago | (#43538213)

AES-256 is recommended by the NSA for the encryption of military networks. I find it doubtful that they recommend an encryption standard for military use that is eaily crackable. Nevermind the scientific backing for the infeasability of cracking algorithms such as this. Even if they can crack it, revealing the capability to do so seems unlikely as they would want to maintain secrecy for use in national defense projects.

Re:what happens if it's cracked ? (2)

HungryHobo (1314109) | about a year ago | (#43538335)

If they can crack it they're totally free to use it.

imagine that there's a body buried someone in kansas. they can't force you to tell them where it is so that they can go collect evidence against you from it.

But if they find it themselves they're free to use it.

for encryption the search space is a mathematical one but otherwise it's similar.

of course if the NSA or some such can crack it there's no way that they'll admit it for something as trivial as a conviction for some petty criminal because then everyone would know it had been cracked and would use a different form of encryption and the NSA would have to do all the work of cracking that new one.

Victimless crimes? (2)

Okian Warrior (537106) | about a year ago | (#43538055)

I sometimes wonder at all the victimless crimes we seem to have.

In this case federal prosecutors not only don't have a victim, they don't have evidence of a crime. The only way to convict the defendant is to get the evidence from him.

I think the constitution was made specifically to protect us from these sorts of "investigations of suspicion"; specifically, the founding fathers recognized that many activities may seem suspicious from the outside and in certain contexts, but that the government can't simply come in and rummage around for reasons to arrest someone.

This is especially salient in today's world, where innumerable crimes go unaddressed even though there are real victims, and investigating and prosecuting would be trivial. Spam, phishing fraud, identity theft, stolen laptops where the laptop tells the owner where it is, robocalling - all crimes where an average citizen has to beg the government to intercede... to no avail.

Having "suspicious activity" but no evidence should be a clear signal to the authorities. Drop the case, or do something to get real evidence. This general "he's done something wrong, we only need the tools to do our job" thing has to stop.

Do your job by protecting real victims.

Re:Victimless crimes? (0)

Anonymous Coward | about a year ago | (#43538339)

But he had 'the look'. Clearly a villain.

I can't remember... (2, Interesting)

Anonymous Coward | about a year ago | (#43538099)

Politicians, police, and heads of major bodies are trained to answer "I can't remember" to questions where a refusal to answer is not permitted.

By Law, in the USA, the statement "I cannot remember" can NEVER be categorised as lying (without a freely offered self-confession of this fact). Understand that the USA is one of the obscene nations where lying to law enforcement goons is a serious criminal offence in itself, whereas the same law enforcement goons have full State authority to use lies as a tool of investigation and interrogation. The reason every lawyer in the USA states that you must NEVER talk to law enforcement goons without a lawyer present is because of these facts. Innocent people can be lawfully converted into criminals in the USA, simply by how they respond to a manipulative and dishonest line of questioning.

Even in the UK, lying to law enforcement goons is not a criminal offence in and of itself (at worst, you can be charged with wasting police time- but there the lie has to be one that suggests false details about a crime that cause unnecessary and useless investigation).

All nations can 'force' a person to reveal a password under some legal principle or other, if the circumstances are right. 'Force' means, of course, that a refusal to comply is a crime. "I cannot remember the password" will work for any elite individual who actually exists above the law (like senior 'banksters' in the USA). It will not work for an ordinary target of law enforcement.

Good lawyers always offer cynical advice. How often have you read stories of famous Americans refusing to be breathalysed at the scene of a DUI incident. The lawyer has trained these clients that the penalty for refusal is FAR lower than the penalty for being found DUI. Forced decryption follows the same logic. For political targets, the USA uses the obscene system of 'contempt' and sequential re-incarceration- effective turning the penalty for the offence into one of life in prison.

The argument about "reasonable suspicion" is an interesting one. It does, however, smack of turning 'presumed innocent' into 'presumed guilty'. Should the command to force decryption be accompanied with a promise that only the expected incriminating digital evidence be used against the individual, and that other illicit digital content that may be found with no relationship to the current case should be ignored, if it proves that the expected material is NOT present within the digital 'safe'?

In other words, if law enforcement goons are wrong about you with their current claims, should you be forced to incriminate yourself over an unrelated 'crime'? After all, if you reward law enforcement goons for engaging in 'fishing expeditions', clearly this tactic will only grow.

Those darn dems (1)

WindBourne (631190) | about a year ago | (#43538195)

They are following the constitution. Now the neo-cons will be upset about that and insist that their buddies at SCOTUS to overrule the 5th.

"Reasonable Belief" (0)

Anonymous Coward | about a year ago | (#43538285)

I realize the last sentence is just commentary, but the language of the 4th Amendment is specific. It says that "no warrants shall issue but upon probable cause". There has been a surge in people (including the head of NSA) claiming that "reasonable belief" is sufficient, but they are wrong. Also, the warrant must be specific as to what is to be searched for. Naturally cops get warrants that are as broad as possible, but they still sometimes get overturned for being "overly broad".

They key in this case is that the prosecution could not claim to have a reasonable belief that the defendant had control of the encrypted device. And the judge is ruling that the defendants use of the key to unlock the device would, in essence, be admitting to the police that he _did_ control the device, which would be an admission of guilt.

So if they have probable cause to search your encrypted drive for contraband, you can be compelled to produce the key. If they don't have evidence that contraband exists, or that you were the person with control of the device, they no longer have probable cause for the search.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...