Hacker News Reader

Comment by libertymcateer | Hacker News Reader

> A possible answer to the first question: Alice is not compelled to provide the key. She is compelled to decrypt the drive. Obviously she can't do that without Bob. Alice is screwed and will spend the rest of her life in prison.

Yes, and in this scenario she would not be held in contempt, so your hypothetical does not apply.

You can only be held in contempt for refusing to comply with court orders, not for the failure of a desired outcome.

Let's put it another way: you are totally misunderstanding why this fellow is in jail. It is not because the hard drive remains encrypted - it is because he defied a court order to decrypt it. Granted, if the drive were decrypted by other means he would likely be let out of prison because the point of holding him for contempt would be frustrated - but that does not mean that he was put into jail because the drive was not decrypted. Contempt is solely about defying court orders.

If Alice gave over her half of the key, she would have complied with the order, therefore, there would be no grounds for contempt.

View on HN

There's no observable difference between inability to produce a result and refusing to produce a result. How do they know he didn't just forget the password? Or that the password was recorded somewhere that he no longer has access to? After sitting in jail for many months, it is very easy to forget a password that you no longer use regularly.

There's also no directly observable difference between killing with or without intent, which is why we have murder trials. The ability to decrypt data can be inferred from the surrounding circumstances, which is what happened here[1]:

> The defendant did not testify at the hearing and did not offer any other evidence or testimony in support of his contention that memory failure prevented him from complying with the court's order. On September 14, 2015, the court issued an order granting the government's motion, App. 6-10, finding that Doe was engaged in a “deliberate ruse” in claiming memory failure as to the external hard drives and that he intentionally disobeyed the court's orders directing him to decrypt the devices.

[1] Government brief, p 12: https://arstechnica.com/wp-content/uploads/2017/02/fedsrawls....

Yes, the court system exists precisely to determine fuzzy things like this.

I'm still curious, what kind of evidence or testimony might be considered believable in this case. Whether someone remembers a particular sequence of words and symbols seems like a thing that's very hard to determine, and by its nature it's unlikely there is any evidence either way.

From the quote you give (and I'll admit I have not read up on this case beyond the article, so it's possible I'm missing something), it sounds like he claimed he didn't remember the password, the court responded with "I don't believe you because you haven't proven that you don't remember it, so have fun in jail until you decrypt."

How would you prove, if you were brought into court, that you don't remember a specific password?

By giving credible oral testimony. The defendant chose not to do that, perhaps because it would have exposed him to cross-examination, and perjury charges if his implausible story was rejected (he remembered other passwords and had been caught with child pornography on other encrypted volumes, and the government may have had evidence about how recently and frequently he had decrypted the external drive, because they were able to decrypt his OS drive). Hopefully, if you really did forget a password you'd be able to give a believable explanation that holds up under cross-examination.

>credible oral testimony.

So the system as it stands is you can be jailed indefinitely because a judge does not believe you actually forgot a password? That doesn't sound ideal.

He gave no testimony, so there's nothing to disbelieve. Everyone has the right to not self incriminate, but that's not a get out of jail free card.

Honestly, what do you envision as an ideal system? The legal system can't be structured like software. You have to be able to cope with unknowns, things that cannot be proven 100%, and people who won't cooperate. This stuff isn't binary.

Regardless of cooperation I disagree with indefinite detention. Write a law that requires you to hand over a key to law enforcement(this will likely require a constitutional amendment) with a specific penalty or follow the constitution as written.

well you can start by codifying your laws and getting rid of juries. there's different types of legal systems.

https://en.m.wikipedia.org/wiki/Civil_law_(legal_system)

civil law / roman law, as used in a large part of the world including Europe. (different from civil law as the term is used in the US)

things are quite a lot more clear cut if you just codify (yes, exactly like code, our law books look like code in human language, precisely worded) instead of reinterpreting the law on case by case basis and some ancient writings reinterpreted to fit a modern setting (even they were made by smart folks, it's still almost religion)

This doesn't answer the parent's point. Most cases turn on the facts, even in civil law systems. Defendants still get locked up when judges don't believe them, and judges can still get the facts wrong.

Most U.S. federal law is codified, including the contempt provision that applied here (18 U.S. Code § 401). Codification does not remove the need for courts to resolve ambiguities. The constitutional right in this case is a good example: there is no explicit privilege against self-incrimination in the European Convention on Human Rights, yet the European Court of Human Rights has found that Europeans do have this right, and has explained its scope by 'reinterpreting the law on a case by case basis' [1].

[1] http://cardozolawreview.com/Joomla1.5/content/30-3/ASHWORTH....

Preposterous. Are you serious?

If I ask you to sink 10 baskets and then 0 baskets are made, there is an extremely obvious difference between 10 airballs and refusing to step onto the court.

Stop thinking like a software engineer and start thinking like a human observer. The court system does not use Jenkins to test conditions in the real world - the court system's "runtime" are the faculties of observation and reason of the judges and juries. There are countless, extraordinarily obvious differences between refusing to comply with an order and complying with an order but failing to produce the desired result. In other words, humans do not judge compliance based on satisfaction of test conditions that have to be written down and then run by a computer - they use their own eyes, ears and brains.

As a result, the difference between genuinely not remembering a password or trying, but failing, to decrypt a drive, is totally and obviously different than telling a judge to take a hike, claiming "fifth amendment" or giving testimony that is obviously untruthful. Frankly, this statement:

> There's no observable difference between inability to produce a result and refusing to produce a result

Is just outrageous. There is no difference between failing to detect the higgs boson and not even trying to detect it? I posit that these two scenarios are outrageously different: (1) building the LHC and not finding the higgs boson and (2) not buidling the LHC. Both situations have failed to detect the higgs boson - but they are, in all other respects, remarkably different. I genuinely cannot believe that you hold this point of view to be true.

There's no observable difference between trying and failing, and refusing by pretending. We can obviously observe an open refusal.

I disagree, and the court system is predicated on this idea.

Judging the credibility of testimony is not only one of the primary activities of judges and juries, but, again, I categorically do not believe that you truly believe there is no difference, whatsoever, in indicia or outward evidence, between telling a lie and telling the truth. It's not a remotely credible position to take. It is absolutely the case that humans can be very bad at judging the difference between lying and telling the truth, but the assertion that there is no observable difference is nonsense. It is the reason there are such a thing as "good" actors and bad actors. It is the reason that athletic events in movies are staged, as opposed to actually performed. It is why special effects exist.

Additionally, these judgments are made in context. You aren't judging the atomic, context-less testimony of a spherical witness on a perfectly cubical witness stand suspended in an infinite vacuum. You are judging a human, sitting in a court, in the context of a whole host of other evidence and testimony. So, basically, you are making one of two claims: (1) that humans cannot judge the difference between truth and lies and (2) that it is improper for humans to make these judgments in the context of criminal justice. I disagree with both, but in this case all that matters is the latter - I will cede that it is often the case that humans mess up on individual judgments, but this does not mean that putting humans in charge of these decisions is not the best option we have when it comes to criminal justice.

What you are pointing out is that justice gets tested at the edge cases - and what we have here is an edge case. I understand the engineer's desire to have proof-positive, objectively testable indicia to differentiate between different case-states - in this instance, the difference between being a convincing liar and telling the truth - but that is the central reason we have a court system that is populated and run by humans and not machines. Our "best guess" is what it comes down to. This does, in fact, result in miscarriages of justice - there are supposed to be correcting mechanisms built into this system to compensate for this as well, and the general release-valve for these errors is the idea that you are supposed to be innocent until proven guilty. We have, in fact, stumbled upon a bug in this system here - judges can incarcerate individuals for contempt indefinitely, and this should not be the case. There are other factors going on in this circumstance that render the issue more complicated, and there are ways to address this bug with procedure - hearings, appeals, evidentiary testimony or expert testimony - but to simply state that the solution is to make the system recognize that it is impossible to tell the difference between truth and lies is an absurd notion that totally undermines its very foundation. It is not just throwing the baby out with the bath-water - it is then bulldozing the house too.

It is a primitive, or axiom, of the court system, that humans can be asked to make value judgments about the truth and falsity of assertions presented to them and to judge the veracity of the witnesses making those statements. If you categorically disagree with that axiom, you disagree with the entire jurisprudence system. In this case, I'd like to quote Churchill, when talking about Democracy:

"It's the worst form of Government, except for every other."

If you have a better idea about how to run the court system, I'm all ears.

In my attempt to be clear about the piece of your rant I was calling attention to, I was imprecise. Your previous comment had been directed at asserting there was obviously a difference between someone verbally stating refusal and someone attempting to comply. I can see how you could choose to read that into what the other poster said, but it is not a charitable interpretation.

> There's no observable difference between inability to produce a result and refusing to produce a result.

I don't see how that is open to interpretations, regardless of charitability. I think it is total, unabashed poppycock.

> How do they know he didn't just forget the password? Or that the password was recorded somewhere that he no longer has access to?

Credible testimony and other evidence.

> After sitting in jail for many months, it is very easy to forget a password that you no longer use regularly.

Right, and that is not the issue. Obviously the judge did not find this guy to be credible in the first instance.

That having been said, I'm a corporate lawyer, so my apologies if I was unnecessarily aggressive in my reply to your post. It is something I always have to watch out for, but your points are appreciated and thanks for taking the time to engage.

> I don't see how that is open to interpretations,

I can see a few things the author might be trying to convey. The most interesting would probably be "[There are cases where t]here's no observable difference [...]". I think the alternative I suggested ("[...] produce a result while pretending not to.") is better supported as the authors probable intent (while being a stronger statement and correspondingly less likely to be accurate).

In any case, pragmatics + charity should tell us someone wasn't asserting we can't tell the difference between a person saying "I can't" and a person saying "I won't", and if you can't figure out what else they might have meant the first thing to do is ask.

> it is very easy to forget a password that you no longer use regularly.

Heck, some weeks ago I forgot part of a passphrase I did use regularly. Fortunately, I remembered enough of it that I could feasibly brute force the rest.

From the article: "Rawls, the government argues, (PDF) "repeatedly asserts that the All Writs Act order requires him to divulge his passcodes, but he is incorrect: the order requires no testimony from [Rawls], and he may keep his passcodes to himself. Instead, the order requires only that [Rawls] produce his computer and hard drives in an unencrypted state.""

Ah, yes... the legal equivalent of "I'm not touching youuuuu...."

That's like being forced to translate your own notebook written in code.

Not my problem, get your own codebreakers to do it.

It's different because you can't verify the authenticity of the custom hand-rolled cipher. This is a request for the accused to produce the keys only, not to do the work of manually decoding.

In a way still testimonial. I must provide secrets that reveal information about myself.

It is literally the same as ordering me to tell them how to make sense of the unreadable data.

I'm not giving them a plaintext copy of something already existing elsewhere (assuming no unencrypted backups), but producing new information for them.

And unless you used FDE with full authentication (AEAD), which almost nobody does, there's nothing that says that this particular ciphertext represents the exact plaintext I've had at any given point in time.

With XTS mode (Truecrypt) you can cut and paste together different blocks from different ciphertexts under the same key for as long as they're in the right positions. Depending on how much you know about the computer and if you've got access to multiple backups, you can splice together something that even if it doesn't contain anything illegal, it would look suspicious and incriminating.

Consider for example LE getting your full file version history of a container from Dropbox.

And revealing the keys is a kind of testimony that you have had read/write access to the drive, and that it indeed is encrypted (not just random).

Isn't the grandparent quote stating the opposite of what you've said here?

Technically, maybe. The court's language is meant to clarify that the accused does not have to disclose his key, he need only unlock his disks. There is no reasonable expectation that this would require a significant effort or testimony on his part.

His case hinges on whether he can prove that the work necessary to decrypt the disks, which is understood to mean entering the keys which he remembers, is testimonial self-incrimination and thus illegal under the Fifth Amendment.

Believe it or not, most judges are aware of smartasses and are not required to accept "Well, I don't remember, and you can't prove that I do, so ha! You have to let me go now!" The evidence surely indicates that this man used his computer regularly, which necessarily required unlocking his disks, and that means that by all rational conclusions he is, or at least was, capable of complying with the order.

Until the court is fully convinced that he is no longer capable of complying, or until the order is dropped, modified, or stayed, Rawls will remain detained for his failure to comply.

> There is no reasonable expectation that this would require a significant effort or testimony on his part.

Whether or not this is true is precisely the crux of the matter. Your comment echoes the government's position: Decrypting the hard disk is not equivalent to testimony, and is therefore not protected by the fifth.

The defence and EFF's amicus brief argue instead that we live in a world where our phones and computers are effectively an extension of ourselves, and asking to decrypt those is equivalent to forcing you to testify on your most intimate secrets, which is most certainly not kosher.

> The evidence surely indicates that this man used his computer regularly, which necessarily required unlocking his disks, and that means that by all rational conclusions he is, or at least was, capable of complying with the order.

Well that is understandable but what if he burned the passwords just before he got arrested, heck he might even chewed them up and those are long gone. How would they find out? If he is a such dangerous child molester should they go full Sam L.Jackson Unthinkable style on him?

No, you're exactly wrong. The demand on Rawls is that he do whatever work is necessary to produce the drives in an unencrypted state. If he hid a printout of the password on Mount Everest, that means he is compelled by the court to climb Mount Everest.

I'm speaking in practical terms here. I haven't read the actual order, but I understand the language of the order may technically require him to do the work necessary to render his drives in a decrypted state. That's because they expect the only requirement to be entering the key.

If he had a password hidden on Mt. Everest and demonstrated that to the court's satisfaction, and then cooperated with the court's order to reasonably assist in decryption (e.g., allowing the court access to the sherpa that routinely retrieves this key and enters it to decrypt his disks via some remote mechanism), I assume he would be considered compliant.

This explanation (and the other forms in which it's presented in this thread) is really troubling to me. It sounds like in order to offer a defense of the inability to comply with the order, the accused has to provide evidence which could be used against him in the trial. In your example, the existence of the password on Mt Everest could be used against him, and was evidence the prosecution probably could not have discovered but for his compelled testimony. It's even more troubling in the case of the Sherpa: revealing the identity of an accomplice (as it were) is surely self-incriminating!

But if this were really how he obtains the password (and similar schemes of off-site passwords and accomplices aren't so outlandish in the case of servers which might require the keys on reboot a few times per year), how could he possibly defend himself from the contempt charge? It sickens me to imagine being in the same situation. If this isn't an instance of the cruel trilemma, I don't know what is =(

And that is the fucking problem. It's a principled issue and you admit that it is. What your arguing about is how much is enough to violate the principle. Since people can only agree on principles, you shouldn't kill, then the law needs to fucking operate on principle alone.

That does not change the parent's point – he is in contempt for refusing to comply, not for being unable to comply. Contempt must be willful: https://www.justice.gov/usam/criminal-resource-manual-753-el...

Yes, and the people who are holding him in a cage are the people deciding whether he is unable or unwilling. Not exactly any consolation.

Yes, the state ultimately decides whether someone's behavior justifies their detainment or not. Is this really news to you? Should they just let him go because he said "Shoot, turns out I don't remember!" How would any criminal justice occur if we let people off with flimsy excuses like that?

Most of the time, absolute certainty that someone is guilty is not possible; that's why the criminal standard is "beyond a reasonable doubt", not "proven to the point of mathematical certainty".

In this case, the simple fact is that the court does not believe Rawls's assertion that he is unable to comply, so he remains detained on contempt. This will change once the court is convinced that Rawls is indeed no longer able to comply.

> should they just let him go because he said "Shoot, turns out I don't remember!"

No, I don't think any private individual should be jailed for failing to decrypt data, regardless of whether they are able to, as part of a case wherein they are the accused. This should be a basic fundamental right of the accused, and I think the current working interpretations of the fifth amendment are unjust.

> How would any criminal justice occur if we let people off with flimsy excuses like that?

Justice in my view is the presumption of innocence, with the duty to demonstrate guilt beyond reasonable doubt placed on the prosecution. Forcing accused to decrypt data obviously helps the prosecution, but so would warrantless searches, and I oppose both for precisely the same reason.

>Justice in my view is the presumption of innocence, with the duty to demonstrate guilt beyond reasonable doubt placed on the prosecution. Forcing accused to decrypt data obviously helps the prosecution, but so would warrantless searches, and I oppose both for precisely the same reason.

Warrantless searches are unjust because the police can come in and execute them without oversight. In this case, the neutral overseer (the court) has directed the accused to comply with a request from the investigators.

Warrants are a check against rampant tyranny. They are issued or declined by an independent judicial officer whose incentives are, at least theoretically, not aligned to favor either party.

Warrants don't exist because we think it's unfair to comply with reasonable requests from the organs of the state in the their pursuit of justice, even when you're among the accused. Rather, they exist to make sure that the requests remain reasonable and fair and serve the interests of justice.

Like many things in our government, these are checks to limit and constrain the power of distinct government bodies and ensure that they do not get out of control. It is incorrect to assume that these restrictions exist for the convenience of criminal suspects, because they don't.

Just because one branch of government performs an action rather than another does not change my views of the action. A court cannot compel someone to testify against themselves just because they're the court, right?

No entity exists neutrally; that is fucking niave. Courts can favor accused police and political officials. The laws must then be designed not to act to grant power to an assumed neural party, but set the stage where all parties have equal power within the confines of the legal process. A fair race.

>This should be a basic fundamental right of the accused

Well, it's not, and that's a terribly naive viewpoint. This is akin to a legal search. Are you also against those? How is this any different than compelling a suspect to e.g. open a safe in their home?

It's very much unlike a legal search. Legal searches require no participation on the part of the accused. I do also oppose compelling an accused person to open a safe, but I have no problem with the authorities breaking into a safe with a warrant. Likewise I have no problem with the authorities confiscating a hard drive and performing any transformations to the data they please

Beyond a reasonable doubt does not mean "hurr guilty cause i tink u lying cause i don like ur face". Observers cannot be relied on to make correct judgements and the observers of the observers cannot be relied on to assess if they made a correct judgement. Indefinite imprisonment via unconstitutional contempt of court laws is the real issue here and not encryption.

How far can court orders go? Let's say he was a crooked accountant and the police couldn't understand his spreadsheet. Is he obligated to show him what he was doing?

To me this is what the disk encryption is like. The cops can't understand how to read the disk. Is he obligated to help them? What if the pictures in there are encoded using a weird format? Should he be forced to produce a program to read them?

How does the Fifth Amendment apply here?

What if the fellow made a sworn statement he doesn't remember his credentials? It happens to me on a regular basis.

IIRC, the I don't recall defense has worked wonders for others in the past.

I wonder if he had an encryption scheme that deleted the data in the event of n password failures and also something of legal value like bitcoins on the drive. Perhaps, then he could argue that knowingly attempting to log in using potentially incorrect passwords constitutes undue harm.

Such a scheme could probably be circumvented by making copies of the encrypted file (or the entire disk), or denying the decryptor write access etc.

Reply on news.ycombinator.com