Hacker News Reader

Comment by xenophanes | Hacker News Reader

I realize this story is in the UK, but could it happen in the US or would the 5th amendment protect you?

As an American, it seems a bit insane to me for someone to be jailed for refusing to help convict himself.

The 5th amendment protects against forced testimony, not against compulsion to provide evidence. You can refuse to testify against yourself, you cannot refuse to comply with a valid search warrant.

Testifying is providing information to the court. Decrypting your hard drive is providing information to the court. What's the difference?

I would argue that all evidence is really just information. Once again, the old lines dividing one category from another become blurred.

The difference is that testimony is revealing the contents of your brain ("I saw X, I did or did not do Y, I felt Z") and evidence is revealing the contents of your car trunk. Evidence does not have its own opinion of what did or did not happen, evidence does not decide what is or is not the truth. Evidence simply exists; it is for others (giving testimony) to give evidence context and relevance.

The password is among the contents of your brain.

It's not the password they want, it's the evidence in side the "safe" that your password protects.

You're compelled to provide access. You could probably make a legitimate case for not actually revealing the password if you provided access for them.

damn. that's a really good point, but i still think it'd fall under the 4th. A password is closer to providing a key to a locked door rather than testimony.

It would be interesting to know if there was ever a hybrid case where there was a password-protected door with a numeric keypad, and someone refused to give the pw. I'd assume in a case like that, however, the cops would just smash shit out of it.

Perhaps a solution is to commit two crimes: crime A which has to do with the encrypted file, and crime B which has nothing to do with it. Then, use a phrase which is self-incriminating for crime B as the password for the encrypted volume. For example, "IBrokeTheSpeedLimitBy15MilesPerHourOnJuneTheTwenty-Seventh,InTheYearTwoThousandAnd4".

In which case the judge would compel you to reveal your password to your attorney. The attorney would not be able to reveal the password as that would violate privilege, but they would be compelled to uphold the terms of the valid search warrant on the decrypted data.

Well, suppose that you do give them the unencrypted file. They already have the encrypted file and presumably are aware of the encryption scheme you used, so (this could be totally wrong, as I don't know enough about encryption) they should be able to figure out the encryption key.

Any encryption scheme that is not worthless does not work that way. If you have the plaintext and the ciphertext (but did not get to choose the plaintext to be encrypted) then you are still no closer to getting the key.

I thought remembered a court precedent in the US that ruled being compelled to divulge encryption keys was equivalent to being compelled to hand over keys to locked places (like a safe), which is historically required.

That said, I can't find such an article, so hopefully I'm making it up and we are indeed safe in our minds.

No legally in the US you are not required to give the keys to the safe, but they can drop your sentence significantly for working with the investigators. For a safe, if you don't give them the key, the get a grinder and hack saw, for an encrypted hard drive in the US they give it to the NSA (though 50 chars would be tough for even them i'd expect).

The NSA doesn't want anyone to know what their capabilities are, but I remember a case where they gave it to a university which threw a cluster at it...

edit: 'they' being 'the authorities', not the NSA.

There's United States v. Boucher but case had a couple of wrinkles, including the fact that Boucher had previously cooperated with law enforcement so it was thought that providing a password wasn't self-imcrimination since it wouldn't add to the knowledge of what the authorities already had: http://en.wikipedia.org/wiki/United_States_v._Boucher

I thought that also but then found this from 2008: http://www.usatoday.com/tech/news/techpolicy/2008-02-07-encr...

Reply on news.ycombinator.com