Hacker News Reader

> The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th.

This is a really subtle point, but in the US this is not (usually) the case, because this is still self-incrimination. You see, by entering the password, you are demonstrating that you have access to the encrypted information, and demonstrating that you have that power is technically self-incrimination. The password is one piece of information that you can't be compelled to divulge, and the fact that you have the password is a separate piece of information, and you cannot be compelled to reveal either. This is also a really important piece of information too, because in order to stick you with any legal consequences associated with the encrypted information, they generally have to prove that you have control over or access to the information. If a file is encrypted it is still possible to reasonably doubt that you have access to its contents despite having access to the physical drive it is on.

While it is (currently, as far as I am aware) untested in the court of law, it may be possible to compel someone to use or divulge their password if this does not incriminate the person to do this. I can think of two ways this could happen: a) access/control to the encrypted information has already been proven, so the testimony is of null value b) the prosecution is not allowed to use the fact that you know the password in court, and takes the gamble that they can prove access/control some other way (possibly by using contents of the information).

This is, of course, assuming that passwords are classified as "testimony" and therefore protected by the 5th Amendment. If the password is ever recorded on a physical medium such as a piece of paper, that piece of paper is probably not testimony, but rather evidence. This means that, like the key to a safe, it is protected by the 4th Amendment rather than the 5th, and you can be compelled to give up the paper via a warrant. This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick?

(IANAL, but I've studied the topic as a layman)

View on HN

"but the Court has never on any ground, personal privacy included, applied the Fifth Amendment to prevent the otherwise proper acquisition or use of evidence which, in the Court's view, did not involve compelled testimonial self-incrimination of some sort." "The taxpayer cannot avoid compliance with the subpoena merely by asserting that the item of evidence which he is required to pro- duce contains incriminating writing, whether his own or that of someone else" "The existence and location of the papers are a foregone conclu- sion and the taxpayer adds little or nothing to the sum total of the Government's information by conceding that he in fact has the papers. Under these circumstances by enforcement of the summons 'no constitutional rights are touched. The question is not of testimony but of surrender.'"