Teenager jailed for refusing to hand over computer password
itworld.com
itworld.com
I do, however, know that such a law is morally reprehensible. Quite frankly, it is in the interest of the people to ensure encryption tools are entirely useable by criminals, gangsters, and terrorists, because that ensures they are entirely useable by lawful citizens as well.
Unlike guns (something possible to "defend liberty" as well as commit crime with), encryption has no victims, has no negative consequences. It can hide negative things, but it merely provides automation for knowing something you refuse to tell.
Edit: spelling
Which immediately made most of literature and theology illegal. You couldn't posses a poem or a bible unless you could explain to the police any hidden symbolism!
Pictures of the police kicking down doors and shouting "you're nicked - now explain what the poet really meant by a host of yellow daffodils"
http://ansuz.sooke.bc.ca/lawpoli/colour/2004061001.php
Computer programmers think, aha, I can apply an arbitrary algorithmic translation to input A and get output B, and applying the law to B would be absurd, so therefore applying the law to A is also absurd. What they fail to realize is that bits have color -- a type of metadata that law algorithms can see and operate on which your computer algorithms are ignorant of.
You think that encrypted contents of a computer harddrive is a logically equivalent operation to writing things in a form only comprehensible to oneself. This is only true if you're Colorblind.
This entirely depends on whether you view your computer as an extension of your personal consciousness or as being an external service that you're interacting with. I'd rather a society where computers act as individuals' agents, rather than people being at the mercy of the computers.
Big file that is storing your n-th computed prime : innocuous.
Big file that is storing pirated movie, even if called "n-th prime" : not OK.
In most (democratic) countries you do not have to cooperate with the police if they have a warrant. So they are allowed to search your house, they are allowed to break your lock/door, but you are not obligated to give them the key to your house.
It's already the same with digital things: The police can get a warrant and is then allowed to try to crack my password. But I'm not obligated to give them the key.
The difference is in the consequences of refusal. For a home search, it's usually in your best interest to open the door because it's really easy for the police to break it down. For an encrypted hard drive, it's nearly impossible to retrieve the data if you refuse to decrypt it.
In most countries the police don't get a search warrant for your head - except where you are wearing an orange jumpsuit and having water poured down your throat.
If you're referring to waterboarding, the water goes in your nose and sinuses, not your throat. And the amount of water used is very small.
The aim is not to drown the person. It is to trigger the drowning reflex. Which happens very fast when you are unable to move.
See http://www.youtube.com/watch?v=4LPubUCJv58 for a demonstration of how exactly it is done and what it looks like.
Edit: Indeed there has been a case, and so far the Fifth Amendment is holding strong: http://cyb3rcrim3.blogspot.com/2010/04/passwords-and-5th-ame...
This one is tricky. It depends on ones beliefs about the true reasons for the anti-self-incrimination laws. If you believe (as I do) that it is a fundamental right to remain silent whenever it could make your situation worse, then it is indeed analogous.
An opposing view is that not being forced to testify against oneself comes from other, more basic reasons. One of the "higher-order" reasons against forced self-incrimination might be that punishment for refusing self-incrimination gives incentive to false self-accusation. This one does not apply to forced revealing of passwords (you cannot falsely self-accuse in this case.)
In the case of the safe, if I refuse they'll just break it open. Strong encryption is not so easily broken so it may not be in my best interest to cooperate (whereas with the safe, it probably is).
Personally I think encryption passwords should be protected by the 5th amendment, but I understand the logic in saying it's not.
Personally I agree with you. My data is my data, and I should be able to do whatever I want with it.
I have a feeling that the transformation argument may fall pray to the "color of bits" problem but perhaps not. I think it may even come down the choice of algorithm - if I use a publicly available encryption algorithm then it might be considered a medium, whereas if I invent my own language maybe it won't.
As for the forgotten key, that's another argument. There is probably a burden of proof somewhere in there (and probably more on the side of the prosecution). If, for example, the police knew you accessed the contents of the hard drive last week, it would be pretty difficult to claim you forgot your key.
My opinion: If I write a poem in a notebook (hard drive) using a cipher (encryption) for which only I know the key, the law is able to take my notebook as evidence and process it as they see fit for their investigation, but the data is still mine, it's my set of bits which I'm entitled to not share with anyone unless it's my desire. I'd even say that to force me to share my data is equal to torturing me to get information from me. In both cases the law would be forcing me to reveal something against my consent, which is a violation of my rights however you look at it.
YMMV of course.
I had the opportunity to attend a public gathering with Jack Straw during the public consultation of this bill (he was the MP who introduced this law).
The issue of "what if you forget your password" is covered in the law, which basically says you have to know and keep control/ability to decrypt all encrypted media you own.
Forgetting the password isn't a defense.
(don't shoot the messenger, I think it's crap too, but I'm just saying they already covered that 'defense').
Now let's say you're in the middle of a murder case, and it is about to be thrown away because of lack of evidence. So they ask you to provide the key to your encrypted drive, but you've forgotten the key... So now do you go to jail on a life in prison sentence because of it? Do they let you go? Do they keep you in prison while they try to decrypt it which might take millions of years?
I can always say "I forgot, this whole ordeal has affected me psychologically and I can't seem to recall the key because of it". Then what happens? I go to jail for 4 months? Which might be a total injustice since there's a possibility it's actually true. Or maybe it's a loophole for a crook because he might have had to serve life in prison, and now he's only doing 4 months thanks to encryption.
A judge can easily send you to jail if there's proof you did something. The same way your girlfriend can easily send you packing because she has proof you cheated. The question is, can you send your girlfriend packing for cheating if you have no proof? If you have no proof then you're sending her packing because of an idea on your head (not real fact and you might be wrong), which is hardly fair and will probably be looked at with contempt and frowned upon by peers (read the rest of the world). Now can the state send you to jail because it thinks that you have child porn on your hard drive, without ever proving you have it?
What happens then when the state has the power to lock you up without proof?
I don't think you do.
<i>I can always say "I forgot[...]" Then what happens? I go to jail for 4 months?</i>
No, you go to jail for a few months and then they take you back to court to see if your memory has improved. If you don't have the key or if you produce a key that doesn't reveal the data they wanted it to, you go back to jail for longer.
If you can't produce the data the state demands, either because it isn't there or never existed, or because you really forgot, then you can stay in jail the rest of your life.
That is the purpose, goal, and implication that so-called law enforcement wished for and got from data investigation rules.
I remember reading about a guy who was basically given an indefinite jail sentence in a civil case because the judge didn't believe that he really lost all his money is poor investments.
However I remember that the article highlighted the distinction between criminal and civil cases.
Heh. Would love to see them take that at face value. "But officer, I need this list of Blu-Ray disk keys. Otherwise, I can't decrypt all my movies the way I'm legally required to!"
And that would explain why I heard of people emailing him encrypted documents / random bits. I'm sure he knows how to decrypt those.
So you're right, it is crap.
The law is fuzzy on the issue of someone emailing you an encrypted archive you didnt have the password to.
If that works, I might try telling them that the file they can't open is a DRM'd media file which I no longer have rights to and do not own.
For some people, that might even be true.
Also, since encrypted data, if done properly is very hard to distinguish between random noise, and people often use writes with random noise as a secure erasure technique, it could also be that you erased that data? That is a thorny issue as well.
Is "I erased the data on that drive securely using random bits" a valid defense?
Encryption doesn't hide negative things, people hide negative things. Almost like guns don't kill people, people do.
http://news.ycombinator.com/item?id=1760700
It's very likely that any comments here will cover the same ground, so if you're interested in might be worth reading the comments there first.
I repeat that I'm not arguing that the law is right. I'm merely pointing out that he is not innocent of the charges for which he is imprisoned.
I'm also pretty sure there are similar or analogous breaches of what one might call natural justice in the USA - I'm sure someone can provide examples.
Actually it can and does. If a judge compels you to turn over your password as a part of the discovery process and you refuse then you can be served with a contempt warrant and go straight to jail without trial and with limited possibility to appeal.
On December 17, 2006, defendant Sebastien Boucher was arrested on a complaint charging him with transportation of child pornography in violation of 18 U.S.C. § 2252A(a)(1). At the time of his arrest government agents seized from him a laptop computer containing child pornography. The government has now determined that the relevant files are encrypted, password-protected, and inaccessible. The grand jury has subpoenaed Boucher to enter a password to allow access to the files on the computer. Boucher has moved to quash the subpoena on the grounds that it violates his Fifth Amendment right against self-incrimination.
The district court held that Boucher could invoke the Fifth Amendment and refuse to comply.
http://cyb3rcrim3.blogspot.com/2007/12/court-upholds-using-f...
They later worked around it by requiring him to provide the decrypted contents of the drive instead of the password itself since a border agent witnessed some of the files on the drive and he wouldn't be providing new evidence.
http://cyb3rcrim3.blogspot.com/2009/03/5th-amendment-bummer....
Why not have two passwords: "foo" and "bar".
If I type in "foo", I get my stuff. If I type in "bar", it may selfdestruct the data, but at least it will show a different content.
So I create a 100GB container, and reserve 10GB as dummy content, maybe 1 mio. copies of the constitution, which will show up with "bar" as password. So I have a password for the police, and everybody is happy.
I think they call them shadow volumes...
2) Call the police.
3) ???
1) While it is true to say you are protected under First and Fifth Amendment rights from having to disclose a password here in the US, it doesn't cover border inspections (including airport custom/immigration, where it is considered you are in 'no mans land'). The legal issues of this are currently going through the courts based around the number of people who have had their laptops searched (passwords are requested at the time of the search if necessary). But even if this is resolved, it probably will only apply to US Citizens and not visitors.
2) The chap who has gone to prison for not disclosing his password will go back again for another term if he doesn't disclose the password when he is released. Someone mentioned "maybe it's better to server 90 days in prison for not disclosing the password then to be caught with something more incriminating on his hard drive". That is mitigated by the fact that each request is treated separately so he could be in prison indefinitely if he doesn't comply :/
3) I've always thought a great defense would be to have your password something like "gofuckyourself" or "obvious". That way if someone asks you for your password you can say "go fuck yourself" or "dude, it's obvious". When you go to court you can say "no, I fully complied. The password was 'gofuckyourself'"
"If Alice has stored her key on a diskette or a smart card, and if Polly is certain of its existence and Alice’s possession of them, she can summon Alice to deliver it – at least, in the United States she can, and also in European countries, according to the European Court’s decision in Saunders. In the Netherlands, article 107 paragraph 1 DCCP, however, prohibits Polly from commanding delivery from suspects."
Further on (page 11) goes on to state that a key that doesn't exist in the physical plane might be considered admission, and therefore protected. That is unless it is demonstrated that the suspect used the same key (elsewhere) recently -- in which case it's already "admitted" by the suspect and the s/he needs to deliver the key.
http://rechten.uvt.nl/koops/THESIS/cryptocontroversy-ch08.PD...
Are they right? Well, that's not something I'm going to speculate on, but I believe the judicial system will push as hard as people expect/will permit them too. If the encrypted data was stolen e-books, I doubt they'd be so very harsh.
I think it's bollucks, however. I think you should have no punishment for refusing to help convict yourself, regardless of what you may have done.
✓ Original article omits context.
✓ US Constitution does not cover the British.
✓ Already covered. http://news.ycombinator.com/item?id=1760700
No discussion required.
Edit: not meaning to complain, I was trying to sort out if it was the Unicode, the tone, the list format, or the "no need to discuss" which is probably a bit rude.
I was hoping to make a quickly read mark that would let people know HN had already been over this ground and there was nothing new in the article, but I failed miserably.
✓ Old story (September 1, 1939).
✓ Thousands of articles likely omitting full context.
✓ US Constitution does not cover the British.
✓ Already covered. http://news.ycombinator.com/item?id=1507526
No discussion required.
If he had been released and nothing further had happened, maybe you could say "No discussion required".
In any case, if I was him I wouldn't worry about them decrypting the data in my lifetime. Do you know how many millions of years would it take to decrypt a 50 random char pass phrase decent encryption. Lots of those. So unless there is a breakthrough on computing power several magnitudes bigger than what we have experienced and the money to dedicate millions of computers to the cause, or someone finds a loophole in the encryption algorithm (highly unlikely if using any type of military grade encryption), his data won't be decrypted.
It's a race between the statute of limitations and encryption/computing technology. (I do agree it seems unlikely).
50 characters x 8 bits = 400 bits of entropy
Even if you account for not having backspaces and linfeeds in the password, he could still easily have 256 bits of entropy.
Even with Moore's law, a strong algo like AES-256 is generally considered to be uncrackable, assuming the algorithm and the implementation don't have any flaws.