Hacker News Reader

Comment by richardthered | Hacker News Reader

The problem with forcing someone to reveal a secret (e.g. a password), is that ultimately, there's no way to prove that someone actually knows the password. If I say that I forgot the password, and a judge throws me in jail for contempt of court, I could rot there forever. There is absolutely no way for me to ever prove that I truly forgot the password. You can't prove a negative.

With fingerprints or face scanning, neither of these is an issue. You put your fingerprint on the device, or you scan your face.

So, I think that forcing someone to reveal a secret that is purely in their head is fundamentally different than compelling other forms of access (physical keys, fingerprint scans, face scans, etc.). The physical access methods can be verified to either work or not. That's not true for mental secrets.

View on HN

Francis Rawls is still in jail after 2 years for not decrypting his hard drive. He's in contempt indefinitely until he decrypts the drive.

Reminds of that guy in The Crucible that gets crushed with rocks for refusing to take part in the witch trial.

I do believe you mean Giles Corey.

https://en.wikipedia.org/wiki/Giles_Corey

However, that's a unique case, because the authorities know the hashes of the cleartext files on his machine match the hashes of illicit media. "Foregone conclusion" so long as you believe in the mathematics behind hash collisions.

How can they possibly know that?

If that is the case then there should be no problem convicting him.

They had access to the drive at one point.

In a filesharing seneario it is common for feds to see what you got before the raid that grabs the physical drive.

In the file sharing scenario, how would the feds know that the encrypted drive actually has the files? They can only know what they suspect is on the drive.

It isnt about absolutes. They can be reasonably certain that the drive was in use on a network.

Either what they have is enough for a conviction or it's not. If it is, then there's no need to actually get access to it, if it's not then it might as well not exist.

I don’t understand this. Are the hash values stored somewhere unencrypted?

You've completely misunderstood the law here, unfortunately, and argued something that that goes in the opposite direction of this ruling.

The law is actually that physical features/etc can be compelled because they are not testimonial.

“[i]t is compulsion of the accused to exhibit his physical characteristics, not compulsion to disclose any knowledge he might have.”

United States v. Wade

"“the task that Diamond was compelled to perform—to provide his fingerprint—is no more testimonial than furnishing a blood sample, providing handwriting or voice exemplars, standing in a lineup, or wearing particular clothing.”"

State v. Diamond (This is a state case but applying the federal constitution).

Note also that fingerprints are almost always taken at booking, etc. They just aren't transferable in a way that lets the police use them to unlock the phone.

Passcodes, on the other hand are often testimonial. Entering the combination to a safe proves you probably had ownership/control of the safe, for example.

In those situations, generally the government has to be able to prove that you own it. If they can, you will be forced to open the safe.

In the case of phones, the only interesting intermediate cases are phones where ownership can't be proven easily by other evidence.

(Note:I don't necessarily agree with these doctrines, but that is the current law)

> Passcodes, on the other hand are often testimonial. Entering the combination to a safe proves you probably had ownership/control of the safe, for example.

Is this not also true for face/fingerprint ID? Proving the face/fingerprint ID proves you probably had ownership control of the device.

No more than having it in your pocket when you get arrested, or it being in the apartment that you share with nobody else, etc.

> With fingerprints or face scanning, neither of these is an issue.

We treat biometrics like a secret (i.e. password), but really it's not much better than public information (i.e. username).

Will you consent to a brain scan then? Memories are physical. All secrets are.

X-ray scan?

Actually, there is a fingerprint in my phone. It isn't any of my fingers (I can't recall, maybe my elbow). Will I be in contempt of court for scanning my finger 'wrong'. I don't think my elbow will work a month later, it must have changed more than my finger.

I don't see why this is downvoted, parent brings up a good point. If a phone has a fingerprint or face lock, there is proof whose fingerprint or face (or whether it is a fingerprint or face) is the key. Is that knowledge not similar to a password? If the phone requires a PIN or passcode after say, 3 attempts, that's important information.

Reply on news.ycombinator.com