Hacker News Reader

Comment by iandanforth | Hacker News Reader

Legal yes, right no.

In many situations you cannot be forced to provide evidence that would be used against you or information which would lead to such evidence. I would go further and say that in all cases you shouldn't be required to provide such information.

It should be recognized as a basic right that you do not have to aid those who are trying to convict you of a crime. Our system of justice is adversarial for good reason and it is explicit in forcing those with the most power to limit the use of that power for the benefit of the accused. Without those checks and balances (and frequently even with them) abuse of that power, under the auspices of a greater good, would be common.

View on HN

The law draws a distinction between being forced to testify against yourself (which essentially has you creating evidence to be used against you), and being forced to turn over evidence in your possession which may be used against you. The latter isn’t indicative of an abuse of of power. The pre-existing physical evidence is what it is, and proves what it proves.

Your proposal is also unworkable. Should companies not be required to hand over corporate records, because those might implicate them in a crime? Should a murder suspect be allowed to deny police access to his shed, where the murder weapon might be hiding? A bedrock principle of law is that “the law is entitled to every man’s evidence.” The whole point of warrants is to reconcile that principle with private property—to create a structured way for police to access private property to get access to evidence. Your proposal isn’t a “check” or “balance”—it obliterates that principle. It allows wrongdoers to hide evidence of their crimes even against a valid warrant.

While I generally agree with you, a court order to provide a password does bring with it a few problems.

1. Sometimes knowledge of the password itself could be considered testimonial. If there is doubt as to whether or not the an individual owns a particular computer, then being forced to provide the password is tantamount to being forced to concede ownership, which would violate protections against self incrimination.

2. People do legitimately forget passwords, and the courts have no way of distinguishing between people who have genuinely forgotten and those who falsely claim to have forgotten. Being subjected to indefinite detention for forgetting a password would violate due process, while keeping someone in jail until they comply with a legal warrant is legitimate. Since the court cannot distinguish between these two cases, any penalty the court may impose for contempt runs a variable (depending on the facts of the case) but non-zero risk of being a miscarriage of justice.

That second scenario has always fascinated me. What's the burden of proof for contempt of court? Forgetting a password seems plausible to me. Anyway, reminds me of this reddit post: https://www.reddit.com/r/IAmA/comments/afib1/truecrypt_and_t...

That's probably a made up story or at least not accurately told. That's not how the legal system operates.

Which part of the legal system isn't expressed accurately there? I'm asking out of my own ignorance, not as an accusation, I've only been a juror once.

It would be extremely unusual for an investigator to continue an interrogation after a direct request for an attorney.

The FBI wouldn't execute a search warrant and miss a bunch of drugs and drug paraphernalia.

You don't get jailed for obstruction on the say so of the FBI.

The Judge doesn't interrogate the defendant ever.

Like the guy in the OP you don't get to just refuse to provide the PW. The Judge would hold in contempt.

A Federal judge wouldn't order property held by the local PD returned. And why would they have it if the FBI conducted the raid and was doing the forensics?

Excellent explanation, thanks. The story was definitely suspect, but I entirely missed the FBI involvement at all. Why couldn't a federal judge order the return of property in a case? Is it a jurisdictional issue, i.e. if for some reason the local police had it, that would require a municipal judge?

What if the software on the phone, hypothetically was able to detect you beeing in distress and would stop complying to even the correct password if you are clearly coerced?

A second self destruct password

This is why when raiding a "hacker" LEOs were[1997] supposed to take immediate physical control of the device and not believe anything said "hacker" tells them about the device. now that mobiles are more common than desktops, but not commonly controlled entirely by the user, heuristics have become sloppy.

"Assume That Every Computer Has Been Rigged To Destroy Evidence"

https://www.govtech.com/magazines/gt/Computer-Evidence-Proce... [1997]

"Alexa ! Im scared!" -would you like me to dial 911? "No Alexa,Hide!" -OK, they cant find me now.

> Should a murder suspect be allowed to deny police access to his shed

A more accurate analogy is forcing the suspect to help the police in accessing his shed.

I would argue that the privacy of the state of your mind (including knowledge of any passwords) is very far removed from the privacy of the state of your non-person property, and deserving of complete protection in all cases.

With regards to "state of mind" evidence, the general distinction that has been applied to other things, and one which I think makes total sense, is that state of mind evidence is protected when the existence of the knowledge itself is incriminating. If someone left a phone at a murder scene, the fact that you know the password to the phone is itself incriminating. On the other hand, if it's undisputedly your phone, and police are just looking for what's inside, then ordering you to provide the password is no different than ordering you to provide the key to your desk drawer.

I thought the only way you could use contempt citations to compel testimony was to immunize the subject. Has this guy been immunize for any crimes that may be revealed by the testimony, ie telling his password, that he may give?

There isn't a supreme court precedent yet for whether forcing someone to disclose a password is equivalent to compelling testimony. The 11th circuit court of appeals says it is, which should be binding in Florida. They're apparently using a district court ruling that says something else, so there's probably some subtlety at work.

Possible subtleties include:

* Is requiring someone to enter a password into a computer equivalent to compelling them to disclose it?

* Is compelling someone to confirm or deny knowledge of a password forced testimony because it implies the person has control over the data that password protects (assuming that's not established by other evidence).

* Is compelling someone to produce the unencrypted contents of a storage device equivalent to compelling them to disclose the password or key?

But a password isn't evidence, it's testimony. The Supreme Court has held that you don't need to turn over "contents of the mind". The example of Wikipedia uses a bank password as an example [1]. In fact even the act of turning over the password demonstrates that the defendant had control of the device and could easily be argued to be self-incriminating.

Also, think about the implications of this. What if the person being ordered to hand over the password says "I forgot"? How do we know if they have genuinely forgotten the password?

1. https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_...

It may or may not be testimony. The Wikipedia example you’re referencing turns on the fact that knowing the password to the account proves ownership or control of the account, which itself may be a fact relevant to the charges. For example, if the account is connected to know money laundering. Turning over the password to a phone may or may not reveal similar information. If the phone was found at a drug stash house, knowledge of the password reveals a connection to the crime. If it’s just your phone, and there is no doubt it’s your phone, knowledge of the password doesn’t in and of itself reveal anything.

Testimony is stuff you’d tell a jury. In the bank account example, you’d tell the jury: this account was used by the criminal, and the accused knew the password, it must be his account. You wouldn’t tell the jury “the accused knew the password to what was undisputedly his own phone.”

The same thing that happens when you make any excuse for not complying with a court order: a judge or jury decides whether or not they believe you. There is occasionally a gray area, but most of the time lies are obvious.

If you attend a trial, you'll hear a lot of things you either do or don't believe, and not many will be gray.

If an otherwise normal person claims to have forgotten the passcode to their phone that they used every day, few judges would buy it.

> What if the person being ordered to hand over the password says "I forgot"? How do we know if they have genuinely forgotten the password?

I'm curious what case law there is there for this situation.

I change my passwords fairly frequently using a password generator, so if I don't use the password regularly, I forget it quickly. If someone brought me an old laptop of mine, it's more likely than not I genuinely wouldn't remember the password for it.

Also, there's the situation where someone isn't sure if the order to give their password is legal, so a court battle ensues for a year, but then even if they lose at the Supreme Court, what if in that year they forgot their password simply because they hadn't used it in so long?

They are clearly "fishing" for other charges or suspects, if it where a more serious crime be sure they will find evidence, we know access to the device it's not completely necessary, they can get location, call registers, social media info and so on.

All true, but there are many downsides to the adversarial approach so we should consider exploring other types. The most obvious downside is an adversarial system police and the state will default to intimidation because that's the most effective tactic on most people. This manifests most perniciously in the case of plea bargains. Economic analysis of criminal justice has led to an approach of deliberately threatening people with wildly disproportionate sentences because it's a powerful incentive to plead guilty to lesser crimes and keep the costs of running a prosecutor's office down. It also promotes an unhealthy zero-sum approach to justice where in order for me to win you must lose. We're seeing now how things work out when that attitude shapes the cognition of national leaders.

Most people think they can make a better adversarial system by tweaking this or that rule, but the unwanted outcomes are baked into the adversarial approach. What works between individual humans (more or less) doesn't translate well to conflicts between individual humans and collective entities which constitute facets of the state, bth because of the yawning asymmetries involved and because the state is necessarily and unavoidably schizoid due to the distributed nature of its consciousness and that of those who comprise its cellular elements.

Legal not so solid...courts have previously held that private free speech is protected see encryption battles during the invention of RSA for the court cases...also noted in many of Lessig's books...if device has private info force them to get the warrant as than you have legal rights to have your case argued before a judge..cops are INVESTIGATORS and not trained to know the law..

>In many situations you cannot be forced to provide evidence that would be used against you or information which would lead to such evidence. I would go further and say that in all cases you shouldn't be required to provide such information.

If you have illegal materials in your home, and the cops present a warrant to search your house, should you have the right to shut the door and not let them in?

You should not be required to assist them. If they can get in on their own with a warrant, that's fair game.

An online persona soliciting child pornography has their IP traced to an individual with a criminal history, registered on a sexual offender database. The police have probable cause to believe this individual has and distributes child pornography.

A judge signs a warrant to perform a forensic search of the individual's hard drive. The individual refuses.

So then, it's just tough shit for the police right? Given that they can't get in on their own with a warrant.

I mean, you've got the right to not answer the door. They just have the right to break the door down because of the lawful warrant. You don't have to help with your own incarceration, i.e. point out evidence they were unable to find, why would you be expected to do the same thing on their phone? Police can't force people to testify either. If your only evidence of a crime rests on the defendent's compliance you've got a poor case. If you can't tie an IP to a device on a specific date and time without forcing someone to open their own device and admit guilt and ownership, then you're really not trying hard enough. The only way that the police can prove who committed a crime on a cell phone that is encrypted is either admission of ownership or compulsion. Neither of which is evidence of a crime in and of itself. They would still have to prove that the person who owned the phone committed the crime, otherwise why have the burden of proof on the prosecutor? These aren't civil cases we're generally talking about where the evidence requirement is lighter these are criminal cases where, as far as I understand anyways, the burdens are much higher. Add to that a cell phone is essentially a tracking device. While your position is certainly a reasonable one to take, I don't think it truly encapsulates the intent of our court system as designed and in fact expressly works against innocent until proven guilty.

Reply on news.ycombinator.com