Hacker News Reader

Comment by DavidSJ | Hacker News Reader

US v Hubbell makes clear that the government cannot compel production of documents (except under immunity to prosecution) which it does not know, ahead of time, to exist.

View on HN

Then how can they compel someone to unlock a laptop to enable arbitrary access? Wouldn't they be limited to requesting specific documents?

The legal system allows them to do things analogous to that, such as compelling someone to open a safe to enable arbitrary access to the contents (as mentioned in the article). Presumably they must suspect that the safe contains documents relevant to the case.

Every case is a little different, but investigators do need probable cause to search a laptop.

This is a mortgage fraud case involving years of criminal activity, so I'm guessing that it's probably not too hard for the prosecution to produce witnesses who can say "yes, she sold me that crappy mortgage and used her laptop when I went to meet with her.", or direct information of her internet usage (ISP, or logs from cable modem), or observation of her using the laptop by police during the investigation.

So the moral of the story is, conduct your criminal activity via software running on an external server on a TrueCrypt partiton, and always interface with it via Tor?

Then they can't prove it's "your server" and thus order you to reveal the key.

(For example, if you have access to a credit card not in your name, you can set up an EC2 micro instance for free for a year. Then install TeueCrypt and be on your merry criminal way. What could the DOJ do?)

The DoJ would simply get a judge to sign an order giving their forensics lab a snapshot of the virtual machine with the key sitting decrypted in RAM. Amazon would be under a gag order not to tell you that they even had it (not that Amazon would even care to tell you anyway).

If they wanted to pin it to you, they could easily show timing correlations between your client system activity and the VM activity. Probably they would also go to the person who lent you their credit card and threaten them with prosecution unless they fingered you.

Cryptography is not going to save you from prosecution if you do any noteworthy crime. There is no security "in the cloud" from any government with a jurisdictional or financial relationship with the provider. (Though Tahoe LAFS is an interesting project).

Interesting. Good point.

the DOJ have laptop (like a knife in a murder case). According to Miranda, the defendant have the right to remain silent (incl. all kinds of communications, ie. oral, keyboard typing, Morse alphabet using campfire smoke, etc... ) and, in particular, can't be compelled into communicating any information in connection with her/his using of the laptop (or murder knife), while the DOJ is free to have as much witnesses as they can describing defendant's usage of the alleged crime tool.

Miranda doesn't apply, here. That derives from the 5th amendment, but it pertains to police interviews after arrest. The ability to obviate the 5th amendment by offering immunity amounts to a way to compel potentially incriminating testimony. It's likely that eventually the question here is going to be the extent of the immunity required to compel testimony of the password: just immunity for information contained in the password itself, or for information contained in the files it unlocks?

http://en.wikipedia.org/wiki/Miranda_warning

So what if the govt suggests a document exists (claims to know exists) and therefore could be located on an encrypted volume is that grounds for them to force someone to decrypt that volume or be held in contempt of court?

Reply on news.ycombinator.com