Hacker News Reader

Comment by sixtofour | Hacker News Reader

You have a fifth amendment right not to incriminate yourself, which the article mentions by noting that you don't have to give up your password when asked.

In my mind (IANAL), if I don't have to give up information about myself, then I have the right to encrypt my information, and to not be presumed a criminal merely for having encrypted my information.

Note that the 5th amendment is not about protecting your criminal activity, since you're presumed innocent unless convicted. It's a right that you have regardless of your character or activity.

View on HN

I am not a lawyer either, but generally you can be compelled to reveal a password.

It is generally seen as analogous to the combination to a safe or a key to a door. Compelling revelation of the password is not generally seen as a violation of the Fifth ammendment.

While a ruling from a lower court, there is a good discussion of this at IN RE JURY SUBPOENA TO SEBASTIEN BOUCHER, Dist. Court, D. Vermont 2009 (which is available on Google Scholar)

Someone could use a two-factor system that splits the decryption key into a memorized passphrase and a physical token. Even if the person reveals their passphrase, the data cannot be decrypted without the rest of the key on the physical token (something that could easily be destroyed).

This is called destruction of evidence, and is a crime.

You're right, but I posed this very question to Kevin Mitnick once. He had just recounted how, during his prosecution, he'd been forced to give up his passphrase. (This was several years ago, and so I might have some specific details wrong, and I'm also going to be a bit vague about it as a result.) I asked him why he didn't just plead the 5th. He said he tried, but that they moved him into solitary and they started abusing him in jail. (abuse is my word, I don't remember the specifics) and they they used every method they could to force him to give up the passphrase, including, I believe, holding him in contempt for not revealing it. Eventually he revealed it.

It is my opinion, having read accounts of people being prosecuted by the government for various crimes over the past 20 years, that in many cases, the government does not hold itself within the bounds of the law, and that such prosecutions are often illegal themselves. Yet, they are able to get away with this, because, what prosecutor is going to destroy their career by pressing charges on cops, other prosecutors or judges?

Also, in this day and age, asset forfeiture is extremely easy. The government can seize all of your assets, effectively denying you the ability to pay your legal counsel, forcing you to rely on the legal services they provide for you. Further, even if you can afford your own counsel, as an "officer of the court" they are subject to extreme pressure. I've read about a fair number of situations where lawyers would not even introduce constitutional arguments for their defendants innocence because it would result in recriminations against the lawyers by the judge. (e.g.: its "frivolous" to claim that federal drug laws are unconstitutional, even though to criminalize alcohol an amendment was needed.)

I'm not a lawyer, of course, this is just my perspective.

"He said he tried, but that they moved him into solitary and they started abusing him in jail. (abuse is my word, I don't remember the specifics)"

Solitary itself could reasonably be described as abuse.

Reading the description that was given, if it did go down as described, that sounds every bit to be torturing a prisoner until he confesses.

That is precisely what it is.

Twenty years? How the Government Breaks the Law (http://www.amazon.com/How-Government-Breaks-Jethro-Lieberman...) was published in 1974. And twenty years before that the "third degree" was still in common use by police.

It's unlikely there will be a breakthrough that allows adversaries (in the cryptography sense) to crack properly implemented strong encryption. Faced with this dilemma, the only other options for the government are varying degrees of black-bag and rubber-hose cryptanalysis. Surveillance (legal or otherwise), asset forfeiture laws, jailing for contempt, lawsuits, deception -- all are just different forms of the rubber hose. It worked against Mitnick, and it would probably work against most of us.

http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

http://en.wikipedia.org/wiki/Black-bag_cryptanalysis

I'm hesitant to mention this again but it does seem that rubber hose is being overplayed as a trump card here too much. Shadow volumes and multiple layered passphrases in arbitrary memorised data offsets on various volumes amongst a scatter of purely random data is completely invulnerable to rubber hose.

It all depends on exactly how paranoid you are as to how deep you go with layers of misdirection here of course but the point remains, they cannot continuously compel you to provide a passphrase when they do not know that another one actually exists.

This is the one arena where the only reason the government has any power at all is due to our ignorance, they do not, and indeed should not, have any power at all in this realm.

>they cannot continuously compel you to provide a passphrase when they do not know that another one actually exists.

unfortunately there have been cases of judges simply jailing people for contempt for years

I understand this, I mean that they don't know how many layers of misdirection are actually involved, you can provide n fake layers of encryption with trivially incriminating information, as long as the "free space" of the volume in question contains randomised data, they can never know if it is actually an encrypted volume one level deeper or not.

rdtsc's point is that you are assuming that the system will play by their own rules. Not necessarily the case, especially when the entire weight of public opinion is against you.

My point is that I understand that, I'm not expecting the system restrict itself in any way shape or form, this is par for the course in many places around the world where no quarter can be expected from the authorities. They can't continue to compel you for more and more passphrases for more and more encrypted shadow volumes that they're not even aware actually exist, this is what it eventually reduces down to.

> They can't continue to compel you for more and more passphrases for more and more encrypted shadow volumes that they're not even aware actually exist

The point is, they can. If you're in some place run by a dictator they can do whatever the hell they want to you, including torturing you until you die.

Sure, but it's tactically useless, as they can't know if they're just applying useless pressure because they don't know how many layers of shadow volumes there are to penetrate. So yes, they can be pricks, but to no discernible effect.

>So yes, they can be pricks, but to no discernible effect.

They won't get more data, but they will send a clear signal to other users of this stuff to behave themselves.

People in power have never been short on excuses for abuses thereof, this aspect of this issue is just another in a huge ocean of existing valid and arbitrary ones.

You don't have a right not to leave evidence. If you did, destruction of evidence wouldn't be a crime.

We are not talking about evidence here, we are talking about information that at some point may be considered evidence.

That is a big difference.

I'm struggling to figure out how this comment is related to the one that you responded to. Did you respond to the wrong one?

I was going to mention a similar scenario of cooking accounting books as a counter to my non-lawyerly argument.

Reply on news.ycombinator.com