Fifth Amendment Prohibits Compelled Decryption, New EFF Brief Argues
eff.org
eff.org
#2 Provide legal support to people who's civil liberties has been violated. Mostly related to free speech.
#3 Protects security researchers from government harassment, particularly those who produce encryption software.
#4 Develops software security tools, like https everywhere.
#5 Uses legal tools to get government to admit and publicly release documents related to surveillance, incorrect search and seizures, anti-file sharing laws, patents and free speech. see more at https://en.wikipedia.org/wiki/List_of_litigation_involving_t...
http://istruecryptauditedyet.com/
The security of Truecrypt is incredibly important to privacy efforts.
If you're looking to provide legal support to people, consider donating to ACLU. By the numbers, ACLU appears to be a much more effective way of converting donations to legal support for civil liberties cases. I have some reservations about EFF but unreservedly support ACLU.
As a security researcher working in encryption, I'm not sure what #3 is about. I'm more likely to have the government offer me money (I won't work for the government, haven't in the past, or even accept DARPA grants) than harass me.
ACLU and EFF has joined their forces on several issues. EFF legal support is about Internet civil liberties cases, while ACLU has the broader scope of "the Constitution and laws of the United States". For example, ACLU domain covers anti-war protesters. When one is considering where to send donation money, a larger or small scope has both benefits and drawbacks.
tptacek, if you want to read more about EFF and their involvement around encryption and security researchers, I do want to point you to Wikipedia for more information. An example is the EFF DES cracker article at https://en.wikipedia.org/wiki/EFF_DES_cracker. There is also https://www.eff.org/issues/coders as linked on their website. A lawsuit that might be interesting to read could be https://w2.eff.org/IP/DMCA/Felten_v_RIAA/20010813_eff_felten... .
EFF had also a role during the Export of cryptography events. There is numerous good books/articles on the subject, include a somewhat sparse Wikipedia article at https://en.wikipedia.org/wiki/Export_of_cryptography_in_the_.... Eff has more details about their role on their own website at https://www.eff.org/issues/export-controls .
One could argue that that was the past and do not reflect today. Hotz might disagree a bit on that subject, as well as each time someone has had "anti-drm circumvention laws" being thrown at them for doing security research. I personally have not forgotten ACTA as a recent example where today's government still want to create laws that hinders security researcher in their job.
As a recurring donor, I'm interested to hear what you don't like about them.
As for protecting security researchers, I suspect the gov't is more interested in (and likely to harass) Applebaum et al than you guys.
Because I know folks will ask me, I think that antidiscrimination law and things like first amendment rights so frequently conflict that I think there is a real conflict of interest when an organization takes on both. The ACLU does take on both, or they claim to, but this usually means pushing antidiscrimination law over first amendment issues, which I think is a real problem.
The ACLU's position in a lot of issues like Hosana Tabor v. EEOC was wrong (so wrong that all 9 justices disagreed with the ACLU and stood up instead for civil liberties), and they are for corporate free speech on political issues (Citizens United) unless that is discriminatory (Willock Photography). And so forth.
The ACLU is doing some important work, particularly in the areas of drones and areas outside the EFF's focus.
I am not that enthusiastic about the ACLU because I think their defence of first amendment issues is rather tepid and has been for decades. In the 1950s they kicked my mother's uncle out for defending the rights of the Communist Party USA to peaceably assemble, and today I am really not happy with the way they look at religious liberty.
The problem with religious liberty and the ACLU is that they seem to look at it entirely as if it is just a piece of anti-discrimination law and nothing more. For this reason they came down 100% on the wrong side of Hosana Tabor v. EEOC, and have generally opposed religious liberty when it conflicts with other anti-discrimination agendas they push. But the First Amendment is not just another piece of anti-discrimination law, and it must have more force than the Americans with Disabilities Act or the Civil Rights Act. The unwillingness to really defend religious freedom outside of the antidiscrimination context is one reason I can't back the ACLU over the EFF.
As far as the EFF and ACLU meh...neither particularly excite me there are distinct differences to be sure. But it is the similarities that make me feel nonplussed about support. The way I think of these orgs if there is something specific you think they do well and more importantly if it makes you "feel good", then give. As for practical results there are other places your money could be better spent.
Practical application over Pontification
I mean, they didn't say it like that.... But still, very valuable. Likely saved me thousands of dollars with a 5 minute phone call.
And, my god, I never would have expected to have to hide behind the DMCA (Digital Millennium Copyright Act)! I used to protest against that thing like a maniac before it was passed!
There's plenty bad with the DMCA and how companies use and abuse it to be against it, but it can also be used for good.
yeah, we protested back in the day because the DMCA made it illegal to decrypt DVD's with DeCSS, which, to this day, is why you cannot watch DVD's legally in Linux without paying someone. For our protest, we actually printed out the code to DeCSS and handed it out to people saying "This piece of paper is illegal, you cannot read this piece of paper." http://en.wikipedia.org/wiki/DeCSS
The DMCA did a lot of stuff like this. It essentially laid the groundwork for future Internet and IP laws. It was the first law to address the content of the Internet, so it was a bit of a landmark.
The clause that's in there that ended up protecting me was where the DMCA states that service providers cannot be held accountable for the things their users say. Huge, awesome bit, that. Definitely a serious 20/20 hindsight thing. I can play DVD's on my Linux machine now, too... Though not legally, really.
In effect, they're contributing to making present and future US law. And they're on the side of civil liberties.
I can think of a few reasons:
(1) My understanding of the legal theory is that computers are considered to increase the capabilities of the population; hence, the government's power to enforce the law must also be increased. Consider a car analogy: you must display visible license plates to identify your vehicle whenever it is on the road, yet that was never required for horses, carriages, bicycles, or any previous mode of transportation. Likewise with computers: where previously you might have been able to whisper a secret to someone a foot away from you, now you can secretly communicate with someone across thousands of miles.
(2) It is assumed that the spirit of the law must be upheld. If the police are legally allowed to wiretap a suspect as part of an investigation, then encryption must not be allowed to get in the way of that. In other words, technology must not defeat the law, even in spirit.
(3) Conservative views of technology: quite a few judges are still of the opinion that personal computers are just fancy cable boxes, and so doing anything that violates the will of service providers or governments is "abuse." Entering a URL manually is considered to be vastly different from writing a script to generate and fetch URLs automatically, even if there is no technical difference. If you discover that your phone lets you make a free long distance call when you whistle into it, you are a criminal; if you discover that a web server will give you anyone's account number when you enter the right URL, well, you're an even worse criminal.
(4) Ignorance of what is actually possible with computers. See e.g. how Kevin Mitnick was treated when prosecutors claimed he could whistle into a phone line and thus launch a nuclear strike.
It is precisely this fact which makes the current "going dark" argument an example of overreaching and mendacious, bad-faith deceptive rhetoric: encryption does not take away any powers the police formerly had; to the contrary, the demand for decryption goes far beyond traditional wiretapping principles.
One could argue (as the DoJ does) that the spirit of wiretapping law is that the police can, with the approval of a court, temporarily violate a specific suspect's privacy in an electronic communication system. Hence if the system automatically encrypt's the suspect's messages, the police should be able to obtain plaintexts. Phone companies are not exempted from wiretapping requirements when they multiplex phone calls, despite the fact that that is a technical measure that (as a side effect) impedes wiretapping.
Again, this is not an argument I agree with. For one, wiretapping laws do not, as you pointed out, require a suspect to participate in any way in the wiretapping. For another, there is a component of modern encryption that does (or should) occur in a suspect's mind, much like the computation of code words. It is also true that in general, wiretapping laws have expanded far more rapidly than communications technologies have hampered police investigations; the ability of the citizens to have a private conversation is still "catching up."
It is a challenge to build a system that encrypts as part of a service (rather than users encrypting at the endpoints), yet prevents the service operater being able to provide plaintext. In this situation the 5th amendment does not avail, but I think there is a strong argument for the service provider having an option to shut down (like Leveson/Lavabit) rather than cooperate - not on the grounds Leveson argued, but rather by a right to avoid being used as an instrument of fraud. But we digress from the main topic here.
The obvious counterargument is that it would have to be a two way street or you would have endlessly expanding government powers. Thus, if computers increase the capability of law enforcement (e.g. to wiretap at scale or search recorded communications without individual law enforcement officials having to listen to them) then the individual's rights against government surveillance must also be increased.
Moreover, if the argument is that we need to maintain the historical balance between privacy and law enforcement interests then even the existing powers of law enforcement go too far, because the technology available to law enforcement officials when the amendments in the Bill of Rights were adopted didn't allow real-time communication between individuals to be recorded whatsoever.
And I have to imagine a lawyer would ask what case establishes this legal theory of government automatically gaining new powers as a result of technological advances, because I'm not aware of any such precedent.
> Consider a car analogy: you must display visible license plates to identify your vehicle whenever it is on the road, yet that was never required for horses, carriages, bicycles, or any previous mode of transportation.
It is easy to draw a distinction between cars and computers because the reason we require identification for cars is not that they are more powerful than bicycles etc., it is that they are more dangerous. Computers, by contrast, are for the most part not dangerous at all. No innocent bystanders are killed when someone uses the internet while intoxicated. Moreover, we can see how the distinction plays out with automobiles, because anyone can use mass transit anonymously, which is clearly much more powerful than a bicycle in rapidly getting you from here to there, but also not very dangerous.
> It is assumed that the spirit of the law must be upheld. If the police are legally allowed to wiretap a suspect as part of an investigation, then encryption must not be allowed to get in the way of that. In other words, technology must not defeat the law, even in spirit.
I'm not seeing any coherent principle in this argument. If the police are legally allowed to stand in the street and look at you through the window when you are standing in your living room, then a curtain "must not be allowed to get in the way of that"?
It seems obvious that just because the use of a technology makes the jobs of law enforcement more difficult doesn't mean that people have no right to use the technology.
And it is also quite beside the point, because I don't think anyone is making the argument that no one can use the specific technology (e.g. encryption), the question is rather whether someone who has already used it can be compelled to reveal the secrets against his will.
But that's just it. The people have far more ability now to keep their communications secret than they have ever had before. It makes no sense to say that the individual has either less or the same ability to keep their communications secret. PGP has been around how long?
The fact is that people don't care. Maybe they will in the future, but I doubt it given the rise of mobile and its corresponding dependence on the cloud.
Honestly, the EFF is the only entity that it is even bothering to do something about this.
Keep this in mind when computer interface design is built towards making sure the user doesn't need to understand what's happening. It's part of it.
It's exactly the opposite. It's technologists that say "but, but computer!" and demand special treatment for computers are involved.[1] Judges generally treat computers in terms of real-world analogies to concrete things, and these analogies often clash with idealistic notions held by technologists.
This case is actually an excellent example of that phenomenon. I've heard people say that their laptop/phone/etc is an "extension of their mind" or something to that effect. Because the 5th amendment only applies to testimonial incrimination (because of the use of the word "witness" in the text of the 5th), you need that nexus to the mind in order to justify concluding that forcing someone to give up an encryption key is equivalent to forcing them to testify against themselves.
The more obvious (to me, anyway) analogy is that a laptop/phone is like a backpack or briefcase. I keep documents, photos, notes, etc, in my laptop just as I would keep them in a briefcase. Well, under the case law it is not prohibited under the 5th amendment to force someone to unlock a briefcase! That act has no nexus with a person's internal thoughts and is thus not testimonial.
[1] Other examples include various CFAA-related things. Nobody would defend just walking into peoples' houses and saying "hey, your locks suck!" but defend analogous behavior with regard to computer security all the time. You also see it in the e-mail context. E.g. most people who complain about the government possibly subpoenaing e-mails they store on Google's servers would not see the problem with the government subpoenaing Enron's records they stored at their accounts' premises. Technologists generally want to ignore the obvious physical analogies in favor of ones based on how they perceive the electronic world (i.e. it's "my personal documents" even though it's stored on a cloud and dozens of engineers and sysadmins have access to them).
Um. Which theory is this? Last I checked, as an American citizen, I'm not subject to Russian law. Why are Russians subject to American law?
"We the People of the United States, in Order to form a more perfect Union, establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity, do ordain and establish this Constitution for the United States of America."
Once in Article I, Section 2:
"The House of Representatives shall be composed of Members chosen every second Year by the People of the several States."
In both cases, it is clear that "people" refers to the body politic--the people who, by their consent, are governed by the United States.
It is just words on paper created by mortal men that certainly were unable to see 200 years into the future. And with the advance of technology some parts will begin to show their age. Both the government and the citizens can do a lot of things right now that they could not foresee.
And yet the idea of the changing, expanding and clarifying it seems to be a taboo in modern US politics. People are only allowed to interpret it, but not allowed to talk about changing it.
It is as close to theology as I could not imagine. I don't know of any other country that treats its founding laws that way.
As for why this spectacle doesn't happen in other countries, it's largely because in those countries there is no "Plan B." If you lose at "Plan A" you're done. In the U.S. you have a "Plan B" because we have a judiciary that is a co-equal branch of government. Other countries have constitutional courts, but those courts have very limited jurisdiction and do not function as a co-equal branch of government. In the U.S., you have 94 federal district courts, 13 courts of appeal, and 1 Supreme Court, any one of which can declare a state or federal law unconstitutional. Moreover, unlike judges of constitutional courts in other western countries, American federal judges have the extensive powers of common law judges. They can not just declare laws unconstitutional, but force public officials to take affirmative actions to remedy violations.
The U.S. federal judiciary is, as an institution, extremely anti-democratic. It can not only defeat the democratic will of a state or even the national legislature, but do so in a way that binds all future legislatures. The power to bind legislation in the future is one that no legislature in the U.S. possesses. The obsession with "the semantics and the literal text of the Constitution" is the flip side of this anti-democratic power. The judiciary derives its legitimacy from its role interpreting the text of the Constitution. To the extent that it strays from that text, it loses legitimacy.
What I was wandering is why there is no scrutiny over the constitution itself - are parts of it relevant still, could they be bettered and so on. Quick checking of the years of the enactment of the various amendments shows that after the initial flurry of activity there is some calm period for the country to settle down - but then with the changing society various amendments are enacted and we have roughly one amendment every 5-10 years after WWI until the seventies.
And then suddenly that stops for 42 (so far) years. So in times of unprecedented technological and social change there is no perception that the document itself must change.
Is the text about well regulated militia needed for security still relevant when you have professional huge standing army ?
Do we need new constitutional right in the digital era and not have to rely on the pity of SCOTUS to extend the current we have?
So basically my question is why the constitution is considered sacrosanct and perfect, and not something with flaws and shortcomings that should be fixed?
Outside of that, you'd need a Constitutional convention or a series of amendments. But nobody wants to open that can of worms. You'd be as likely to see an amendment banning abortion as one guaranteeing privacy. The equal protection clause of the 14th would be on the chopping block. People would seriously propose repealing the 13th amendment.
> And then suddenly that stops for 42 (so far) years.
I missed this earlier, but you've got your facts wrong. The last ratified amendment was the 27th in 1992, or 21 years ago. The 26th was 21 years before that in 1971.
> Is the text about well regulated militia needed for security still relevant when you have professional huge standing army ?
The Wikipedia page has a lovely summary of Judge Scalia (and originalist) contorting himself to pieces over it. It would be entertaining if it weren't law.
The literal text of the Constitution is the current law of the land. That's why its interpretation continues to be relevant. I'm perfectly fine with amending the fuck out of it in theory, but I can agree with most people that such amendments need to be carefully reasoned about before being enacted.
I, for one, don't consider the Constitution to even be correct. I consider it to be real. It's not really different from a man saying, "The sun comes out at night." I feel obliged to correct him, but to do that, I have to acknowledge that he said it.
> It is as close to theology as I could not imagine.
Your mistake is mostly in imagining that it is not theology. It is. [1]
Many people, most notably libertarians, have been co-opted by the refrain of "what the Founders originally meant" and "what the Constitution originally said" as a way to justify their policies.
This is made more confusing by the presence of "originalist" jurisprudential theory. [2] But this originalism is also an outgrowth of dominionism.
Libertarians would normally be expected to oppose this kind of trend, but their label was part of the co-opting. The result is that there are libertarians and Real True Libertarians, just as there are Christians and Real True Christians and Republicans and Real True Republicans (read: not a RINO).
All of this is dominionism. It's arguable that a lot of this is just a wave of echoes from the Reconstruction after the Civil War, which was unprecedented in a lot of ways (the rise of the central executive using what was unquestionably force to suppress rebellion and secession; the breaking of the institution of slavery on a national scale; the deliberate and callous humbling of the losers in the war), and merely delayed until the 1980s because of the two World Wars and Vietnam.
[1] http://en.wikipedia.org/wiki/Dominion_Theology
[2] http://en.wikipedia.org/wiki/OriginalismIt wasn't so much "delayed" so much as faded over time without completely subsiding until, as the post-WWII realignment of the major parties progressed, it eventually became political useful for one of them to deliberately expend resources and propaganda efforts to fan it, starting with Nixon's "Southern Strategy".
Erm. Are we reading the same Constitution? There's only one instance of the word in there and it's talking about IP ("To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries;"). The understanding of IP law that I've seen is that American patents don't apply internationally: they have to be converted over to the other governments' systems.
> It's also in the spirit of the declaration of independence that "all men are created equal", which would lead one to believe that they all have certain inalienable rights, citizen or otherwise.
This is the same Declaration of Independence that didn't bother including slaves and women as "men", yes? Just to be clear on what the "it" you're referring to isn't being changed by modern times.
> It also doesn't mean that Russians are subject to American law (at least not while in Russia), but that for things such as rights, they apply to everyone.
The essential claim here is that rights granted by American law apply to Russians.
What you're not saying, but perhaps are meaning to say, is that there ought to be legal structures that transcend national boundaries to apply to the entire human race and that we can in turn derive American law from such a structure such that there are situational effects at a national level. The UN, and the UNDHR, come closest to this but American law does not recognize the UNDHR as anything but a set of suggestions. Judges do not use it as a guideline. Legislators do not use it as a blueprint. (And further, the UN does not have in its membership the entire human species.)
That would make sense. It would reduce Americans' sense of sovereignty, and thus would be fought tooth and nail by the xenophobic culture you reference, but it would then make sense to talk about universal human rights.
It's funny. I've been of the mind for the past decade and a half that we need a species-level government precisely in order to achieve effects like this, but it's also specifically the people who want these effects who are most horrified at the prospect.
So perhaps that's not what you're meaning to say. Maybe you're suggesting that there's a moral Lawgiver who hands down rights and everyone should listen to Him for a change? That's what the Founders largely thought, after all.
Of course they don't apply to other governments, they apply to the US government. The constitution, and American law, tells the American government what rights it ought to enforce or protect, within it's jurisdiction.
> This is the same Declaration of Independence that didn't bother including slaves and women as "men", yes?
It makes no such distinction. Didn't the US have a civil war over this? Which side won?
> The essential claim here is that rights granted by American law apply to Russians.
In places where American law applies, yes. Do you think they shouldn't?
No, it doesn't. You can keep asserting this, but making up claims from thin air is not actually enforced law.
> It makes no such distinction. Didn't the US have a civil war over this? Which side won?
Are you proposing that we should have a feminist versus anti-feminist war? Because I'm pretty sure the anti-feminists would win that one right now.
> In places where American law applies, yes. Do you think they shouldn't?
My opinion isn't material. My questions have, aside from the philosophical digression, been about the factual ground we're upon.
Because if American law applies to foreign nationals, then Guantanamo becomes a lot less illegal. Quote passages of US Code, or other relevant law. Not your philosophical opinion, which isn't the point here. If you want to discuss what should be, then let me say that I don't even want America to exist. That's how far afield we're going if you want to know what my opinions are.
You are on Russian soil (unless you have diplomatic immunity). It would be reasonable (but perhaps not true) to assume that if you're subject to limits of law in a jurisdiction you're also privy to its protection (presumption of innocence etc).
All the original policy stated is that the "border search exception" to the 4th amendment did not have to be at the literal border. This was to accommodate border checkpoints in the southwestern U.S. which are for practical reasons not right at the border but a few miles inland along major highway routes.
Caveat: The "border search exception" has some other pretty enormous holes.
As a non-citizen, I don't believe you need to answer any questions, but they may decide to just deny you entry at that point, and it could cause problems if you ever wish to return. Best idea I've heard of is to have your company encrypt the laptop before you travel and do not provide you the key until you're done travelling.
The one case I am aware of was when a CBP agent stated they saw child porn on the laptop, which the person subsequently locked. In that case a court ordered him to provide the key.
If I were concerned about traveling with certain data I would use a travel drive. Swap it in before going, and, as suggested, download what I needed once safely at my destination.
Now I'm wondering if there are other ways to carry that data with me in a format that would resist inspection. For example, on an SD card inside a camera. Or on a DVD. Break up the data into smaller files and named them variations on foo.jog or bar.avi or something, and reassemble things later.
For something like that the question might be whether I could be compelled to install or copy files to the active machine for inspection or evaluation if anyone got wise.
Planning to travel but got ITAR data on your disk? Better swap that disk unless you like fines and jail time.
1) Does the Fifth Amendment apply?
2) Does the Fifth Amendment prohibit certain things?
The Fifth Amendment, like the others, generally applies to not just citizens, but legal residents and others who are on U.S. soil.
The second issue is what's interesting here. The literal text of the Fifth Amendment is:
"No person... shall be compelled in any criminal case to be a witness against himself."
Literally, it prohibits people from being forced to testify against themselves in a criminal trial. The Supreme Court has ready it very broadly to prohibit all sorts of other things, but one limit it has recognized is that it still only applies to "testimonial" incrimination. Think: testifying on a witness stand. Non-testimonial acts, like forcing someone to unlock a box, are not covered.
Some courts have held, and the EFF argues, that providing an encryption key is unlike providing the key for a box because it requires you to recount things that are in your memory, and is therefore testimonial.
The 5th Amendment and other parts of the constitution are taken to imply other rights. The Presumption of Innocence is one of these. (Taken to be implied by the 5th, 6th, and 14th amendment.) However in U.S. law, it is fine for jurisdictions to compromise this for certain kinds of crime. Prosecutors may not need to prove motive or intent, for example.
This is true but even for strict liability crimes there may be vagueness problems unless you can show some degree of at least a very general intent.
For example consider rape. You can't imprison someone because of a totally reasonable misunderstanding of this sort, so typically you are going to have to construct consent from the view of the accused. This leads to all sorts of things like (in many/most/all? states) the nature of the relationship is relevant. If you wake a woman up with sex and she's your wife and you normally share a bed, no prosecutor anywhere is going to consider that rape, but if you move into the bed of a friend-of-a-friend you let sleep in your guest room and wake her up with sex, that will be.
These things get really complicated. My reading of the cases in the US which have ordered compelled encryption have held that there was already full testimony that the documents existed and were of a certain nature, and were decryptable by the defendant that it was solely a matter of demonstrating what was already testified to.
The problem here is that the prosecutors hold a lot of sway over how much Presumption of Innocence should be relaxed in each case, as they are the ones who advise the governments of local jurisdictions about these matters. That would be like the umpires always being on the payroll of the home team. I'm not so sure this situation is conducive to a level playing field.
(IANAL) The example is not 100% applicable. You can only be legally compelled to open a lockbox if doing so provides no testimonial information. If there is uncertainty around whether you had control over the contents of the lockbox, then opening it would definitely provide that information. This action is therefore considered to have a testimonial component, and covered by the 5th Amendment.
You can still be compelled to open the lockbox, if doing so will not run afoul of the 5th Amendment. There are generally two ways to do so. One is that the action does not have a (non-trivial) testimonial component: If there is no doubt that you had control over the contents of the lockbox, then there is effectively no information being provided. The second way is that the testimonial component is not used against you: the prosecution cannot say that you opened it, but is otherwise allowed to use the contents as evidence (with caveats).
I am not aware of any court in the US which has held otherwise to be honest.
There are a few cases where individuals were ordered to decrypt contents but in all those cases, it was content that the law enforcement officials had already seen on the computer.
For a parallel, there's a case before the Supreme Court which was just argued over whether the 5th Amendment protects an individual from testifying against himself in the context of a court-ordered psychological evaluation. The likely outcome is that it does unless the defendant raises an insanity defence, and then, as long as the defendant can offer evidence that he was not sane, the state gets to compel him to have an evaluation.
What I am getting at is that the 5th Amendment almost certainly both applies and prohibits, generally, forced decryption at least in the US. There may be cases, however, where the 5th Amendment does not apply because nothing new is revealed to the government that the individual has not already presented.
This true only once you are on the soil, not at the entry points. If you are not a US citizen, or at least granted some form of acknowledgement by the government i.e. a visa, the protections of the Constitution and the Bill of Rights do not apply to you. Again, this is true at the entry point to the US[1].
So to come back to the original example: if I enter the US as a non-citizen, can TSA or border security force me to decrypt my hard drive? The answer, with no doubt, is 'absolutely, yes they can'. In the eyes of Homeland security, if you are not a US citizen, you have no rights at the border and they will not hesitate to detain you or send you right back if you are uncooperative.
I'd expect that if CBP is asking for your encrytion key and you are not a U.S. citizen and you refuse to provide it you're probably going to be refused entry. Being refused entry isn't to be taken lightly. It may very well mean you will never be allowed entry again.
As others have pointed out it's probably better to simply not know the encryption key or to download your data after arriving. Which are covered in the guide I linked.
Your post mentioned the TSA but I'm not aware of the TSA asking for encryption keys. I'd be surprised if they ever do or have since their mandate is aircraft safety. Searching data would not likely be allowable under the search exceptions they operate under. Your concern should be towards CBP doing the search while clearing passport control/customs.
That said, I'm nonetheless happy the EFF is pushing at this - it's that kind of pressure that makes sure reasonable calls are made in the corner cases.
They believe the random looking data is actually encrypted data, data they believe is relevant, and they believe it can be decrypted by what they believe is a keyphrase they believe you still remember or had in the first place.
That is quite a big wager to throw someone in jail over, for a potentially unlimited time.
(Now of course TrueCrypt containers and the like still have somewhat of a recognizable header format - but theres no guarantee they contain anything)
For instance, it's not self-incriminating if the government can show that they already know you're associated with the key/lock. Likewise with an encryption key...
To put it another way, let's say you are using Truecrypt, and the prosecution can prove that you have incriminating documents on your laptop. You enter your "innocent" passphrase and behold! No incriminating documents. I think the next obvious move will be for the court to demand that you enter your other passphrase, leaving you trying to prove that you really were not using the distinguishing feature of Truecrypt.
A better solution, where applicable, is to destroy keys as quickly as you can. Keep your keys on a smartcard, and self-destruct the card if you think you will be arrested. You will deny yourself access to your files, but you will also deny your adversary such access. The police might try to prove that you destroyed evidence, but that is much harder to prove if your own procedure is to periodically destroy your keys (and such a procedure can be done individually without raising suspicion). Basically it all comes down to opsec -- something the military has known for centuries.
But your hypothetical is also strange: "let's say ... the prosecution can prove that you have incriminating documents on your laptop." If the prosecution can prove that you have incriminating documents before you ever provide the keys, you're already screwed.
As for the hypothetical scenario, that is actually something that happened in real life:
https://en.wikipedia.org/wiki/In_re_Boucher
In real life it is somewhat unusual for the government to grab random people off the street and demand plaintexts. There is going to already be some kind of evidence against you, something to make the government suspicious. Maybe you attended an antiwar protest. Maybe you published a book about how to molest children. Maybe you are connected to some kind of fraud. Maybe a cop saw what appeared to be child pornography on your monitor. If the government is asking for your passphrase, it is because they already expect to find incriminating files; they will not just shrug and say, "We goofed!" when they see a deniable encryption system producing innocent files.
The real problem here is that, in a way, using deniable encryption is itself incriminating unless everyone uses it -- and we do not live in such a world. Unlike other cryptosystems, it is hard to develop a "legitimate" reason for using deniable encryption, as it has no particular advantage in protecting data from criminals over non-deniable encryption.
Sure it does, in that the criminals can't see the attack target or even be sure one exists.
They may or may not stop, you can't control that. However, if you simply refuse to provide any more keys (regardless if such keys exists); then their only recourse is to try and convict you for not providing the key - and there, on a trial by a layman jury, the plausibility of whatever excuse you [didn't] provide would matter a great deal.
I'm not expecting them to shrug and say "we goofed", I'm expecting them to realize that with a well-designed deniable system, they can't tell the difference between you being uncooperative and there being nothing incriminating to find. If they can prove the files exist and you're refusing to give them up, then that's something they can charge you with, but as I indicated earlier, that's a different kettle of fish.
The big risk with deniable encryption, of course, is that the courts don't really understand it well and you end up in a situation where they are compelling you to provide information that actually does not exist (they think it's on a hidden aspect but they're wrong), and are willing to throw you in jail for not producing it. This risk is what leads me to the conclusion that the law must acknowledge that compelling complete decryption of all data is impossible.
Perhaps, but then why not just provide no key at all and rely on the semantic security of the cryptosystem? If you need to give the court a reason why you are not producing the secret key, you can always claim to have forgotten it. How does deniable encryption improve over that, if in the end it comes down to indistinguishability?
"I'm expecting them to realize that with a well-designed deniable system, they can't tell the difference between you being uncooperative and there being nothing incriminating to find."
OK, but the same is true of non-deniable encryption when you say, "I forgot the key!" Anything that might lead them to believe otherwise would be equally applicable to deniable encryption.
To put it another way, what is the difference between saying, "I only have this key," and saying, "I cannot remember the key at all?" In either case, you need to convince the police that there is no incriminating key they can demand from you.
Key one: Sanitized image. Turn this in immediately.
Key two: Image with something that someone may consider embarassing, such as a few GB's of gay porn. Turn this in with great reluctance.
Key three: Actual design documents, etc. Do not turn this in.
> nor shall be compelled in any criminal case to be a witness against himself,
I could see compelled decryption being congruent with the constitution if the decrypter is guaranteed immunity--ie, you can be compelled to be a witness against someone else.
Really though, there is a deeper issue here. What if I legitimately forget my passphrase? There is no real way to know whether or not I forgot it; will I be held in contempt of court over my forgetfulness? Will I be accused of perjury? Will I be imprisoned? Might the government accuse me of a crime, point to an encrypted hard drive that I have not used in a year, and then throw me in prison for failing to decrypt it?
MRIs might change this.
Who is to say that "It is on the tip of my tongue/fingers, but I can't seem to say/type what it is." does not, under an MRI, appear to be "He knows what it is, but won't say/type it."?
I'm sure you could find expert witnesses willing to be paid to argue either way exactly what the MRI is or could be indicating.
Seems terribly shortsighted, given the points you are arguing from. If there is a disorder, it seems quite likely that we would eventually be able to detect the disorder.
Regardless, I did say "foreseeable future". There may be developments that catch me by surprise, but going at the current rate and direction we are right now, there is no way in hell MRIs will be able to satisfactorily contradict "I am unable to recall" in a courtroom anytime soon.
Depending on all kinds of criteria, most likely including factors such as what is your known relation to that hard drive, your attitudem, how you look and how good is your lawyer, the argument 'I forgot that passphrase' may turn out both ways.
To use an analogy if you can be compelled to give up the keys to a physical safe how can electronic keys be considered differently? To quote Spock "a difference that makes no difference is no difference "
This is what the "man on the clapham omnibus" would think
Now, smartcards are another story. Smartcards can be designed to self-destruct after too many bad passphrases are entered. I suspect, though, that a forensic lab could back up the secret before you are allowed to enter anything.
What you really want is a cryptosystem that provides a "clean" image when given one passphrase, and the "real" image when given another passphrase. Then when you're compelled to give up the passphrase, you do. Since it's mathematically impossible to tell the encrypted data from random data you wrote to the disk before using it for real, it would be very difficult to prove (through analysis of the disk image alone) that you knew 1 or more additional passphrases that would reveal other encrypted data.
Of course, this all depends on very careful implementation: the "clean" image must not overwrite "real" data, but also must not leak the existence of a possible area of more data. You'd also better have realistic timestamps in the "clean" area, etc.