Hacker News Reader

> from a technical perspective, or from a legal perspective

Is there a difference? A system like Lavabit is meant to provide technical defences to legal threats. It has to be; that's the entire point. It's not like Levison was providing (or claiming to provide) any defences from any non-legal threats. What Levison needed to do was design a system which did not technically allow him to comply with the subpoenas he received.

And at least for American's, your counter about "can't the government just grab your laptop" is incorrect; you have a privacy interest in your laptop that you do not have in a 3rd party servers. You have stronger 4th Amendment protections, plus a 5th Amendment right not to incriminate yourself. (This last point gets confused; the government does have a right to compel you to give up your keys only if they already know what's being protected. If they know that you have a child porn on your laptop from other means, you must let them access the child porn on your laptop. If they have no idea what's on it, they cannot compel you to let them access it.)

That's where this all falls apart what if the government believe you have on thing on your laptop but in stead it turn out you had something else.

Did they just break the law by forcing you to decrypt it?

Or is it enough for the government to believe whatever they want to make you give up your encryption key?

>the government can coerce you to give up your encryption keys just the same, no?

No they can't. In general, such an act would be a breach of the Fifth Amendment protection against self-incrimination. You cannot claim similar protections for information that would get another person in trouble though. This is why Levison was risking a contempt charge by refusing to turn over evidence about someone else.

OK, do you mean, I can be compelled to give up all my equipment via search warrant, but they have no legal means of making me tell them what my passphrase is? that would be an important distinction. Though at the same time, the government can just as well have covertly installed a keylogger on my system. Which may be illegal but it seems to be happening regardless.

> [the US government] have no legal means of making me tell them what my passphrase is?

Exactly. There was a lot of back and forth about legislation in the UK that basically considered it contempt of court (or worse: impeding an investigation) to not provide encryption keys/pass phrases. Problem was, the government didn't have to prove that you actually had (access to) the keys in question -- effectively being caught with a usb key filled with random data could get you a year in prison...

If you think about it it's entirely unreasonable to demand encryption keys (to say nothing of how you would prove/disprove that the right keys have been provided, specially with stuff like hidden encryption partitions available...).

At any rate the (technical) problem with lavabit was that lavabit could technically sabotage their product in such a was as to gain/give access to user data -- a secure system would not.

The viability of both private (data) and private meta-data messaging have been debated a few times, but basically it's currently hard to beat regular email+gpg+mixmaster routing.

And as long as we don't have secure "web" crypto, the situation won't change.

I just want to point out that, with respect to Fifth Am. protection for passwords and keys, there are at least two District Court decisions suggesting that giving up keys is non-testimonial, and one Circuit decision suggesting it is, so there may be a split on this issue sometime in the future that will end up at the Supreme Court.

Giving up keys about information otherwise already known to be on the computer is what's declared non-testimonial though.

It would be like refusing to open a safe even though the cops have a video recording of every point in time from you putting a bloody knife in the safe to the present time; making you open the safe isn't what proves your association with the knife as the police already have that on video.

How the courts interpret that kind of theory for computing will certainly be intriguing though.

|Giving up keys about information otherwise already known to be on the computer is what's declared non-testimonial though.

That was true of In Re Boucher and to a similar extent US v Kirschner, but in US v. Fricosu, the agents had not seen the contents of the computer, as the defendant claimed she couldn't remember the password. Obviously PC still has to exist that the thing to be found will be found on the computer, but in Fiscosu it was.

I believe you are correct and the grandparent is not. The fifth protects you from being coerced into saying "I did the crime", but not from cooperating with court orders. By you uttering your passphrase, you are not incriminating itself (a wise guy in the crowd will as "What if my password is 'IDidIt!'?" In that case, as I understand it, the jury would be told to disregard the actual phrasing of the passphrase and look only at what the passphrase (really the decryption key) unlock.

In other words, yes this is exactly like refusing to open a safe. The only difference is that with a safe, if you no longer have the key, the law enforcement agencies can attempt other methods of opening the safe. If you lose your encryption key, nobody can prove that you actually lost it and are not just trying to hide it. In this case, it seems the judge will simply say that you are in contempt of court and will lock you up until your memory improves (as in indefinitely).

Like I said somewhere else, some courts have agreed with this analysis, and others differed. Obviously each case is fact intensive, but I imagine we'll have many more discussions as more cases come forward, a circuit split emerges, and it is eventually considered by the Supreme Court.

> No they can't. In general, such an act would be a breach of the Fifth Amendment protection against self-incrimination.

The first sentence doesn't follow from the second.

It most certainly does. Reread it.

I think they were hinting at coercion.

The first sentence only follows from the second if you also assume that the government cannot do anything that you or someone perceives to be a violation of the Constitution.

"When you say Levison's system made claims it couldn't possibly backup, do you mean that from a technical perspective, or from a legal perspective?"

Both. I can't speak for tptacek but can explain his comment. Lavabit may not have known about the legal possibilities, but the technical design was such that Lavabit could expose users' communications.

The technical shortcoming was that the system used the password input by the user as a key for the encryption. I may have some details mixed up, but basically they could capture the password in plaintext and unlock the user's comms with it. They made a practice and promise of not doing so, but one of the government demands was to intercept it.

He is distinguishing between what the service provider can or cannot be compelled to do.