Silk Road forums
Discussion => Security => Topic started by: CaptKrunch on January 24, 2012, 01:37 pm
-
Source: http://news.cnet.com/8301-31921_3-57364330-281/judge-americans-can-be-forced-to-decrypt-their-laptops/
American citizens can be ordered to decrypt their PGP-scrambled hard drives for police to peruse for incriminating files, a federal judge in Colorado ruled today in what could become a precedent-setting case.
Judge Robert Blackburn ordered a Peyton, Colo., woman to decrypt the hard drive of a Toshiba laptop computer no later than February 21--or face the consequences including contempt of court.
Blackburn, a George W. Bush appointee, ruled that the Fifth Amendment posed no barrier to his decryption order. The Fifth Amendment says that nobody may be "compelled in any criminal case to be a witness against himself," which has become known as the right to avoid self-incrimination.
"I find and conclude that the Fifth Amendment is not implicated by requiring production of the unencrypted contents of the Toshiba Satellite M305 laptop computer," Blackburn wrote in a 10-page opinion today. He said the All Writs Act, which dates back to 1789 and has been used to require telephone companies to aid in surveillance, could be invoked in forcing decryption of hard drives as well.
Ramona Fricosu, who is accused of being involved in a mortgage scam, has declined to decrypt a laptop encrypted with Symantec's PGP Desktop that the FBI found in her bedroom during a raid of a home she shared with her mother and children (and whether she's even able to do so is not yet clear).
Colorado Springs attorney Phil Dubois, who once represented PGP creator Phil Zimmermann, now finds himself fighting the feds over encryption a second time.
"I hope to get a stay of execution of this order so we can file an appeal to the 10th Circuit Court of Appeals," Fricosu's attorney, Phil Dubois, said this afternoon. "I think it's a matter of national importance. It should not be treated as though it's just another day in Fourth Amendment litigation." (See CNET's interview last year with Dubois, who once represented PGP creator Phil Zimmermann.)
Dubois said that, in addition, his client may not be able to decrypt the laptop for any number of reasons. "If that's the case, then we'll report that fact to the court, and the law is fairly clear that people cannot be punished for failure to do things they are unable to do," he said.
Today's ruling from Blackburn sided with the U.S. Department of Justice, which argued, as CNET reported last summer, that Americans' Fifth Amendment right to remain silent doesn't apply to their encryption passphrases. Federal prosecutors, who did not immediately respond to a request for comment this afternoon, claimed in a brief that:
Public interests will be harmed absent requiring defendants to make available unencrypted contents in circumstances like these. Failing to compel Ms. Fricosu amounts to a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) that encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers to obtain such evidence through judicially authorized search warrants, and thus make their prosecution impossible.
While the U.S. Supreme Court has not confronted the topic, a handful of lower courts have.
In March 2010, a federal judge in Michigan ruled that Thomas Kirschner, facing charges of receiving child pornography, would not have to give up his password. That's "protecting his invocation of his Fifth Amendment privilege against compelled self-incrimination," the court ruled (PDF).
A year earlier, a Vermont federal judge concluded that Sebastien Boucher, who a border guard claims had child porn on his Alienware laptop, did not have a Fifth Amendment right to keep the files encrypted. Boucher eventually complied and was convicted.
Prosecutors in this case have stressed that they don't actually require the passphrase itself, and today's order appears to permit Fricosu to type it in and unlock the files without anyone looking over her shoulder. They say they want only the decrypted data and are not demanding "the password to the drive, either orally or in written form."
Because this involves a Fifth Amendment claim, Colorado prosecutors took the unusual step of seeking approval from headquarters in Washington, D.C.: On May 5, Assistant Attorney General Lanny Breuer sent a letter to Colorado U.S. Attorney John Walsh saying "I hereby approve your request."
The question of whether a criminal defendant can be legally compelled to cough up his encryption passphrase remains an unsettled one, with law review articles for at least the last 15 years arguing the merits of either approach. (A U.S. Justice Department attorney wrote an article in 1996, for instance, titled "Compelled Production of Plaintext and Keys.")
Much of the discussion has been about what analogy comes closest. Prosecutors tend to view PGP passphrases as akin to someone possessing a key to a safe filled with incriminating documents. That person can, in general, be legally compelled to hand over the key. Other examples include the U.S. Supreme Court saying that defendants can be forced to provide fingerprints, blood samples, or voice recordings.
On the other hand are civil libertarians citing other Supreme Court cases that conclude Americans can't be forced to give "compelled testimonial communications" and extending the legal shield of the Fifth Amendment to encryption passphrases. Courts already have ruled that that such protection extends to the contents of a defendant's minds, the argument goes, so why shouldn't a passphrase be shielded as well?
Fricosu was born in 1974 and living in Peyton as of 2010. She was charged with bank fraud, wire fraud, and money laundering as part of an alleged attempt to use falsified court documents to illegally gain title to homes near Colorado Springs that were facing "imminent foreclosure" or whose owners were relocating outside the state. Some of the charges could yield up to 30 years in prison; she pleaded not guilty. Her husband, Scott Whatcott, was also charged.
-
I see this being overturned fairly soon. It is clearly a fifth amendment issue, and many other courts have seen it the other way. Plus the bottom line is you don't have to give it to them, they cant torture you. And not having evidence is a good thing for the accused, whether they face additional penalty for not divulging the passphrase. Again I predict it will be turned over.
-
I'll take the contempt of court.
or
"Oops, it's just been so long and it was such a long random password. I forgot it... I know I used one of those password generator sites to generate it though, maybe you could follow up with them?"
-
another reason do not have an encrypted info on computer, flash cards are pretty big this days and solid state HDs quite cheap. 3 years jail in UK for not telling the password. Oh and don't ever go for holidays in countries like Bahamas and Thailand, they can get you anywhere, even in a box with a fox.
-
- "this has been such a stressful time for me, i have entered all the passwords i can remember"
-
another reason do not have an encrypted info on computer, flash cards are pretty big this days and solid state HDs quite cheap. 3 years jail in UK for not telling the password. Oh and don't ever go for holidays in countries like Bahamas and Thailand, they can get you anywhere, even in a box with a fox.
I still say encrypting the entire drive is a good idea, because for one fact they have plausible deniability feature now, so just give them the password to the benign partition and there you go. Also unless you are a complete angel on your computer, forensics will ALWAYS find something if they have access to the drive, even if its just a VMware install log (I'm assuming you keep a VM on a encrypted thumb drive). If you are just using the drive to store files and a hidden browser bundle then you are pretty much retarded in security sorry buddy.
3 years in jail for contempt is better than 10+ for trafficking.
-
Wow. Just... Wow. I guess I shouldn't be surprised by anything that comes out of the government these days, but I really would not have expected the court to rule that way. One solution might be the use of a USB keydisk - I know you can encrypt your LUKS partitions that way, and since the password is some randomly generated string of bits, you *can't* give it to them because you never knew what it was in the first place. Of course, if you lose that drive, or are unable to destroy it before they get to you, your data is gone forever... but maybe that's a risk worth taking when the alternative is being Big Bubba's fucktoy for the next 15 years. :o
-
Wouldn't it make sense to have a Truecrypt partitioned drive, with a dummy partition for this reason alone, if none other? Then, when they ask for the password, you just give them the one for the dummy partition.
-
this is exactly why i have a hidden partition container on one of my normally encrypted drives. don't expect this to be overturned... there is a strong correlation to this being an order to open a safe - whereas in the past they had safecrackers and torches -- you can't crack a strong password and AES - at least not before you, the judge, and the entire prosecution are likely skeletons in a box.
i keep all of my personal documents, the local copies, the backup server copies, and the offsite copies encrypted anyways in the event of home invasion or theft - that should be common practice with anybody who does any sort of business with their computers - i have like 20 years worth of data that I don't want to lose, and I don't want to share (it's not so common with people who solely use their computers for amazon.com and playing words with friends). inside of one of these drives is a small container where I keep the shit I really want to hide... that is impossible to detect (look it up).
there's also the line, 'i forgot it'. you may still be held in contempt... but that's apples compared to doing federal time for serious felonies.
-
too much weed, can't remember password......
-
some time ago, one very well known in internet trade circles guy been tortured in thailand jail, obviously he revealed the password to encrypted data containing details of of his 10 years activities. now he doing 20 years in US. You dont wonna ask him what he thinks about encrypting the whole hard drives.
-
Hmm I guess the right against self-incrimination no longer exists...what is wrong with these judges? If a democratically appointed judge did something like this the right would be screaming and yelling about how they were legislating from the bench...so hypocritical. I know (hope) this decision won't stand but this kind of stuff really makes me mad...
-
- "this has been such a stressful time for me, i have entered all the passwords i can remember"
This is actually a good tactic, especially when combined with other methods, such as hidden encrypted partitions and plausible deniability. You can be prosecuted for being unwilling to comply (contempt of court, obstruction of justice), but you can't be prosecuted for being unable to comply. All my drives are encrypted, and while it might be possible to compel me to divulge my passwords, it wouldn't make any difference because there isn't anything there to incriminate me further. Truly sensitive info should never be found to begin with...
-
Wouldn't it make sense to have a Truecrypt partitioned drive, with a dummy partition for this reason alone, if none other? Then, when they ask for the password, you just give them the one for the dummy partition.
Precisely this. Everybody using encryption to mask illegal activities should be using TrueCrypt's hidden volume. Even better, if you mount the outer volume without protecting the hidden volume you'll corrupt the hidden volume and make it genuinely garbage data. (Guess who did this by accident the other day?)
-
LMFAO, what's next?? What idiot couldn't say "I forgot my pasword. der der"????? I'll be damned if I would give them anything, let alone my password for my key. This is America, what the fuck are they gonna do some CIA interrogation type shit??? No, that's illegal as fuck and you'd own the system if that happened. This is another way they think they run shit but in reality they don't.
Hell, it's illegal to order drugs online, right? That doesn't stop us, does it? No it doesn't.
This is one more petty attempt to have control over something they have no control.
If anyone is smart enough to mastermind ordering here, I'd have to assume they wouldn't just say "yes mr LEO, my password is bigpimpin, have at it".
What a joke. facepalm for our government, big time.
-
They key here is probable cause... In the Canadian border case, the guy's laptop was running and US CBP saw the evidence, they knew it was there. In this woman's case, she was recorded in the jail as saying things which incriminate herself, leading them to believe there is evidence on the laptop.
Lesson here: DON'T FUCKING TALK. All jail phones are recorded, real inmates can snitch, fake inmates can be planted, cells can be monitored.
I think she stands to lose this one, but I hope the Supreme Court will rule in favor of protecting our privacy (yeah right).
-
They key here is probable cause... In the Canadian border case, the guy's laptop was running and US CBP saw the evidence, they knew it was there. In this woman's case, she was recorded in the jail as saying things which incriminate herself, leading them to believe there is evidence on the laptop.
Lesson here: DON'T FUCKING TALK. All jail phones are recorded, real inmates can snitch, fake inmates can be planted, cells can be monitored.
I think she stands to lose this one, but I hope the Supreme Court will rule in favor of protecting our privacy (yeah right).
that Canadian border case was quite remarkable. feds spent one and half year trying to brake PGP and dropped.
-
My bet that this will be overturned... Or you could just say, " Try this code" oh, that didnt work? try this.. My memory is for shit and cant remember it, lol. IF you cant remember it you cant remember it...But, it wont get far, my money is on it getting overturned somewhere in the court system..
-
That's definitely fucked up. But it's likely another failed attempt at scare tactics. Half of American computer owners don't even know how to check their fucking email so how are they going to prove that one is even capable of decrypting their computer? Obviously you probably can decrypt something that you were able to encrypt but prove it. It could have been encrypted by someone else or virus or third party software... or you could just simply forget your password.
-
This thread title misleading. This specific case, the women in question made a jailhouse confession that she had some documents which contained evidence, and that they were encrypted.
The judge then ruled that the specific document must be produced since she admitted to having it, he didn't say 'All drives must be unencrypted and all evidence handed over' just that one document.
However they will of course go through everything after decrypting. Should've used the Truecrypt deniable password full HD encryption and given them the decoy, or claimed she forgot it. Also don't talk in jail :)
-
Just in case anyone in the uk thinks they are ok , a couple of years ago a law was passed saying we have to do the same(divulge pw/key) or face 2 years in jail, if you think you are clever or get smarmy with, they could always say we have reason to believe you were involved in terrorist activities and then the sentence goes up to 5 years. I always wondered how the old,"oh man im so stoned all the time, i've forgotten" excuse would wear? scary stuff eh. Sunny
-
Just in case anyone in the uk thinks they are ok , a couple of years ago a law was passed saying we have to do the same(divulge pw/key) or face 2 years in jail, if you think you are clever or get smarmy with, they could always say we have reason to believe you were involved in terrorist activities and then the sentence goes up to 5 years. I always wondered how the old,"oh man im so stoned all the time, i've forgotten" excuse would wear? scary stuff eh. Sunny
exactly to the point.
encryption is for transmission of information over internet. locally, all on flash card and hidden very well.