Federal Judge decides 5th amendment protection does not apply to encrypted HD...

[TheCotMan]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Yay! Discussion. :-)

I'm not sure where you get this idea, as such laws already exist, and have existed for years. Do you offer any proof of such abuses?

Intent plays a part, at minimum in the following realms:
* Who gets arrested for destruction of evidence (enforcement)
* Who get tried for destruction of evidence (DA)
* Who is found guilty for destruction of evidence (Jury/Judge)

A law enforcement officer arriving at a scene of a crime, not knowing it is a scene of a crime may destroy foot-print or other evidence without knowing a crime has been committed. Intent plays a part here.

Paramedics and medical people are permitted to provide life-saving support to a person that may be a victim of murder, or other crime, and their primary goal is to take any actions necessary to render support even if the actions they take result in destruction of evidence at a crime scene. (Split focus on medical support opens the door to lawsuit, when a person dies as a result of not having received the best care possible, which *would* have been provided if they could ignore a directive, "do not destroy evidence.")

Law enforcement have similar allowances when the believe a person's life is at risk, such as arriving at a scene of a crime where the people involved are still committing crimes against each other or threatening to do so.

It is unlikely a law enforcement officer will arrest another law enforcement office for destruction of evidence if it is believed there was no intent to do so. (I'd prefer to leave, "dirty cop," out of this discussion, as it would take us off topic.)

Then there are questions about psychologists/psychiatrists with patients being compelled to testify against their patients or be forced to provide medical documentation they gather while treating a patient. However, after the number of year expire on how long they are legally required to keep their notes and records, they are allowed, or required to destroy their records, which may be evidence on committing a crime.

Abuses:
* Selective enforcement based on intent or profession or need to save life
* Selective prosecution based on intent or profession or need to save life
* Selective judgement based on intent or profession or need to save life

A person that is a defendant would not be afforded these advantages. If they, "accidentally," typed in a bad passphrase which leads to destruction of data, there would likely be an assumption this was intended by the defendant and they should be punished. These people are not afforded the same advantages as others, protected by the legal system because of exceptions created based on their intent to support the justice system.

If I am a journalist, and conduct an interview with an alleged political refugee, and they admit to committing crimes of treason against their government, which carry a death sentence, and that government is willing and able to use "spies" to execute this person on U.S. soil if their crimes were known, the journalist may view destruction of all their evidence to save the life of the person they interviewed as saving their life. (I understand this is far-fetched... A journalist thinking of someone other than himself/herself? Rubbish. ;-) The intention to save a life in this case would not be valued when compared to the intention to save a life by a paramedic.

Intent is usually not addressed in such laws, as the destruction is considered apparent (prima facie) of bad intent.

Though literally, this may be the case, historically, it is not.

Before PCR made it possible for very small sample of human cells to be consumed for testing, large quantities of blood, or other human samples were required for DNA testing. Before DNA testing, blood-typing consumed human samples. Before trial, we have examples of evidence being destroyed (necessary for PCR, or older DNA testing, and even older blood-typing.)

Though you may argue that there are legal exceptions to *allow* destruction of evidence in order to perform analysis on evidence, to derive more evidence that may implicate, associate, or remove a person of interest from the scope of investigation, *intent* is at the core of such an exception. In these cases, the intent is for investigation, to help identify or exclude candidates as persons of interest.

Next, consider ballistics, and bullets. When ammunition, and a handgun or firearm are found, and are believed to be associated with a crime, these are taken and studied. Some of the tests include firing one to a few rounds of ammunition with the presented firearms, and as you likely know, the firing of a firearm with rifling alters the results on ammunition fired from the same weapon. (Changes are small, and it requires many, many rounds be fired to have appreciable difference result in the marks on rounds fired, but changes still happen.) This is only possible if the weapon, in evidence, is being altered, and part of it is being destroyed. Sample ammunition entered into evidence may also be fired, or disassembled.

Next consider analysis of fibers (man-made, human, animal, natural) and how these may be removed from a piece of evidence, altering the item checked-into evidence, partly destroying the item checked-in.

Next consider molecular analysis of parts of items checked-into evidence such as with a mass spectrometer, necessarily destroying evidence as part of the process of examination.

In all of the above cases, the evidence *tested* is no longer available for testing by the defense. In all of these cases, a *different* sample must be used, and when it goes to court, and the defense looks to test another sample from a piece of evidence, they, too, are destroying evidence.

Furthermore, in many jurisdictions, there is precedence for a legal presumption that when evidence is destroyed, it may be reasonable for the court to infer that the person who destroys the evidence had "consciousness of guilt" or other motivation to avoid the evidence being presented to the court. The court may then conclude that the evidence would have been unfavorable to the defense, and may interpret the information as being in the worst possible light for the defense.

In fact, forensic labs usually have to get permission from the courts to perform testing that is destructive to evidence. The courts, in turn, usually only grant such permission when both the prosecution and the defense agree to the test and the destruction.

This quoted paragraph includes an implication that you are defining evidence as only those items provided to the court *after* charges have been made.

This may be a key point of disagreement and source of problem with our discussion. Should our discussion qualify, "evidence," as only being labeled as "evidence" when entered into "evidence in court" ?

If so, then what do we call the evidence gathered at a crime scene by law enforcement and the evidence "made" as a result of analysis of the evidence gathered at a crime scene, or from a properly issued search warrant? (Not trolling: need to agree on definitions to argue.)

That's very unlikely. Courts generally view "speedy trial" as being a requirement of the prosecution. On the other hand, anything that the defense does to delay a trial usually can't be used to get a dismissal on those grounds. Otherwise, everyone charged with a crime would do everything possible to delay trial, and then cry foul that they didn't get their trial in a timely manner.

This seems to be different. I agree that a court would not likely view a person that is intentionally is slowing down a case for their defense would not be able to win a challenge where they claim they are not getting the speedy trial they were promised. However, this is a special case where the defense (may/will) claim they forgot the passphrase to unlock the drive.

In this case, right to a speedy trial is violated if they genuinely cannot remember, but probably not a violation if they are not telling the truth. If we apply innocent until proven guilty, then we must assume they are telling the truth about not being able to remember unless the government can prove otherwise. With this framing, the case if purposefully being slowed down due to reasons not under their control, thus denying them right to a speedy trial, and punishing a person for forgetting.

No, once jeopardy is attached, and a person is found not guilty or acquitted (there is a difference), then that person cannot be charged with the same crime. New evidence has nothing to do with it. The legal requirement depends on jeopardy being attached for a given crime. Jeopardy is considered to be attached when there is sufficient information to uphold a conviction, and a jury is charged.

This in known in legal circles as the prosecution "getting only one bite at the apple". A prosecutor MUST put their best case forward the first time, because they don't get a second chance. There are murderers who are walking around free, as the prosecution failed to prove the case, and even though better evidence came to light after the not guilty verdict/acquittal, those people cannot be retried.

Right. To avoid ambiguity on "same crime" being a separate violation of the same law at the same time, but not included in charges for this case. (My mistake for not being clear on, "same crime," which was misleading.)

"crime(s)" (lower-case 'c') are the specific crimes that the prosecution believes the defendant has committed, AND was charged with by law enforcement.
"Crimes" (upper-case 'C) are all crimes that the defendant actually committed with respect to this case, some of which law enforcement and the prosecution believe the defendant committed, but without sufficient evidence, were not able to bring changes against the defendant.

Double Jeopardy prevents the prosecution from arresting and trying the defendant for the "crimes" they were tried for before, but does NOT prevent them from being arrested and tried for the ("Crimes" - "crimes") Crimes they committed, but were not arrested for, when new evidence is uncovered to show they committed these "Crimes."

Now, the same penal code could have been violated multiple times, and the "crimes" they were arrested, and tried for could have iterated over all of these "crimes" while omitting other "Crimes."

If the evidence for the "Crimes" not part of the "crimes" she was prosecuted for are found after this trial ends as a result of law enforcement gaining access to the decrypted contents of the laptop (through whatever means) then there is no "double jeopardy" issue, as the person would be charged with the violating the same law, but a "different" "Crime" that was committed around the time of the other "crimes."

So, again, if this case is dismissed, and law enforcement uncovered new evidence of "Crimes" being committed, could they go after her again, and side-step Double-Jeopardy protection?

[Thorn]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Discussion is fun and interesting.

Disclaimer: In case you didn't know or didn't recall, I spent 20 years in law enforcement, and worked for 5 years in a state forensic lab as a forensic specialist (commonly called a "CSI" these days due to certain TV programs) and have investigated literally thousands of crime scenes from simple burglaries to multiple-victim homicides. Also, I have testified in multiple state courts and US Federal court on the collection, forensic testing, meaning and interpretation of evidence. In the last few years my business has specialized in digital forensic collection and examination. While I am not a lawyer (my parents were married ), I have a good working knowledge of criminal law, and the rules of evidence.

All that is just so you don't scream "he's a ringer!" later.

First, pertaining to the terms. I'll agree that there are some things being misconstrued, but (and this isn't a troll) I think that you're possibly using the terms in a very wide sense, where I'm using them in a relatively narrow sense, based on my training and experience.

1) "Evidence" in my use, is usually something that has been collected for examination that specifically pertains to a crime. Before collection, whatever is lying around a scene, may have potential as evidence (or it may be trash), but it's not 'evidence' per se. An item only becomes evidence when the investigators say it pertains to the crimes. Responding officers, firefighters, or EMTs/paramedics may alter or cause the destruction of some things, by their lifesaving attempt. However, at that time the the destroyed items only have potential as evidence and are not yet considered evidence as such.

Think of potential evidence as the Schrodinger's Cat of crime scenes. It can exist in the potential one of two states, but the exact state can't be determined until the inside of the box is observed, or in this case, whether the item has value to show the who, what, when, where, or how of a crime.

There is also a secondary consideration of what constitutes "admitted evidence" in the narrow confines of court, as to what is entered as evidence during trial ("State's Exhibit A" or "Defense Exhibit 1") being allowed or shown to the jury. However, that really is outside the scope of what we're talking about here, and I mention it only in an attempt to be complete.

By the way, it's well known by the police that medical personnel destroy more than their fair share of potential evidence. Most cops and CSIs claim that "EMT" does not stand for "Emergency Medial Technician" but rather "Evidence Mangling Technician".

2) Evidence that is derived ("made") or descended from other evidence, is just that: derived or descended from another piece of evidence. Evidence tracking systems (whether electronic or manual) have a way to determine what evidence was extracted from another piece of evidence. e.g. Evidence Item #3-1 was derived from Evidence Item #3.

3) Portions of an evidence item consumed by testing, whether firearm rounds or a swatch of fibers taken from a bloody sheet, are not considered to be "destroying evidence." While someone might argue that one bullet in a box of fifty is not the same at the other forty-nine, the courts take a reasonable assumption that if they are from the same lot, they are essentially identical due to modern manufacturing techniques. In the case of a bloody sheet, a swatch is considered just a sample, and as the majority of the sheet is still available, the evidence it is not considered to be destroyed. In the same vein, slight alterations which may occur as result of testing, (such as in your example of barrel wear in firearms testing) and may be explained by the examiner, are considered reasonable and acceptable by the courts.

4) "Destructive testing" is usually only an issue when the total evidence is so small that it will be totally consumed in testing, and there won't be enough left for the defense to have independent tests performed. For example, a single blood drop, only one or two millimeters in diameter, would likely be totally consumed (destroyed) by testing. This is the type of issue I was referring to before, when I said that the court would be consulted. Usually, this is when their is an adversarial state (an arrest has been made, and charges entered into the court system). If there is not an adversarial state, then the lead prosecutor (State's Attorney, District Attorney, etc.) must give permission for the test to be performed, and allow that the sample be destroyed. The point is that there is both oversight and accountability, and that one person is not merely making a decision that may be misinterpreted later.

Presumption of innocence does not include an assumption that the defendant is truthful. Far from it. (I've never even heard a defense attorney express such an idea, and the tend to be very liberal in their interpretation of the law in relation to defendants.) Innocence doesn't preclude people lying to investigators. In fact, most investigators work under the assumption that everyone -including defendants- can and will lie to them to some extent, and determining the truths from what they've been told is usually more difficult that determining what are lies. Furthermore, judges routinely decide on their own whether or not someone is being truthful. Under every court system that I'm familiar with in the US*, a judge must presume that the defendant is innocent under the law, but he or she is still lying like a bad rug. (*I don't know much about the Napoleon system used in Louisiana, although I understand there is a de facto presumption of guilt,.)

So, having said all that, I still haven't seen any proof of a case of abuse. Again, it's not a troll, but I think you're either expressing a fear of potential abuse (not a bad thing, but not the same as it actually happening, or proof of it happening), or you're applying a layman's view of the legal arena, and misinterpreting things that are considered normal and expected. i.e. Samples being consumed, but that the evidence is considered to still be available.

Finally, about new charges: Generally, the courts will allow a secondary charge to be levied against a defendant using the same evidence at a later time, but it must be a separate crime. Example: A defendant is charged with drug dealing, and is ultimately found innocent. Later, some of the same evidence from the drug charge is used to show that the defendant committed murder, which results in a separate charge. In that situation, the charges would likely be allowed, although I would expect to see a big fight in pre-trial hearings over what evidence and testimony would be allowed at the murder trial.

[TheCotMan]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Disclaimer: In case you didn't know or didn't recall, I spent 20 years in law enforcement, and worked for 5 years in a state forensic lab as a forensic specialist (commonly called a "CSI" these days due to certain TV programs) and have investigated literally thousands of crime scenes from simple burglaries to multiple-victim homicides. Also, I have testified in multiple state courts and US Federal court on the collection, forensic testing, meaning and interpretation of evidence. In the last few years my business has specialized in digital forensic collection and examination. While I am not a lawyer (my parents were married ), I have a good working knowledge of criminal law, and the rules of evidence.

All that is just so you don't scream "he's a ringer!" later.

Oh yeah, I know. :-)

1) "Evidence" in my use, is usually something that has been collected for examination that specifically pertains to a crime. Before collection, whatever is lying around a scene, may have potential as evidence (or it may be trash), but it's not 'evidence' per se. An item only becomes evidence when the investigators say it pertains to the crimes. Responding officers, firefighters, or EMTs/paramedics may alter or cause the destruction of some things, by their lifesaving attempt. However, at that time the the destroyed items only have potential as evidence and are not yet considered evidence as such.

Think of potential evidence as the Schrodinger's Cat of crime scenes. It can exist in the potential one of two states, but the exact state can't be determined until the inside of the box is observed, or in this case, whether the item has value to show the who, what, when, where, or how of a crime.

There is also a secondary consideration of what constitutes "admitted evidence" in the narrow confines of court, as to what is entered as evidence during trial ("State's Exhibit A" or "Defense Exhibit 1") being allowed or shown to the jury. However, that really is outside the scope of what we're talking about here, and I mention it only in an attempt to be complete.

By the way, it's well known by the police that medical personnel destroy more than their fair share of potential evidence. Most cops and CSIs claim that "EMT" does not stand for "Emergency Medial Technician" but rather "Evidence Mangling Technician".

Ok. Let's consider you definitions for evidence.

Consider this:
URL1=http://www.wired.com/threatlevel/2011/10/cia-dodges-contempt/
URL1="Judge Refuses to Sanction CIA for Destroying Torture Tapes" By David Kravets, October 6, 2011 @4:48 pm.

A federal judge won’t hold the CIA in contempt for destroying videotapes of detainee interrogations that included the use of a torture technique known as waterboarding, ruling instead Wednesday that the spy agency merely committed “transgressions” for its failure to abide by his court order.
...
A year before the tapes were destroyed, Hellerstein ordered the CIA “to produce or identify all responsive documents” in response to the ACLU’s request for “records concerning the treatment of individuals apprehended after September 11, 2001, and held by the United States at military bases or detention facilities outside the United States.”

Isn't that convenient? [voice: Doctor Nick from the Simpsons]One hand washes dee uhtter! (the other)[/voice] :-D

But is this abuse? By your narrow definition of, "evidence," it would not be evidence until entered into the court, or acquired by law enforcement. If deleted before law enforcement, or representatives of an executive branch could obtain them, then there is no crime, as they were not really evidence, at all.
Certainly the judge requested the documents before they were deleted, but since they never arrived into, "evidence," there were not actually evidence at all.

However, this article suggests, "evidence," can be anything a police officer thinks they would like to examine for possible crimes, but not yet tagged, submitted to court, the district attorney, or even have in their possession....

URL2=http://www.theeagle.com/police/Man-arrested-for-cocaine--destroying-evidence--police-say
Monday, July 13, 2009 12:38 PM

A 31-year-old man was arrested Monday after police said he was detained in Bryan for questioning, then threw a baggie of cocaine out of his pocket and crushed it with his foot while talking to an officer.

If the wider definition is not accurate for, "evidence," then how can someone be arrested for tampering with evidence?

I would submit that this (and other similar news stories on people arrested for destruction or tampering of evidence) that my definition for, "evidence," is a more accurate description where law enforcement, the district attorney and judges may consider.

If we accept my definition for evidence being, in the broadest sense, information or objects gathered, or yet to be gathered to aid in prosecuting someone with committing a crime, the arrests like the one mentioned in URL2 make sense.

If we accept this broad definition, then we can compare and contrast how some people (based on profession) are permitted destruction of evidence without penalty, while others face arrest and prosecution.

This looks a lot like abuse, at least to me.

2) Evidence that is derived ("made") or descended from other evidence, is just that: derived or descended from another piece of evidence. Evidence tracking systems (whether electronic or manual) have a way to determine what evidence was extracted from another piece of evidence. e.g. Evidence Item #3-1 was derived from Evidence Item #3.

3) Portions of an evidence item consumed by testing, whether firearm rounds or a swatch of fibers taken from a bloody sheet, are not considered to be "destroying evidence." While someone might argue that one bullet in a box of fifty is not the same at the other forty-nine, the courts take a reasonable assumption that if they are from the same lot, they are essentially identical due to modern manufacturing techniques. In the case of a bloody sheet, a swatch is considered just a sample, and as the majority of the sheet is still available, the evidence it is not considered to be destroyed. In the same vein, slight alterations which may occur as result of testing, (such as in your example of barrel wear in firearms testing) and may be explained by the examiner, are considered reasonable and acceptable by the courts.

I still see some evidence is being destroyed or altered as part of the process to derive more evidence.

You should understand, I am not saying this practice should be stopped. Not at all. It is to the benefit of society that the prosecution destroys some parts of evidence in order to derive more evidence that my exclude candidates. My purpose with this is to be very, very literal, and precise when I claim that some evidence is absolutely destroyed and unavailable for testing once "tested." My argument is on the topic of abuse where destruction (or altering of evidence.)

This is core to one example of my argument:
* Some people are provided preferential treatment when they "destroy" evidence as a result of evaluating their *intent* , purpose/profession, and duties.)
* The cost of this is most other people do not, and unequal treatment often provides an example of abuse.

4) "Destructive testing" is usually only an issue when the total evidence is so small that it will be totally consumed in testing, and there won't be enough left for the defense to have independent tests performed. For example, a single blood drop, only one or two millimeters in diameter, would likely be totally consumed (destroyed) by testing. This is the type of issue I was referring to before, when I said that the court would be consulted. Usually, this is when their is an adversarial state (an arrest has been made, and charges entered into the court system). If there is not an adversarial state, then the lead prosecutor (State's Attorney, District Attorney, etc.) must give permission for the test to be performed, and allow that the sample be destroyed. The point is that there is both oversight and accountability, and that one person is not merely making a decision that may be misinterpreted later.

Now-a-days, not even a drop of blood is needed. A speck or fleck can be enough, and still provide sample for testing. I would bet that even just a single cell could be enough if the lab had a clean enough, but if possible and a single cell is all that was available, but then we would be in the realm of what you describe above as, "destructive testing."

For very old remains, larger tissue samples are needed, and as was shown in another story, through statistics, an entire genome can be estimated with very good accuracy:
* http://www.nytimes.com/2006/11/15/he...5iht-gene.html
* http://www.foxnews.com/scitech/2012/...man-sequenced/

Presumption of innocence does not include an assumption that the defendant is truthful. Far from it. (I've never even heard a defense attorney express such an idea, and the tend to be very liberal in their interpretation of the law in relation to defendants.) Innocence doesn't preclude people lying to investigators. In fact, most investigators work under the assumption that everyone -including defendants- can and will lie to them to some extent, and determining the truths from what they've been told is usually more difficult that determining what are lies. Furthermore, judges routinely decide on their own whether or not someone is being truthful. Under every court system that I'm familiar with in the US*, a judge must presume that the defendant is innocent under the law, but he or she is still lying like a bad rug. (*I don't know much about the Napoleon system used in Louisiana, although I understand there is a de facto presumption of guilt,.)

Sorry, I used a bit of logic and left out the middle. If A => B, If B => C, if C => D.

Please let me show the chain of logic, and how I came the the conclusion that the defendant must be trusted with their claim because of innocent until proven guilty.

In *this* case, barring use of polygraph, mind reading, telepathy, or brain scanning (some of these are jokes -- you choose which are not) it is impossible for a court to KNOW if the defendant actually did forget the passphrase.

Defense attorney goes to court of appeals while defendant is in contempt of court and in jail, and has been for, let's say 1 month. Defense attorney argues at federal court of appeals, "My client is being denied right to a speedy trial," while the state would defend right to hold the defendant in contempt of court until they "remembered" the passphrase. The defense would say, "but she does not know it, and no amount of detention will cause her to remember. The failure in the prosecution to provide enough evidence to convict her of a crime with what they have entered into evidence is no reason to detain my client who is innocent until proven guilty, until she can do something she is unable to do." The state could then claim, "oh, she knows the password, but is just refusing to tell us!" While the defense can counter with, "how do you know this is true?"

Do you see the problem here? What kind of evidence can be provided to counter a claim that a person does not remember? If there is no evidence of a crime of withholding evidence, or in this case, not complying with a judges order because she claims she is unable, then is the system punishing someone for something they are unable to do?

So, we must believe the claim of the defendant, that they cannot remember, or find a way to show this is not true, or set case law which is described like this, in a general sense:

It is just, and not a violation of a person's constitutional rights for a judge to order indefinite detention of a defendant on the grounds they are unable to do something they are unable to do.

Getting crazy with the cheese whiz now...

Judge: I order you to build me a perpetual motion machine that creates energy.

Defendant: I can't do that.

Judge: Contempt of court for ever! HA HA! I win! Rot in jail or die in a fire, whichever comes first.

Yeah, that is meant to be a crazy example, but does show where this could go.

If allowed to stand, as this above, then this could be cited as case law to say a judge can hold someone indefinitely for not being able to do something they are unable to do.

So, having said all that, I still haven't seen any proof of a case of abuse. Again, it's not a troll, but I think you're either expressing a fear of potential abuse (not a bad thing, but not the same as it actually happening, or proof of it happening), or you're applying a layman's view of the legal arena, and misinterpreting things that are considered normal and expected. i.e. Samples being consumed, but that the evidence is considered to still be available.

I wanted to understand some definitions so that I could provide examples of how that definition does not seem to be consistent with how laws are enforced and prosecuted. Then, provide examples of how some people are given a "free pass" while others are not, and show how professions or intent play roles in the outcome, such as preferential treatment.

Finally, about new charges: Generally, the courts will allow a secondary charge to be levied against a defendant using the same evidence at a later time, but it must be a separate crime. Example: A defendant is charged with drug dealing, and is ultimately found innocent. Later, some of the same evidence from the drug charge is used to show that the defendant committed murder, which results in a separate charge. In that situation, the charges would likely be allowed, although I would expect to see a big fight in pre-trial hearings over what evidence and testimony would be allowed at the murder trial.

So, if a person actually killed 10 people, was arrested for killing 6, because police could not provide enough evidence for 2 the other killings and don't know about 2 more killings on top of that, and there is evidence on an encrypted laptop with images, video, audio recordings of self-created confessions and a journal describing all 10 murders, but the court cannot get access to the unencrypted data, and the defendant is found not guilty, and then the police FINALLY get the drive decrypted, the police cannot arrest the person for the 4 other murders they committed (same crime (murder), just different victims) because of protection from double jeopardy?

This is another way to write the question I posed before, but in the case of this woman, the financial crimes described on the laptop could be for financial crimes the courts and police don't know she committed.

[Thorn]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Ok. Let's consider you definitions for evidence.
...

If the wider definition is not accurate for, "evidence," then how can someone be arrested for tampering with evidence?

In the first case, I'm not clear that they had been seized by any investigative agency or authority. Additionally, the judge seems to think that the people doing the destruction were not aware they were even supposed to be evidence.

In the second case, the cocaine instantly becomes evidence by observation and consideration by the officer. This happens to be contemporaneous to the crime (possession) and the destruction is also contemporaneous to the crime. Contemporaneous actions are well-known and accepted under case law.

This looks a lot like abuse, at least to me.

I still see some evidence is being destroyed or altered as part of the process to derive more evidence.

I think we'll just have to agree to disagree over the testing/destruction in a lab setting. I understand what you're saying, but while it is true that some things are consumed completely by the test, the accepted legal viewpoint that the remaining portions still constitute the same evidence is the viewpoint I've had to work within, so I'll stand by that. It may be something of a legal fiction, but it's one that tends to guide my work, it's a parameter I'm comfortable working under.

More importantly, it's one that guides the courts, and they don't see it as abuse.

Do you see the problem here? What kind of evidence can be provided to counter a claim that a person does not remember? If there is no evidence of a crime of withholding evidence, or in this case, not complying with a judges order because she claims she is unable, then is the system punishing someone for something they are unable to do?

I certainly understand what you're saying about the potential conflict in what the defendant is saying, and whether she is telling the truth verses if she is lying about forgetting the password. One way the contempt charge is warranted to compel her to give up the information, and in the other way it serves no good purpose at all, and she is being punished over something which she as no control.

However, based on my experience, people who are in court and "forget" important details are usually lying. I'd bet this judge is of the same mind.

So, if a person actually killed 10 people, was arrested for killing 6, because police could not provide enough evidence for 2 the other killings and don't know about 2 more killings on top of that, and there is evidence on an encrypted laptop with images, video, audio recordings of self-created confessions and a journal describing all 10 murders, but the court cannot get access to the unencrypted data, and the defendant is found not guilty, and then the police FINALLY get the drive decrypted, the police cannot arrest the person for the 4 other murders they committed (same crime (murder), just different victims) because of protection from double jeopardy?

This is another way to write the question I posed before, but in the case of this woman, the financial crimes described on the laptop could be for financial crimes the courts and police don't know she committed.

If the murderer was only charged with six homicides. then no jeopardy is attached for the remaining four. Each homicide is of itself a seperate crime. So in that scenario, it would be easy enough to charge for the other four should later evidence be uncovered. So in this case, if there are other unknown or legally unprovable crimes she has committed, and they uncover the evidence at a later time, then she might well be charged with additional crimes, as long as they are separate and distinct.

There are also practical considerations to that, however. In a lot of jurisdictions, the prosecutor might just have the police close the case with no further actions (usually called "Cleared by Exception" or something similar), if charging and trying the 'new' cases doesn't really further the interests of justice. This is often applied if the perpetrator is still serving time for the charged offenses.

By the way, my personal feeling here is that this is a self-incrimination issue, and the judge is trying to compel testimony that violates the defendant's rights under the Fifth Amendment. My contributions to this thread are merely an attempt to illuminate how the courts and law enforcement work based on actual experience, not to defend what I believe is a bad decision by a particular judge.

Similar case have come up server times in the past four or five years. I expect that sooner or later, one of them will make it to the Supreme Court of the US (SCOTUS), several written opinions of the court (1988 & 2000) hint that SCOTUS might decide that encryption passwords are protected by the Fifth Amendment.

Justice John Paul Stevens wrote in 1988 as a dissenting opinion:

"A defendant can be compelled to produce material evidence that is incriminating. Fingerprints, blood samples, voice exemplars, handwriting specimens, or other items of physical evidence may be extracted from a defendant against his will. But can he be compelled to use his mind to assist the prosecution in convicting him of a crime? I think not. He may in some cases be forced to surrender a key to a strongbox containing incriminating documents, but I do not believe he can be compelled to reveal the combination to his wall safe - by word or deed."

While the dissent is not legally binding, the Court has leaned on this metaphor in another case in 2000 when it ruled that a defendant shouldn't be compelled to give up certain documents.

"It was unquestionably necessary for respondent to make extensive use of "the contents of his own mind" in identifying the hundreds of documents responsive to the requests in the subpoena. The assembly of those documents was like telling an inquisitor the combination to a wall safe, not like being forced to surrender the key to a strongbox."

Based on that, the court seems to be implying that giving up an actual key that you physically possess is one thing, but being compelled to remember a safe combination is quite another thing entirely. I expect they may apply the same logic to an encryption password.

[Chris]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Holy Shit tl;dr.

Is there an abridged version?

Thorn agrees, Cot doesn't maybe?

[Thorn]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Holy Shit tl;dr.

Is there an abridged version?

Thorn agrees, Cot doesn't maybe?

Are you implying Cot is long-winded? I know you wouldn't say that about me.

Abridged version:
I think we both agree that the judge's decision in this case is poor. Where we differ is where Cot seems to think there are abuses in authority pertaining to evidence handling, I see a system that is already defined and functions well within the law.

[TheCotMan]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Are you implying Cot is long-winded? I know you wouldn't say that about me.

Abridged version:
I think we both agree that the judge's decision in this case is poor. Where we differ is where Cot seems to think there are abuses in authority pertaining to evidence handling, I see a system that is already defined and functions well within the law.

Pretty good summary. :-)

More specific:

* We disagree on the definition of "destruction of evidence" which is central to an argument on how some are allowed to destroy evidence without penalty, and others are not. Under the definition he has used in his work, destruction of samples of evidence are not destruction of evidence so long as other samples can be tested by the defense. (This has been where we spent most of our words.)

* We have some agreement on 5th amendment protection and the judge's decision in *this* case. (Prosecution knows of no specific evidence on the encrypted device, but wants access to it anyway. We did not start discussion for consensus of compelling a person to provide clear-text of encrypted content when the prosecution/law-enforcement have witness testimony claiming "evidence" does exist and has been seen.)

* We have disagreement of, "right to speedy trial," as a constitutional reason for dismissing the case when [the existing evidence is not sufficient to find the defendant guilty and] the person claims to have forgotten the passphrase and is detained indefinitely or until they remember, though he recognizes problems with the concept of contempt of court being imposed on a defendant until they do something they are unable to do.

* We have agreement on, "Double Jeopardy," not being a problem if the, "same crime," (same law is broken) but a different instance than the crimes the prosecution/law-enforcement has arrested and charged the person with, and taken to trial. (If she was arrested and brought to trial for 6 specific crimes, but not 4 others, 2 known by police, but insufficient evidence, and 2 unknown, and THIS case of 6 crimes is dismissed, and "they" later decrypt the drive which provides evidence to these 4 other instances of the, "same crime," could be prosecuted "again" because they are "different instances" of the "same crimes" from those that went to trial.

Thorn, did I gather the key points of our discussion? Were there any other disagreements or agreements not contained under the above points?

Thanks!

[edited to fix typos, extra characters and add clarifying comment in [] above and here.]

[Thorn]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Thorn, did I gather the key points of our discussion? Were there any other disagreements or agreements not contained under the above points?

Thanks!

That's pretty much it.

[TheCotMan]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

URL1=http://www.zdnet.com/blog/identity/woman-pleading-fifth-in-password-case-loses-appeal/267

"Woman pleading Fifth in password case loses appeal," By John Fontana, February 21, 2012, 3:05pm PST

Dubois said he had planned to argue on appeal that Fricosu’s Fourth Amendment rights - which protect against unreasonable search and seizure - were also violated. Dubois says he raised the Fourth and Fifth Amendment arguments in his original objections in the case, but that the Fifth Amendment piece is what made headlines.

What is not clear in this newer article, is if the fourth amendment appeal was also denied. We know the first request for appeal was denied, as it was not the right "time" for an appeal. The appeals court said after conviction would be the, "right," time. This is a newer article, but does not seem to contain any new information, unless the new information is the appeal for fourth amendments protections from illegal search, which was (also?) denied. if this was the case, though, then the article should have been changed to cite the fourth amendment instead of the fifth.

Other articles provide similar info, but nothing new:
* http://www.washingtonpost.com/nation...VRR_story.html
* http://www.huffingtonpost.com/2012/0...n_1291567.html

[bluknight]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

For those who didn't pick up on this, it's interesting to note that this case is being defended by Phil DuBois (of Zimmermann-PGP fame -- no case citation, Wikipedia says he was never formally charged. I had forgotten that!) who has a good reputation in tech circles in Colorado.

I'm a little confused as to why it would matter that now is not the appropriate time for a 4A and 5A defense, as opposed to after a case is (presumably) lost, subsequent to the compellment of discovery. To the (admitted unlearned) layman, I'm guessing that this is a legal case of chicken and the egg -- until the disclosure of the password is forced (and decryption completed), defendants rights have not been violated, and there is no standing for the court. Is this essentially correct, or is there something I'm missing?

[TheCotMan]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

More news stories from today about this:

URL1=http://nakedsecurity.sophos.com/2012/02/22/ramona-fricosu-decrypt/

"Alleged fraudster has until next week to decrypt her hard drive for prosecutors"
Graham Cluley on February 22, 2012

What makes the demand for access to Fricosu's PGP Desktop-encrypted laptop particularly troubling is whether prosecutors have provided reasonable suspicion that evidence is hidden in the encrypted content.

If they haven't - then it could begin to sound like evidence-fishing trips are being sanctioned, something which would make those who care about civil liberties very nervous.

URL2=http://www.techzone360.com/topics/techzone/articles/2012/02/22/269013-legal-technology-dilemma-suspect-fraud-case-has-give.htm

"Legal Technology Dilemma: Suspect in Fraud Case Has to Give Unencrypted Hard Drive of Her Laptop to Federal Agents"
Ed Silverstein, February 22, 2012

“The government offered Fricosu some limited immunity, but did not give adequate guarantees that it won't use the information on the computer against her,” EFF claims.

...until the disclosure of the password is forced (and decryption completed), defendants rights have not been violated, and there is no standing for the court. Is this essentially correct, or is there something I'm missing?

An appeals court could choose to make a judgement on the order, now, but this is not "normal" for appeals for some of the reasons you list. Such appeals are sometimes accepted if "new" or sufficiently different from previous experience or cases. (It is my opinion that they don't want to touch this for some reason. Instead, they pass the buck back and hope everything works out.)

It is an important point, too.

If a decision finds that it is constitutional to require a person to provide unencrypted versions of encrypted content OR provide decryption key(s) then privacy is dead for citizens on any external data, and if keys are demanded (the othe half of this OR statement) then a door is opened to compel a person to give up other information stored in their brain.

If a decision finds that it is unconstitutional to require a person to provide unencrypted data AND/OR key(s) to decrypt data, then people (criminals and non-criminals) have a system to store data outside their brain which can only be defeated if they give up their key, or they decrypt it for the state, or the key is found by the state through other means, or an implementation failure makes it no longer necessary to have the key.

Either way, there are risks for people to lose:
* Lose their a "fair" chance for justice when wronged
* Lose right to privacy when the state "thinks" you have evidence useful to them in prosecuting you or others, even if there are no witnesses to such "thought"

If any judges at an appeals court want any chance to get nominated to become a justice of the US Supreme Court, either decision will likely deny any chances for them to be approved by congress.

[inert]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Keep in mind that cross border searches are basically ex-judicial for non-citizens (and citizens to a certain degree). There is no law, it's a no mans land. If you want to cross the line, you must do what they say, no judicial oversight or much of anything.

I would argue that the data on the hard drive is just that, data, an abstract series of values. In an encrypted form it's the contents of the hard drive so the data is that mess of random numbers. I was travelling with randomness. If they mean something to someone is irelllivant. I plan on taking a few devices with me across the border inthe near future that are filled with /dev/random to establish precident of the illegal number theory.

I'm curious how the courts would deal with rubber hose encryption or multi-layered encryption; Court: "Decrypt the hard drive" Defendant: "There you go, muffin recipies" Court:"Uh can you decrypt the data that puts you in jail?" Defendant: "I decrypted the drive, suck it"

I agree. It's just data. It would be like TSA searching my bag and finding a ThingaKabobber, and telling me to give a presentation on it. Or finding a letter my son wrote me, and asking me to translate his half Klingon/ half hyperactive boy transcript. We might consider hiding storage media in plain sight. More importantly: What is the black market value of muffin recipes anyway?

[TheCotMan]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Another article with more information on this case:

"Can the government force you to decrypt private data?"
February 22, 2012 By Geoff Duncan
URL1=http://www.digitaltrends.com/computing/can-the-government-force-you-to-decrypt-private-data/

...
In May of 2010, the government executed search warrants at the residence Fricosu was sharing with her mother and two children. ... The government obtained a separate warrant to search the Toshiba M305 computer, but discovered the content was encrypted using PGP Desktop whole-disk encryption. ...

Whatcott telephoned Fricosu from Colorado’s Four Mile Correctional Center. The conversation was recorded. In it, Fricosu says investigators had asked her for passwords to the computer, and that she didn’t answer, saying her lawyer had advised her she was not obligated to give passwords to investigators. She does, however, repeatedly refer to the notebook as her own computer and implies she knows the password to access it.
...
Judge Blackburn finds that the government has reasonably established the Toshiba notebook belongs to Fricosu or was primarily used by her, and that the government “knows of the existence and location of the computer’s files.” His finding rests strongly on the recorded telephone conversation between Whatcott and Fricosu. ...
...
Judge Blackburn has granted Fricosu limited immunity from the government using the act of producing the decrypted data against her. In other words, if the decrypted information contains something unexpected or even unrelated, the government would not be able to pursue prosecution based on the fact Fricosu was able to decrypt it.
...
Although Judge Blackburn has granted Fricosu limited immunity to prevent the government from using the act of providing decrypted data against her, immunity does not extend to the data itself. An argument can be made that this limited immunity potentially violates a Supreme Court prohibition against derivative uses of compelled testimony. If the government were to use evidence obtained from the unencrypted laptop against Fricosu, the government might have to prove it obtained (or could have obtained) all that evidence from independent sources rather than solely from Fricosu herself. So far, the government has had no luck digging up the information it believes is on the notebook from other sources, nor have investigators made any progress decrypting the notebook. Nonetheless, Judge Blackburn found “the fact that [the government] does not know the specific content of any specific documents is not a barrier to production.”
...

In Washington State back in 2004, former King County sheriffs detective Dan Ring was arrested for improper use of law enforcement databases as well as other criminal charges. Although data found on Ring’s computer detailed some of his interactions with girlfriends, prostitution rings, and escort services in multiple countries, a portion of his hard drive was encrypted. Ring consistently claimed he couldn’t remember the password to the encrypted data, and partly as a result the case against him was dropped three days before it was set to go to trial. Ring retired — with pension — and the encrypted data has never been cracked.

This is one the of the better articles on this topic. I do not feel comfortable quoting more than I have. There is more detail at URL1. This reads like it was written by a real, live journalist, complete with details, and relevant cases and law. (Journalists that actually do research? I thought they went extinct. :-)

It is troubling to point out how when a detective in a sheriff's dept was arrested, claimed password was forgotten, the case was dropped, and prosecution did not proceed. This is another example that causes me to worry my assertion on favoritism with selection for prosecution has even more merit. Certainly, 3 data points is not enough to establish a correlation or a predictable trend, but such a result is troubling. I doubt non-law-enforcement people will be given this advantage as much as members of a DA's office, or law enforcement, or criminal evidence collection. Time will tell us if this is an issue of privilege to deny justice depending on the profession of the people that break laws, or a statistical anomaly. (Another item for comparing apples to oranges? On top of different trials, different crimes, and different evidence, the alleged "crimes" were committed in different states. Don't expect me to say, "see? I told you so!" if her case is not dropped. It will take many cases with this as a trend to show abuse.

If the state has insufficient evidence to prosecute this defendant without the contents of this drive, and her case is not dismissed/dropped, we'll have an indication that my assertion may be predictive, but no proof. (Correlation is not causation.)

[TheCotMan]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Link to this from DaKahuna on twitter that is set to use protected tweets comes a link to a related case:
(He said it was ok for me to credit him with tweeting the link he found.)

D.C. Docket No. 3:11-mc-00041-MCR-CJK
John Doe appeal of 5th amendment protection from disclosing password to decrypt HD.

Summary after reading the document. For Chris and other people that consider 36 pages something that would be "TL;DR," a summary:


This case is about accusation that the John Doe had kiddie porn on media, legal seizure of encrypted media (March 2010):
* IP addresses used to download kiddie porn included 3 hotels, where the Doe was the only common person staying as a guest at each of these 3 hotels.
* Judge signed search warrant authorizing seizure of all media, encrypted media and passwords/passcodes from Doe's hotel room.
* Media is legally seized.
* Media contains encrypted content, which law enforcement and crime lab techs are unable to decrypt most encrypted content. (They were able to find passphrase/password/passcode to 2 encrypted parts of media, but revealed no evidence supporting prosecution.)
* Judge orders Doe to reveal decrypted contents of encrypted media.
* Doe claims 5th amendment protection for self-incrimination (because of only partial immunity to data decrypted), AND it is something he is unable to do because he forgot the passphrase.
* Judge rejected these claims, orders detention, held in contempt of court.
* Doe appeals


Points:
* "by decrypting the contents, he would be testifying that he, as opposed to some other person, placed the contents on the hard drive, encrypted the contents, and could retrieve and examine them whenever he wished."
* Prosecution claimed the data they wanted existed on the encrypted portions of the media, "the Government introduced an exhibit with nonsensical characters and numbers, which it argued revealed the encrypted form of data that it seeks."
* Cross-exam of McCrohan : there is no way to know if the encrypted media has data or is empty.
* Question is raised (thanks Renderman above) what if random data (encrypted content) is just random data? Witness concedes this is possible. Also, an item in this doc: random data is not a file. :-)
* Like in this case of topic in thread, this judge ordered the defendant decrypt the drive, and the by not requiring the password, it would not be testimony, and if not testimony, 5th amendment protection does not apply, and limited immunity to the process of decrypting was granted, but no immunity to derivative content found after encrypted.


Appeal finds errors in court decisions:
* "First, it erred in concluding that Doe’s act of decryption and production would not constitute testimony." (details on "why" and what cases support this are in the PDF)
* "Second, in granting Doe immunity, it erred in limiting his immunity, under 18 U.S.C. §§ 6002 and 6003, to the Government’s use of his act of decryption and production, but allowing the Government derivative use of the evidence such act disclosed." (details on "why" and what cases support this are in the PDF)
* "decryption and production of the hard drives would require the use of the contents of Doe’s mind and could not be fairly characterized as a physical act that would be nontestimonial in nature."
* "decryption and production would be tantamount to testimony by Doe of his knowledge of the existence and location of potentially incriminating files..."
* The analogy of a passcode to encrypted content being like a key to a lockbox was found invalid by citation of two other cases, which involve requiring contents of a person's mind be used to acquire evidence against them.


Central to support this appeal included these points:
* The prosecution and law enforcement know of no specific evidence of crimes exist on the media
* Encrypted data may just be random data
* Decrypted contents may be empty
* Prosecution does not need to know the exact names/locations of incriminating content, but does need to know it exists. (or the case of the border crossing kiddie porn where the ICE officer observed content on the device, could be used and cited.)
* Prosecution did not establish Doe had access to files on the encrypted portions of media
* Prosecution did not establish Doe was able to decrypt the contents

Interesting items not brought up above in our thread but are in this PDF:
* The district court still could have compelled Doe to turn over the unencrypted contents—and held him in contempt if he refused to do so—had the Government offered and the district court granted Doe constitutionally sufficient
immunity.
* Forcing a person to decrypt a drive establishes a chain of evidence showing that the defendant has access to the decrypted contents.

Specific cases were cited to support these arguments. If you want to know these cases, you can read the PDF.

[Edit: from description online:]

Case Name: "In Re: Grand Jury Subpoena Duces Tecum Dated March 25, 2011 USA v. John Doe"
Case #: "11-15421"
Docket #: "3:11-mc-00041-MCR-CJK"
Date: "02-23-2012"
Type: "CON"
File: "[url=http://www.ca11.uscourts.gov/opinions/ops/201112268.pdf]view[/url]"

Search for Docket: 3:11-mc-00041-MCR-CJK

Search for others: http://www.ca11.uscourts.gov/opinions/search.php

[bluknight]

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

From a user on twitter that is set to use protected tweets comes a link to a related case:
(If he agrees to the citation, I'll change "a user" to their name.)

D.C. Docket No. 3:11-mc-00041-MCR-CJK

The Wall Street Journal posted an article in re: this case this morning.