Federal Judge decides 5th amendment protection does not apply to encrypted HD...

**renderman** · January 23, 2012, 21:05

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Keep in mind that cross border searches are basically ex-judicial for non-citizens (and citizens to a certain degree). There is no law, it's a no mans land. If you want to cross the line, you must do what they say, no judicial oversight or much of anything.

I would argue that the data on the hard drive is just that, data, an abstract series of values. In an encrypted form it's the contents of the hard drive so the data is that mess of random numbers. I was travelling with randomness. If they mean something to someone is irelllivant. I plan on taking a few devices with me across the border inthe near future that are filled with /dev/random to establish precident of the illegal number theory.

I'm curious how the courts would deal with rubber hose encryption or multi-layered encryption; Court: "Decrypt the hard drive" Defendant: "There you go, muffin recipies" Court:"Uh can you decrypt the data that puts you in jail?" Defendant: "I decrypted the drive, suck it"

**hexjunkie** · January 24, 2012, 04:35

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

I logged in this morning to pose the same questions as Cot:

The courts are saying that self incrimination doesn't apply to contents of a hard drive. Fine I'll allow that for the moment (stupid but okay).
Use of a TrueCrypt Hidden Volume : TrueCrypt.org could be an option.
I can't see that keeping multiple encrypted volumes is a practical way to keep your data safe as it would take forever to remember all of the passwords.

Personally, I keep my home folder encrypted. I tend to keep my external drives as True Crypt volumes. That is about it.

Without going completely insane. I'd just stick with the "I Don't Remember" line. I'd rather sit in jail for Contempt of Court than anything else I could be convicted of or giving away my on personal information to which they have no right to make me give. I would think that "cruel and unusual" punishment would be reached at a certain point.

Also the Americans with Disabilities Act requires that a person cannot be punished for having a disability. Punch yourself in the head.. claim to not remember anything and I'd think you could skate away.

**TheCotMan** · January 24, 2012, 08:06

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

I'd like to add a little more to this discussion for the tin-hat wearing paranoid people.

A slashdot article appeared not too long ago:
IBM's Five Predictions For the Next Five Years (Tuesday December 20, @10:15AM ) (Business Week: IBM's Five Predictions for the Next Five Years (December 19, 2011, 2:27 PM EST)

This included:

Originally posted by BusinessWeek

Mind reading is no longer science fiction. Scientists are working on headsets with sensors that can read brain activity and recognize facial expressions, excitement, and more without needing any physical inputs from the wearer. “Within [five] years, we will begin to see early applications of this technology in the gaming and entertainment industry,” IBM notes. It will also be good for folks who have suffered from strokes and have brain disorders.

Certainly, early attempts at this technology include using thoughts to control computer interfaces to perform specific tasks by only thoughts. There have also been attempts to read body language by programs, and then try to identify the emotional state of an individual. Where there is ambiguity is in the, "headsets with sensors that can read brain activity," which some people interpret as a device that allows random-access to the brain and anything stored in it, or the ability to see what our, "consciousness," is thinking at the time. However, to my knowledge, this is not yet possible. There are claims that specialized devices can be trained with hours of work to predict what the person tha trained the device is, "thinking," or, "seeing," at the time.

Mind-goggling
It is now possible to scan someone’s brain and get a reasonable idea of what is going through his mind (Oct 29th 2011)

Originally posted by economist

there is another kind of mind-reading, too: determining, by scanning the brain, what someone is actually thinking about. This sort of mind-reading is less advanced than the machine-controlling type, but it is coming, as three recently published papers make clear. One is an attempt to study dreaming. A second can reconstruct a moving image of what an observer is looking at. And a third can tell what someone is thinking about.

'Mind-reading device' recreates what we see in our heads (5:01PM BST 22 Sep 2011) (Includes video to compare video from brain scan to video a person is actually seeing.)

Scientists Can Now Officially Read Your Mind, UCLA Declares (Fri., Dec. 23 2011 at 8:08 AM) (About being able to "read"what you are thinking at a given moment, but is not visual, only detection of like vs. dislike in what is being presented to you through bioinformatics and MRI.)

Scientists develop software that can map dreams (6:19AM GMT 11 Dec 2008) (Reproduction of images in dreams of subjects.)

The point is this:
Technological advances are heading in this direction. The human brain can be compared to a computer, as there is processing capability, and storage capability. Presently, there are significant limits to the above technology that question the reliability and details of the information provided. If we continue to see advances in this technology, then details of images will improve, and accuracy of emotional state when presented with various images will move from 90% and work closer towards 100%**. Though full random access of thoughts seems unlikely in the future without invasive procedures, it too, may also be possible.

** Citing the 90% accuracy in the UCLA article on MRI scans to detect and identify emotional response to various input.

Witness testemony is evidence that appears in the physical world after it has been communicated. Compelling a person to use knowledge from their brain in order to expose encrypted data on a laptop as unencrypted data to the prosecution is effectively a proxied request to data that is only* available when a witness or accused is compelled to use data from their brain and make it available. The arguement by the judge is that since the passphrase is not needed by the court, only the unencrypted contents of the HD are required, the fifth amendment does not apply. Could this same argument also apply to compelling a person to allow investigators access to the thoughts of an accused person through future-tech? Both are information. In one case, the information is stored external to the accused but requires their cooperation using information from their mind/brain while the future-tech is internally stored in the accused and may not require their cooperation. (For example, reading the emotional state of a person as you talk about details of a crime they are accused of committing can provide hits for things they worry about being discovered. This does not require cooperation, as your emotions are reactionary and are not under rational control.)

*only: ignoring brute-force, key-space attacks, discovered cipher/hashing weakness(es), and failures in implementation.

Working off the idea presented by hex junkie:

Originally posted by hexjunkie

Also the Americans with Disabilities Act requires that a person cannot be punished for having a disability. Punch yourself in the head.. claim to not remember anything and I'd think you could skate away.

Maybe mental illness will provide a defense as a way to question the reliability of these scanning technologies.

Humor: How many punches in the head does it take to get to the center of a tootsie pop? :-D
"One, two, three, three, three, three, purple, cheese. Hey, why does my head hurt?"

**hexjunkie** · January 24, 2012, 08:49

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Since they can read minds.. I counter with :

Ta - Da no head punching requried!

**snideology** · January 24, 2012, 19:48

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

But as you noted, these techs are not advanced enough to do what might traditionally be considered 'mind reading.' IMHO mind reading - the notion that we can actually in real-time directly discern what referent and actual thought is in your mind - is beyond the scale of technology, today or possibly ever, despite rosy predictions. However, I think it is perfectly reasonable to expect stunning advances in reading emotional states to the point that, with other information on which to build, a professional could perhaps make a very reasonable guess regarding what a subject is thinking.

The problem with transparent encryption is that you have to be pretty smart about it, or they will find the tracks leading to a the blank wall. Sudden data destruction is a great idea, like they used to do with specialty safes, which would destroy internal contents when tampered with, but that still does not meet the 'legal' requirement Cot threw out there.

Oh... and contempt can be ugly; there was a case back at the beginning of the century or so, where a defendant appealed indefinite imprisonment and readily lost; the phrase 'keys to your freedom' or some such emerged; in other words, that a person held in contempt for reasons such as these has their own keys to use at any time.

I think with HIPA a defendant might be able to argue that to release records with others' info on them would be a violation of federal law. Otherwise, seems to me that any legal loophole found would be closed once used.

**DjDamyard** · January 24, 2012, 22:20

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Originally posted by snideology

But as you noted, these techs are not advanced enough to do what might traditionally be considered 'mind reading.' IMHO mind reading - the notion that we can actually in real-time directly discern what referent and actual thought is in your mind - is beyond the scale of technology, today or possibly ever, despite rosy predictions. However, I think it is perfectly reasonable to expect stunning advances in reading emotional states to the point that, with other information on which to build, a professional could perhaps make a very reasonable guess regarding what a subject is thinking.

There are several ways that your body expresses emotion without you having the ability to control it, for example, the dilation of your pupils. It may not be possible to read exactly one's thoughts, however, it is possible to read when one is thinking good thoughts. I agree with you that when people drop the phrase "mind reading", I always assume that it means seeing exactly what is in the mind as the owner of the mind sees it.

But it's common for a "magician" or illusionist to "read" their audiences mind. Say they walk past someone in the street and like the look of them, or however David Blaine and his buddies do it... They tell them to think of a card and write the card on a piece of paper or whatever, and then mysteriously pull that card out of a shuffled deck of cards. Is it possible that they control this persons mind, or implant this card in their mind before, or while, they are writing it down? If this is the case, then if such technology was to get invented that it could "read the mind" of the defendant, is it possible that their mind can be controlled, erased or "edited" before the court case?... I mean, what does someone who is in a state of hypnosis think about? How compos mentis can someone who has been hypnotised be?

**snideology** · January 25, 2012, 20:03

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Originally posted by TheCotMan

The article, pretty much, says 5th amendment does not apply, as the court does not need the person to provide the key, only provide the unencrypted contents of the HD to the court.

The point of this post is to focus on what security people should advise their clients to do.

Assuming you have clients with needs to keep data private, what advice will you provide to them, in light of the mentioned decision?

Are these the only 2 legally defendable positions? Being unable because of memory, or loss of key? Is there anything else?

-----
But Therein lies the real fascination for me: the sustainable loophole. I stated in my last post that any loophole would be closed after 0day, but I retract that somewhat: a loophole based upon confirmed constitutional law would have a very good chance of retaining its viability.

Since the courts can't enforce a 'compelled testimonial communication,' that means there is a sort-of constitutional loophole already recognized. This, according to the article quoted above, probably extends to the mind, so that negates somewhat the notion of reading minds, or such is my thought.

I don't know if my ramblings help, but the frame I am most interested in surrounds inventing (or discovering, if you prefer) a legal and sustainable method of circumventing a legal request for access to subpoenaed information. My only thought to date is to claim that other data exists there that you are legally required NOT to hand out, as in the HIPA situation I mentioned previously.

**Thorn** · January 31, 2012, 18:26

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Originally posted by snideology

I think with HIPA a defendant might be able to argue that to release records with others' info on them would be a violation of federal law. Otherwise, seems to me that any legal loophole found would be closed once used.

Originally posted by snideology

My only thought to date is to claim that other data exists there that you are legally required NOT to hand out, as in the HIPA situation I mentioned previously.

Nice try, but no cigar. There are legal precedents for these exact situations, and they don't bode well for a defendant. The standard in this situation is for the judge to review all the material, and then give the appropriate evidence to the prosecutor. So, the judge would review the contents of the hard drive, and give the [bomb plans || bank blueprints || child porn] to the prosecution, essentially saying "these items are covered under the terms of the search warrant", but withhold the HIPAA information as being irrelevant and unreleasable in and of itself.

**DjDamyard** · February 2, 2012, 21:23

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

I was on planes all day on Wednesday and Thursday, and on one journey, I happened to look over the shoulder of the person in front of me and saw an article in a newspaper with the headline "Scientists tinker with mind-reading". I wasn't able to see any of the article, or which paper, but after google-ing it, I've found, what I believe, is the article.

Originally posted by http://www.usatoday.com/NEWS/usaedition/2012-02-01-brain-voice-_ST_U.htm

In a report out Tuesday, scientists say that through a kind of surgical wiretapping they were able to translate brain electrical signals back into single words heard by patients, with 89% accuracy. The report raises the possibility that brain sensors could help people speak through a computer simply by thinking what they want to say.

If scientists were ever able to translate brain signals to say 95, or even 99% accuracy, then could there ever be legislation to allow the use of this device if people refuse to speak or give answers in court?

**TheCotMan** · February 6, 2012, 18:55

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

URL1=http://www.wired.com/threatlevel/2012/02/forgotten-password/

There has been an update to this case:

Originally posted by URL1

Defendant Ordered to Decrypt Laptop May Have Forgotten Password
By David Kravets, February 6, 2012 | 2:55 pm

...
“It’s very possible to forget passwords,” the woman’s attorney, Philip Dubois, said in a telephone interview. “It’s not clear to me she was the one who set up the encryption on this drive. I don’t know if she will be able to decrypt it.”
...
“The government will probably say you need to put her in jail until she breaks down and does what she is ordered to do,” Dubois said. “That will create a question of fact for the judge to resolve. If she’s unable to decrypt the disc, the court cannot hold her in contempt.”
...
“She has not taken that position [claiming she can't remember the password] in court,” Davis said. “When she does, we’ll figure it out.”
...

(Comments in "[" and "]" in quote above were not in the on-line article.)

This creates an interesting bit of trouble. If the judge holds her in contempt of court until she remembers, but she (for the sake of argument) truthfully cannot remember the passphrase to decrypt the encrypted contents, then she is literally being penalized for something she is unable to do.

For the sake of argument: if we are really, "innocent until proven guilty," is contempt-of-court as a penalty constitutional as a penalty? If so, then it may become legal for a US citizen to be detained indefnitely with what is effectively a life-sentence because they claim to not be able to remember something. If they are killed while detained, an effective life-sentence then becomes a death sentence... Though not legally murder, the actions of choosing to put someone in jail implies taking responsibility for their safety as they are not free to move to a less violent cell block. If they die while in custody of the state, what party is supposed to be responsible for their death? Government would argue they are responsible for their own death, because they chose not to, "remember," the key to decrypt the drive. Such a position includes an assumption they are guilty of witholding evidence until they can prove they are innocent.

It will be interesting to see if this goes to a federal appeals court, but even more interesting to see if it goes before the US Supreme Court. It would be good to know just how far fifth amendment protection really goes.

**Thorn** · February 6, 2012, 20:14

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

The answer to the question about the amount of time that you may be held in contempt, like so many legal issues, is: "It depends." Mainly it depends on whether you are charged federally or under state law, and if it is a state crime, then the state limit for contempt under the law. For example, being found in contempt of in the US Federal system, carries an 18 months maximum. In some states, my understanding is that you may be held in contempt up to the maximum sentence that may be imposed if convicted of the alleged crime. So if, for example, you are held in contempt under a crime that carries a 1 to 5 year sentence, then you could be held in contempt up to five years. In other states, it's been told to me that there are no limits. Some states (e.g. AZ) have a requirement that an independent court review contempt cases on a regular basis.

For some interesting legal reading on contempt issues, Google the case of H. Beatty Chadwick, who was held in contempt for 14 years (1995-2009) in Pennsylvania before being released.

**renderman** · February 6, 2012, 20:34

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

To throw some fuel on the debate, what about a situation where there are only a few login attempts before data destruction. 'I forgot but I think it might have been....' could lead to the datas destruction.

Of course forensics would have backup bit level copies to retry, but that takes time/effort/money. What get interesting is if/when things like TPM ties in the crypto and once attempts are exhausted, you are locked out for good, what then?

If the defendant gave it thier best try are they responsible if they were wrong and data is destroyed?

**TheCotMan** · February 17, 2012, 15:45

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

February 10, 2012, 8:28am PST, "Woman who pleaded Fifth in password case now citing Fourth," By John Fontana
URL1=http://www.zdnet.com/blog/identity/woman-who-pleaded-fifth-in-password-case-now-citing-fourth/248

Originally posted by URL1

...
The 10th Circuit Court of Appeals in Denver ruled on Jan. 23 that the Fifth Amendment had nothing to do with the case and gave Fricosu until Feb.21 to provide the password.

On Tuesday, Fricosu’s lawyer, Philip Dubois filed a petition to appeal. A ruling should come in the next 10 days. Dubois, however, did succeed in getting Fricosu’s password deadline pushed back to Feb. 28.

Now, her lawyer says if the appeal is granted that he will argue that Fricosu’s Fourth Amendment rights - which protect against unreasonable search and seizure - were also violated.
...
He said the Fourth Amendment is a better argument “for us and for the public in general.”
...

Feb 17, 2012, "Feds Urge Court to Reject Laptop Decryption Appeal," by David Kravets:
URL2=http://www.wired.com/threatlevel/2012/02/laptop-decryption-appeal/

Originally posted by URL1

...
Generally, appellate courts frown on taking cases until after there’s been a verdict. So the woman, the government said, should unlock the drive and appeal if she gets convicted of the financial fraud charges, which theoretically carry decades in prison.

Fricosu, prosecutor Patricia Davies wrote, “can appeal her conviction — just as defendants do when compelled to produce documents pursuant to subpoena or when denied suppression of evidence or statements pre-trial.”

Davies also said Fricosu’s reasons for appealing are legally baseless.

“Fricosu argues that the order is appealable because of its novelty, and the fact that it is of public interest and importance,” Davies wrote (.pdf) “But courts have properly rejected the claim that otherwise non-final orders should be reviewed on such grounds.”
...

Nothing much more in the way of extra info has been added.

Originally posted by renderman

To throw some fuel on the debate, what about a situation where there are only a few login attempts before data destruction. 'I forgot but I think it might have been....' could lead to the datas destruction.

Of course forensics would have backup bit level copies to retry, but that takes time/effort/money. What get interesting is if/when things like TPM ties in the crypto and once attempts are exhausted, you are locked out for good, what then?

If the defendant gave it thier best try are they responsible if they were wrong and data is destroyed?

It would depend on a judgement: if no image-copy of the disk was made, was the loss of data intentional?

To have a law with significant penalties exist on destruction of data/evidence regardless of intent, would lead to serious abuse.

In order for it to work, you would need a media/crypto-system that defies reads of any data, even if the drive is disassembled.

Some other thoughts on this:
If she claims to have forgotten the passphrase, and is held in contempt of court until she remembers or prosecution is able to brute-force the passphrase, or discover a weakness in the crypto implementation, could she then have her lawyer appeal the processing of the case on grounds of a right to a speedy trial? If not, is there any duration less than the maximum sentence possible for the crime she is accused, where such an appeal would be accepted before the case was closed, and found in her favor?

Also, if there is not enough evidence to convict her of this crime, and she is found not-guilty, and the prosecution later decrypts the laptop to find sufficient evidence, can they legally arrest her again for the same crime, not introduce any old evidence only "new" evidence to avoid issues with double-jeopardy, or would the contents of the encrypted laptop "count" as evidence used in the previous (present) case, even if encrypted before, but decrypted after the first trial ended?

**Thorn** · February 17, 2012, 18:18

Re: Federal Judge decides 5th amendment protection does not apply to encrypted HD...

Originally posted by TheCotMan

To have a law with significant penalties exist on destruction of data/evidence regardless of intent, would lead to serious abuse.

I'm not sure where you get this idea, as such laws already exist, and have existed for years. Do you offer any proof of such abuses?

Intent is usually not addressed in such laws, as the destruction is considered apparent (prima facie) of bad intent.

Furthermore, in many jurisdictions, there is precedence for a legal presumption that when evidence is destroyed, it may be reasonable for the court to infer that the person who destroys the evidence had "consciousness of guilt" or other motivation to avoid the evidence being presented to the court. The court may then conclude that the evidence would have been unfavorable to the defense, and may interpret the information as being in the worst possible light for the defense.

In fact, forensic labs usually have to get permission from the courts to perform testing that is destructive to evidence. The courts, in turn, usually only grant such permission when both the prosecution and the defense agree to the test and the destruction.

Originally posted by TheCotMan

If she claims to have forgotten the passphrase, and is held in contempt of court until she remembers or prosecution is able to brute-force the passphrase, or discover a weakness in the crypto implementation, could she then have her lawyer appeal the processing of the case on grounds of a right to a speedy trial?

That's very unlikely. Courts generally view "speedy trial" as being a requirement of the prosecution. On the other hand, anything that the defense does to delay a trial usually can't be used to get a dismissal on those grounds. Otherwise, everyone charged with a crime would do everything possible to delay trial, and then cry foul that they didn't get their trial in a timely manner.

Originally posted by TheCotMan

If not, is there any duration less than the maximum sentence possible for the crime she is accused, where such an appeal would be accepted before the case was closed, and found in her favor?

That seems to depend on the jurisdiction.

Originally posted by TheCotMan

Also, if there is not enough evidence to convict her of this crime, and she is found not-guilty, and the prosecution later decrypts the laptop to find sufficient evidence, can they legally arrest her again for the same crime, not introduce any old evidence only "new" evidence to avoid issues with double-jeopardy, or would the contents of the encrypted laptop "count" as evidence used in the previous (present) case, even if encrypted before, but decrypted after the first trial ended?

No, once jeopardy is attached, and a person is found not guilty or acquitted (there is a difference), then that person cannot be charged with the same crime. New evidence has nothing to do with it. The legal requirement depends on jeopardy being attached for a given crime. Jeopardy is considered to be attached when there is sufficient information to uphold a conviction, and a jury is charged.

This in known in legal circles as the prosecution "getting only one bite at the apple". A prosecutor MUST put their best case forward the first time, because they don't get a second chance. There are murderers who are walking around free, as the prosecution failed to prove the case, and even though better evidence came to light after the not guilty verdict/acquittal, those people cannot be retried.