US court test for rights not to hand over crypto keys Civil liberties activists have lent their support to a case that will test whether a US citizen can refuse to decrypt personal data on the grounds that it might be self-incriminatory. The case involves allegedly fraudulent real estate transactions. The government wants a Colorado court to compel Ramona Fricosu, who is accused …
And sounds so much better than "We've no idea what they've been up to and find the old TOTC ploy gets us a warrant no questions asked."
But self incrimination would seem to be an *obvious* issue with this sort of evidence.
Drawing the next logical conclusion, if you hand write your records, surely they cannot be used against you, since it would be self-incriminating?
I thought not.
You would still be found guilty if you wrote in French - the Police just need an interpreter. So encrypted is just the same.
The law is there to protect you from spoken evidence and the catch22 of lying. Any information committed to another medium (little black book, excel, encrypted zip) is not spoken and therefore fair game as evidence, and giving the key is not self-incriminating. If you want to keep it secret, don't write it down!
What if you buried your paper records in a secret location known only to yourself? Unless the police get lucky and stumble across your hiding place, to all intents and purposes that document only exists inside your head.
In that case, you could argue compelling you to reveal its location amounts to self-incrimination.
The really scary bit is the UK RIPA law that means if you genuinely forget where you put the records or if they never existed in the first place, you're going to jail.
And a good Judge would correctly instruct the jury to disregard that as purest speculation on the intentions of the accused when they chose where to store their files.
Prosecutors always try to get away with all sorts of shit to influence the jury, but then so do defence lawyers. It's just how the adversarial system works......
Sorry to burst your bubble, but hidden partitions in Trucecrypt are not actually hidden. Discovering their existence is trivial by diving the registry and/or log files on the host system. If you give the key to the "fake" partition, working out the existence of a hidden partition is simply a matter of TC size - fake partition size. Even the filesystems used can give the game away.
And, finally, you think TC can't be cracked without the original key? Really, really?
There are measures that can be taken - but if you are into that level of paranoia as a normal person, then you probably need help.
"And, finally, you think TC can't be cracked without the original key? Really, really?"
Can you give a link to that information? I refer to cracking TrueCrypt analytically or exploiting an inherent cryptographical weakness, rather than through social engineering or finding shreds of sector data that contain the original key. I mean cracking TrueCrypt "without" the original key, as you said.
This post has been deleted by its author
Except that an encrypted file system is like a safe with a combination. While the police can use anything against you if they can get into the safe they cannot force you to give them the combination(in the USA). Your example of needing an interpreter is flawed. Since the defendant is the only one that could unlock this data(for example if he/she used a made up language to write down the hypothetical records that you mention) it would be self-incrimination to provide the key(combination to the virtual safe). The SCOTUS(should this case get that far) should hold that an encryption key is equivalent to a combination and therefore a defendant cannot be compelled to give such information to the police.
"Except that an encrypted file system is like a safe with a combination. While the police can use anything against you if they can get into the safe they cannot force you to give them the combination(in the USA"
Well spoken. However, the encrypted file system is virtually impossible for anyone to get in to (as far as we know). Whereas the authorities can force their way into pretty much any safe. So the "safe" situation is not a true reflection of the "encryption" situation.
If they authorities can search your house for documents, why should they not be allowed to search your PC for electronic documents ? [I am undecided on the matter, just asking for opinion]. So much that we do is online, anything relevant to anyone's life will be found on their PC these days, and often nowhere else.
If the police show probable cause that some of the contents of the may be material to the investigation of the crime and convince a judge who signs a warrant, that safe is going to be opened. Self-incrimination is about using a confession. It's in the US Constitution because kings were quite fond of torturing for admissions. Yes, I get the Guantanamo irony.
"The law is there to protect you from spoken evidence and the catch22 of lying."
That might be part of the motivation, but this constitution also embeds rights to privacy that annoy authorities and a right to bear arms that exists precisely so that when push comes to shove you can shoot back at the bastards. It seems perfectly possible to me that the authors intended to offer blanket protection to the contents of your head. (In the historical context, governments within living memory had certainly attempted to break open people's head by a variety of means, so even if it wasn't explicitly stated as a motive, the authors would have understood this.)
That is consistent with the interpretation that you can withhold a combination but not a key. A computer key is just a combination, so I'd expect the courts to side with the laptop owner in cases like this one, unless they want to overturn that previous decision.
encrypting it and keeping it in your house is the equivalent of locking it into a safe in your living room. Either way, the authorities will want the combination or the encryption key. Obstructing a legal search is presumably a crime anyway. So, if you do that, you are not being *asked* to incriminate yourself: you already have done! (And probably not many juries will believe you can't open your own safe one more time or decrypt your own documents.)
I don't think you understand what rainbow tables are for.
They are for finding the data that produces a given hash, they are a reverse hash lookup table.
I don' t think the coppers had a hashed password; the they were probably looking for a password which decrypted a key which decrypts SOMETHING which could be a file, file system or another layer of encrypted something.
Good look finding a rainbow table for that when you don't even know what any of the intermediate somethings are supposed to look like.
Act of Settlement, 1701,
Bill of Rights, 1689
and other sources such as (quoted from http://www.historylearningsite.co.uk/british_constitution1.htm)
Laws and Customs of Parliament; political conventions
Case law; constitutional matters decided in a court of law
Constitutional experts who have written on the subject such as Walter Bagehot and A.V Dicey
i.e. evolution over a thousand years, not some big bang freezing the values and context of a particular era and argued about ever since.
I recall reading that the formal, written constitution of the late USSR was one of the best in the world.
The USA seems to have more than its share of human rights problems, particularly in regards to the "justice" system. How can the infamous "perp walk" be in accord with rights to a fair trial etc.? Extradition without evidence and a system based on the financial means to defend oneself at law, get medical treatment, progress in politics? I fail to see that the average citizen benefits much. The IR seems to be above all normal considerations. Data Protection? Interesting concept in the USA.
I agree, but only if it is written *without* the "weasel clauses" that allow the Government to effectively negate the protections given.
Eg Article 8 of the European Convention on Human Rights says:
1. Everyone has the right to respect for his private and family life, his home and his correspondence.
But it then goes on to say:
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
Those exceptions pretty much let the Government say "well, we need to do this for (insert spurious but plausible reason here)" and thus trample all over the rights it's trying to protect.
"However, as first reported in The Register back in 2009, the first person jailed for failing to hand over encryption keys to authorities was a schizophrenic software developer initially charged with explosives offences that were later dropped during a police inquiry"
What ever happened to him, is he still locked up ...
http://k-world.me.uk/2009/11/24/uk-jails-schizophrenic-for-refusal-to-decrypt-files/
It is a scary story. I did not hear any mention of him being given access to legal advice. If he had such advice, he might have been told that he no longer had an absolute right to silence and that RIPA trumped his EU rights.
Perhaps the US administration may use this case in their ongoing efforts to extradite Gary McKinnon.
"Or they could just label him an "enemy combatant"....." It's a she, not a he, which just goes to show the complete lack of any background reading that went into your post, either on Ramona Fricosu or on the topic of enemy combatants. Don't worry, I'm sure there were a few equally unknowledgeable people that read your post and were stupid enough to actually think it was lulz good.
A few more details on the actual accussations:
"....The third indictment alleges that several financial institutions and homeowners were defrauded in a scheme to buy properties under imminent foreclosure, pocket loan proceeds and then sell the homes without paying the outstanding mortgages....."
So, she's not some beacon of righteousness fighting The Man, she's accused of pretty base fraud. This is the best case the EFF could find to get all whipped up and frothy about? Besides, she is just being asked to decrypt the laptop or provide the key, not to actual read the file contents out loud - neither is an accusation of guilt nor provides the prosecution with a hammer to beat her with, they just make her data available so the prosecution can look through it for a possible hammer, so how is it self-incrimination? It's no different to the police asking her for the key to the office she ran her (crooked) business from. Some of the bleeding hearts at the EFF need to stop and think carefully about the assistance they are giving to those that only want to break the law.
Poor little frightened person... Suck it up (or go read the Daily Mail). The law is (allegedly, although in practice...) to protect everyone from government arbitrariness, in order to keep the vast majority of non-scum safe. If every now and then a criminal is benefited... Well, collateral damage of a greater good. Or does "collateral damage" only applies to killing innocent brown people, as the term is usually applied in the US?
It's truly a marvel of devolution that you can type with so many chips on your shoulder!
"Poor little frightened person... " Que? What exactly am I supposed to be frightened of? I'm more concerned that a body I normally support (the EFF) is dressing up as some sort of ACLU in techno drag.
"....or go read the Daily Mail..." Oh dear, you sad little wannabes really need to update your insults to something more 21st century. Or was that because someone hasn't spoonfed you any modern variations yet?
"....The law is (allegedly, although in practice...) to protect everyone from government arbitrariness...." Wrong! The law is there to outline what is criminal behaviour and the punishments that can be applied to those found guilty of said behaviour. The Fifth Amendment to the US Constitution covers a range of issues but also allows a defendent to not answer a question in court whilst under oath if the answer could incriminate them. It is not meant to protect against "government arbitrariness", it was actually intended to protect against extraction of a confession by torture. In application, in the US courts system, it was originally used so that the accused could not be found in contempt if they refused the judge's demand to answer a question. It has subsequently been used by less savoury types to obstruct investigations of a crime. The key is that the accused must be under oath in court to "plead the fifth", which Ms Ficuso plainly is not if it is still at the investigation stage.
Not even going to bother with the racial undertones in your final statement, just too silly for words. Please just grow up.
you can invoke the fifth amendment at any point when being questioned, you do not have to be under oath. For a more complete explanation of the "Self Incrimination" section of the 5th Amendment, you might take a look at what Findlaw has to say.
http://caselaw.lp.findlaw.com/data/constitution/amendment05/
http://caselaw.lp.findlaw.com/data/constitution/amendment05/07.html
http://caselaw.lp.findlaw.com/data/constitution/amendment05/08.html
http://caselaw.lp.findlaw.com/data/constitution/amendment05/09.html
Then again, I'm sure you're extensive legal background is more authoritative.
EFF are not getting whipped up about the case, they are getting whipped up about the principle.
They can't weigh in until there is a case that addresses a principle - and here is one, so off they go.
Hurrah for the EFF and lets hope they get it established BEFORE some poor sucker ends up in the same position.
I doubt the EFF is going to find a pleasant house marm whose interests involve cats and crochet that needs the protection of the 4th, 5th, and 14th Ammendments. This woman may not be an ideal citizen, but I fully believe that forced disclosure of the keys is essentially compelling her to testify against herself if there is incriminating evidence.
It may not be physical torture á la Star Chamber but the threat of loss of liberty is significant when the threat for non-compliance is jail.
The US Constitution is frequently "tested" by the ignoble defense of shady characters, and I personally am thankful for it. Jurisprudence at work.
"....The third indictment alleges that several financial institutions and homeowners were defrauded in a scheme to buy properties under imminent foreclosure, pocket loan proceeds and then sell the homes without paying the outstanding mortgages....."
The key word is alleges, I could allege you murdered someone and hid the body, doesn't mean it's true. That is why we have trials and courts, so that people have the right to mount a defence.
As for moaning about why the EFF filing, would you prefer they didn't file the motion and allow precedent to be set? And when you are accused of something that I find distasteful, I can sit and pontificate on how the EFF shouldn't defend the likes of you.
"....The key word is alleges...." Yes, until the trial finishes in a judgement, it is only an alledged crime. But, the evidence available to the public is already pretty strong (she's been identifed by the mortgage vendors as one of the three parties that made the fraudulent loan requests). I'm guessing the prosecution just need the contents of her laptop files to really tie a bow on their case. I'm not saying she shouldn't be allowed to defend her case, just that I don't think the EFF is right to be helping her out.
"....would you prefer they didn't file the motion and allow precedent to be set?...." You also fail to see that if the case fails because the judge simply doesn't like her, then it sets a precedent for use against people you might consider more worthy of the EFF's support.
"....And when you are accused of something that I find distasteful, I can sit and pontificate on how the EFF shouldn't defend the likes of you...." Whilst I'm sure your circle of tinfoil-attired friends encrypt all the mindnumbingly boring informtaion on their laptops, I don't have anything encrypted on mine because I'm a bit more realistic, so no need for the EFF's support.
The court must make the prosecution prove that the individual not only has access to the files in question, but also has 1. The authority to access the device in question, 2. The ability to access that device with a key, or other form of either digital or physical security token that prevents prosecutors from accessing that information, and 3. Has accessed the device in a directly related matter to the case at hand.
Basically, it should fall on the prosecution to prove that they must have access to the device, and that the individual in question has not only the ability to access the device, but the authority to access that device as well. For example, you couldn't arrest an IT Admin at a company, and ask him to divulge the encryption keys on all of the network computers, since he's not authorized to do such a thing.
The defendant should not have a case for "I don't know the password to the hard drive." before he is ordered to unlock the hard drive.
Also, as another item, the contents of a hard drive should fall under separate pieces of evidence, and should also follow the rules of appropriate search and seizure, requiring a warrant, and documenting the contents thereof. If the case is for child pron, and the search turns up nothing of the sorts, but it turns out he was torrenting the crap out of Walt Disney, the poor fellow shouldn't be liable to be charged with Copyright Infringement instead.
If, in the process of serving a search warrant for one crime, evidence of another crime turns up, the evidence is noted but left alone while a police officer is instructed to make haste to a judge or magistrate on duty, explain the situation at hand, and obtain a second search warrant, this time for evidence of the second crime. Meanwhile, the officers already there draw out the search. Since they are still present, the evidence cannot be touched since the original search is still in progress. All the officer has to do is come back with the new warrant before they run out of things to search and they're all legal to take the new evidence.
In the UK, highly likely. In the US no way. No US judge would allow evidence of pot growing into a court if the warrant was issued for stolen goods. 4th Amendment is taken seriously. In fact I doubt you could get a warrant for "stolen goods" - far too vague. Appeal courts are very hard on loosely drafted warrants, and have been known to throw them out - usually meaning the conviction is overturned.
There *are* exceptions - and I guess federal agencies feel less fettered by such niceties.
To those griping about the flaws in the US constitution - you may have a point - but it still stands as an explicitly binding statement that the states power over the citizen is not absolute, and needs control. Sadly, there is no document *anywhere* in the British political system which does the same.
Wrong, like so many arguments about the magna carta, we do have documents that explictly detail the curtailment of the governments power against the people.
Those documents are the centuries of case law & judgements that our judicial system has created.
Which is a much better system allowing change to happen when society changes rather than some musty old document setting in stone a type of society no longer in existence
it may as well be a copy of next Sundays NoTW (and that's before I ask "which version ?"
The problem with Britains "ethereal" constitution - and one which Coke, Dicey et al couldn't have seen coming - is that because it's "unwritten" and uncodified, it can be pissed over from a great height, by concerted and cynical manouvring of parliament.
Which is *exactly* what has happened over the past few years.
> but not the combination to a safe in much the same scenario
The EFF might have a strong case here. The prosecution is trying to argue that if you type the number into the keypad of a safe it is protected but if you type the number into the keypad of a laptop it is not. The obvious "solution" seems to be a safe that also serves as (or contains) a SecureID card.
Because only lawyers could come up with the absurdity that you can be compelled to provide a key, but not a combination. Common folk everywhere see that for the point of accessibility providing either is functionally equivalent. So if you can be compelled to provide one, you should be compelled to provide the other. And that the same thing applies to encryption as well. Now it might well be that the original decision to compel turning over the key was wrong, but if it is assumed to be right, then the others are just verbal jujitsu to make the law say what your prejudices want it to say, not what it actually says.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
