Passwords ruled as not protected by 5th amendment?

[SlackerInside]

http://www.wired.com/threatlevel/2012/01/judge-orders-laptop-decryption/

So I'm sure many of us have been following this story, though I was yet to see anything posted here about it. The story was churning for a while as to what the judge might do, but it looks like he has finally gone ahead and decided to order that the password be produced by the defendant.

I wonder what some of the other folks here think of the topic?


A really scary thought, is more widespread use of the TrueCrypt decoy drive feature as a result. If I was doing full drive encryption, I would certainly be setting up a decoy volume as a result of this ruling right now. (Ultimately, I'm too lazy to use full drive encryption, especially managing it between multiple drives. I only have a small volume for personal documents.)

Now imagine that someone using TrueCrypt without a decoy drive is called up and ordered to produce the password. The prosecutor doesn't find the exciting evidence they were hoping for, and accuses you of providing a decoy. Remember that it's impossible to know if a decoy even exists in the encrypted volume and even if you know one of the two keys. If the judge agrees that you've provided a fake, you could then be held in contempt of court until you produce the “real” password (which in this case has already been provided). Some states have held such people until they provide the ordered information – indefinite imprisonment which I understand is legal based on that their incarceration is “at will.” So in such an example, you could face effective life in prison without breaking any law.


Preemptive counterpoint:
While the comparison between furnishing keys to safes and lockboxes is somewhat apt, keys are physical objects that can be seized. It's my understanding that the law cannot compel one to produce the combination to a lock from your own mind.


EFF Chimes in:
https://www.eff.org/deeplinks/2012/01/disappointing-ruling-compelled-laptop-decryption-case
http://volokh.com/2012/01/24/encrytion-and-the-fifth-amendment-right-against-self-incrimination/

[The20]

Quote:

The judge ordered Fricosu to surrender an unencrypted hard drive by Feb. 21. The judge added that the government is precluded “from using Ms. Fricosu’s act of production of the unencrypted hard drive against her in any prosecution.”

That leaves room for interpretation. They want an unencrypted hard drive? They can get their unencrypted hard drive. Now where did i put that DBAN CD ...

Aside from that - what the hell?

[SlackerInside]

The20

Quote:

The judge ordered Fricosu to surrender an unencrypted hard drive by Feb. 21. The judge added that the government is precluded “from using Ms. Fricosu’s act of production of the unencrypted hard drive against her in any prosecution.”

That leaves room for interpretation. They want an unencrypted hard drive? They can get their unencrypted hard drive. Now where did i put that DBAN CD ...

Aside from that - what the hell?

I'm fairly certain that the judge is referring to the fact that it was encrypted can't be used against her. Considering that their whole case hinges on the data on the laptop, I doubt that they would say that the unlocked contents were now off the table.

And yes. What the hell. That was my response when I read that the judge was even considering it. That's he's gone ahead and given the order... flabbergasted.

[psychic stalker]

To be clear, the Judge has ruled not that the password is unprotected, but that producing an unencrypted hard drive is no different from producing documents.

If you are compelled by the Court to produce a document, you are required to turn it over or be in contempt. (Which can lead to all manner of sanctions.)

So the Judge is saying she can't be forced to turn over her password, but she can be forced to enter the password to produce the unencrypted data.

It sounds like they're going to argue an inability to decrypt the hard drive (which is a valid, if weak, argument.)

[SlackerInside]

psychic stalker

To be clear, the Judge has ruled not that the password is unprotected, but that producing an unencrypted hard drive is no different from producing documents.

If you are compelled by the Court to produce a document, you are required to turn it over or be in contempt. (Which can lead to all manner of sanctions.)

So the Judge is saying she can't be forced to turn over her password, but she can be forced to enter the password to produce the unencrypted data.

It sounds like they're going to argue an inability to decrypt the hard drive (which is a valid, if weak, argument.)

This at least makes the logic a little clearer.
Though I would imagine that it's usually applied to other people/corps in a case. I've never heard of someone being compelled to produce documents for their own case. I would say that would still ring of self incrimination. Usually the cops have to come up with that on their own via forcibly seizure.

Decoy volumes still make a huge cluster**** in a case like this though.



++ Though it does still effectively nullify the purpose of a password.

[psychic stalker]

SlackerInside

Though I would imagine that it's usually applied to other people/corps in a case. I've never heard of someone being compelled to produce documents for their own case.

It's called "discovery."

The prosecutor has evidence (phone tap recordings) that suggests that there is evidence of interest on the defendant's laptop. This is part of the process of "discovery" where evidence can be brought to the case that is not already available.

SlackerInside

I would say that would still ring of self incrimination. Usually the cops have to come up with that on their own via forcibly seizure.

This is a matter of course in civil cases. That it also happens in a criminal case should not be surprising.

SlackerInside

Decoy volumes still make a huge cluster**** in a case like this though.

I'm wondering if that's actually the case. I could definitely see a circumstance where the Judge orders decryption of a volume and it comes to light that there is a hidden volume. That could lead to another discovery request, or, if the Judge chooses to view it this way, cause for sanctions.

SlackerInside

++ Though it does still effectively nullify the purpose of a password.

I'm not so sure.

But then, neither of us is an attorney.

[The20]

psychic stalker

SlackerInside

Decoy volumes still make a huge cluster**** in a case like this though.

I'm wondering if that's actually the case. I could definitely see a circumstance where the Judge orders decryption of a volume and it comes to light that there is a hidden volume. That could lead to another discovery request, or, if the Judge chooses to view it this way, cause for sanctions.

Isn't the whole point of a hidden volume that you don't know it's there unless you enter the right password?

[psychic stalker]

The20

psychic stalker

SlackerInside

Decoy volumes still make a huge cluster**** in a case like this though.

I'm wondering if that's actually the case. I could definitely see a circumstance where the Judge orders decryption of a volume and it comes to light that there is a hidden volume. That could lead to another discovery request, or, if the Judge chooses to view it this way, cause for sanctions.

Isn't the whole point of a hidden volume that you don't know it's there unless you enter the right password?

Yes, but that's beside the point. It could very well come to light through some ancillary evidence.

[SlackerInside]

So further reading from the EFF and the one they linked from Orin Kerr:

"Rather, the Court is saying that the Fifth Amendment privilege can’t be asserted in a specific case where it is known based on the facts of the case that the computer belongs to the suspect and the suspect knows the password. Because the only incriminating message of being forced to decrypt the password — that the suspect has control over the computer — is already known, it is a “foregone conclusion” and the Fifth Amendment privilege cannot block the government’s application."

So the government is in fact not claiming that she has to produce the contents of the drive. It's the fact that they know she knows the password that they are claiming nullifies her 5th amendment protection of it. So she must produce the encryption password. This was the "phone call" that PS was referring to. She admitted it was her laptop and that she knew the password. She did not admit anything about having documents that were incriminating.

The fact that the documents stored on the drive will now be open to be used against her is simply a side effect.


If this stands... as long as the government can prove you own a computer, it's easy to logically follow that you would know the password to it.

My original thread title stands, as far as I'm concerned.
"Passwords to drive encryption ruled as not protected by 5th amendment"
*If it's your own computer. (Which is insanely easy to prove)


Once you're in, it wouldn't be hard to use the same logic for any online accounts you found saved into the machine...

[29582351c3]

psychic stalker

To be clear, the Judge has ruled not that the password is unprotected, but that producing an unencrypted hard drive is no different from producing documents.

If you are compelled by the Court to produce a document, you are required to turn it over or be in contempt. (Which can lead to all manner of sanctions.)

So the Judge is saying she can't be forced to turn over her password, but she can be forced to enter the password to produce the unencrypted data.

It sounds like they're going to argue an inability to decrypt the hard drive (which is a valid, if weak, argument.)

The ruling is based on the 'forgone conclusion' since the person allowed a law enforcement officer to see the documents in question.

[Sitwon]

I just spent the weekend at ShmooCon and the EFF gave two separate talks at which this case came up. They clarified the details of it several times so let me try to re-convey what they told us.

SlackerInside

So the government is in fact not claiming that she has to produce the contents of the drive.

Actually, yes. Yes they are. They are arguing (based on a vague reference that was made in a recorded phone call) that it is a "forgone conclusion" that there is evidence on the laptop that is relevant to the case. Because of that, the defendant is being required to turn over those contents of the hard drive to be used as evidence. If it weren't for the phone call implying that there was relevant evidence on the hard drive, she could claim a 5th Amendment right not to disclose the password itself.

SlackerInside

It's the fact that they know she knows the password that they are claiming nullifies her 5th amendment protection of it.

No, it's the fact that they "know" that there is evidence relevant to the case on the hard drive. (Now, based on the details of the case you can argue that they can't really be sure that there is relevant evidence on the hard drive, but the judge seemed to be convinced enough that the contents of the hard drive were relevant.)

SlackerInside

So she must produce the encryption password.

No, they are giving her the option to simply type in the password with the assurance that nobody will watch, or to produce an unencrypted copy of the files that are on the encrypted drive. The password itself is not deemed as relevant evidence and is still protected by her 5th Amendment rights.

SlackerInside

The fact that the documents stored on the drive will now be open to be used against her is simply a side effect.

Again wrong. The judge has explicitly stated that she is still entitle to immunity, so the act of production (or any incidental information they glean from the act of production) cannot be used against her as evidence.

SlackerInside

Once you're in, it wouldn't be hard to use the same logic for any online accounts you found saved into the machine...

Online accounts were never protected by the 5th Amendment anyways. The host is a third-party and can be subpoenaed for evidence. They can't use the 5th Amendment on your behalf.


Despite the disappointing ruling, the EFF reps sill seemed pretty optimistic about this case for a number of reasons.
1. It's not about child porn.
2. It's a relatively low court, so there is still a chance this decision could be overturned by another court.
3. The judge's ruling hinges specifically on the "forgone conclusion" that there was evidence. Specifically, the recorder phone call that implied there was relevant evidence on the encrypted hard drive. Without that forgone conclusion the 5th Amendment protection would still apply.
4. The evidence supporting the forgone conclusion is pretty weak, so it may still be overturned in appeal.

[SlackerInside]

Sitwon

I just spent the weekend at ShmooCon and the EFF gave two separate talks at which this case came up. They clarified the details of it several times so let me try to re-convey what they told us.

From the links up top, they seemed to be saying that the phone call revolved around admitting it was her PC and knew the password. Not what was on it.

Do you have some specific elaboration on the exact content of the call?
Since that would clear everything up pretty easily if it's simply contradicting what I had already read.

You know... instead of breaking off all the points into separate quotes for what appears to be the personal enjoyment of saying "no no no" ...

[Sitwon]

SlackerInside

From the links up top, they seemed to be saying that the phone call revolved around admitting it was her PC and knew the password. Not what was on it.

Do you have some specific elaboration on the exact content of the call?
Since that would clear everything up pretty easily if it's simply contradicting what I had already read.

Yes, the blog post on eff.org states:

Quote:

...relying heavily on the fact that the government recorded a conversation between Fricosu and her ex-husband in which the government says she admitted that the laptop was hers and she knew the password.

However at Shmoocon Hanni M. Fakhoury and Marcia Hofmann, both staff attorneys at the EFF, clarified that it wasn't enough that she admitted owning the laptops (the prosecution already knew who the laptops belonged to). It was specifically that she had vaguely implied that there was (quoting Marcia Hofmann) "information which might be of interest to the government". In particular, there was no mention of what that information was or even if that information was relevant to the current case.

Simply admitting ownership of a computer isn't enough for the government to invoke "forgone conclusion", at least not yet.

https://www.eff.org/sites/default/files/filenode/us_v_fricosu/gov_application.pdf

Page 9, second paragraph, last sentence

... Ms. Fricosu discussed the Subject Computer with co-defendant and ex-spouse Scott Whatcott while he was incarcerated (and the telephone call was being recorded) and referenced specific information relevant to the case that the Subject Computer contains.

Emphasis mine.


Anyways, that is how they described it to me. It is entirely possible that their analysis or my understanding of the situation is incorrect. However it seems as though the part of this case in contention is whether or not the government has:
A) made a sufficient case that it is a forgone conclusion that there is evidence relevant to the case on the laptop, and
B) offered Ms. Fricosu sufficient immunity in exchange for her cooperation.
(Apparently Ms. Hofmann doesn't believe that the immunity awarded by the judge was sufficient in this case.)

[The20]

Sitwon

Despite the disappointing ruling, the EFF reps sill seemed pretty optimistic about this case for a number of reasons.
1. It's not about child porn.

I don't understand that point at all. Where did this come from now?

[Sitwon]

The20

Sitwon

Despite the disappointing ruling, the EFF reps sill seemed pretty optimistic about this case for a number of reasons.
1. It's not about child porn.

I don't understand that point at all. Where did this come from now?

It turn out that nearly every other case involving computers and 5th amendment rights were child porn cases. And as we all know, child porn is such a strongly emotional issue that it can be used to override people's rational thinking and lead to very bad policy or precedent being set with very little opposition. You know, the "for the children" argument that gets bad laws passed. It's hard to take a moral high ground or even a pragmatic, logical high ground when doing so essentially aligns you with child pornographers.