U.S. Court Extends Fifth Amendment to Encrypted Data

[ElPatron]

ITT: people thinking that your own personal files are the sole remnants of evidence available

If you are ordered by a court to produce a printed document you shred it not only are you guilty of contempt the shred document can be put together and used in evidence against you. Why should the process of encryption be treated any different from shredding? It is also clear that he was ordered to by a court after due process.

Shredding a document means destruction of the evidence.

Encryption only protects it, even if the result is not being able to use it in court either.

I think it's perfectly legal to forget a password.

 

[Baresark]

And great day for fraudsters, drug dealers, corrupt politicians, the various mobs, hit men, the Ku Klux clan, the Aryan nation and the other terrorist groups out there. So if Enron had just encrypted all their data they could have walked away scot free after defrauding ten of thousands of poeple. Rod Blagojevich should have sent an encrypted email instead of selling Obama's senate seat on the phone and he wouldn't be doing 14 years and the democratic process would have been for sale. But hey data privacy is way more important than protecting the democratic process.

Uh oh, you are in danger of being in the minority on an internet forum, beware.

In all seriousness though. The fifth amendment isn't about criminals protecting themselves from Crime A when they are guilty. It's about protecting themselves from Crime B in the case where they are innocent of Crime A. Also though, it can apply to Crime A. If a guy pleads not guilty, he is within his right to not say, "I murdered John Doe". It would be contempt of court and obstruction if he had, but it has to be proven that he did it, at which point contempt and obstruction do not matter. No one can say if what he is protecting is proof of guilt in said crime or not. But the important thing to remember is that these laws do not exist to protect criminals, they exist to protect innocent people of being convicted of crimes. All the Prosecution is trying to do is catch somebody for a crime, if they are the one's, great. If they are not the one's, great. All they are trying to do is connect you with the crime in question, regardless of guilt. Being a suspect is good enough for most people to ruin a life anyway. That is what due process is all about. Innocent until proven Guilty. It's far more important that innocent people have the tools to prove their innocence than the prosecution has the tools to put away anybody they see fit to lock up.

I hear people talk the talk about the "cost of freedom". But, by and large, they have it wrong. The cost of freedom is that occasionally guilty men go free in order to protect innocent men from being jailed for crimes they did not commit. If he is guilty, then that sucks. But, that is the cost of freedom, and I am more than happy to pay that.

Like it or not, this is a win for every innocent person who the police have ever wrongly accused of a crime and any future instances of that same thing.

Also, in reference to the security: It's supposed to stop people from getting into your data. A lot of people like to encrypt data so NO ONE but them can access it. Just because I don't want someone getting into my data doesn't mean I'm a terrorist or a criminal, it means I feel the data is private and that is the end of the story.

 

[RedEyesBlackGamer]

I am pleased with this ruling. Nice to see our Fifth Amendment rights upheld.

 

[Realitycrash]

Okey, I'm not from the US, so can someone PLEASE explain to me what the 5:th Ammendment is all about? Because after reading this, I imagined a scenario.
Imagine that there is a man that the feds know of, that have a trigger locked in a small box. If the trigger is not pressed within 24 hours, a bomb goes off somewhere, and a lot of people get killed. The feds know this, they have the man, he knows how to open the box, but he denies that there is a trigger in the box (though he confirms that there is something illegal in there, and that he can open the box, but he won't, because it would "incriminate himself"). The feds can not open the box without the bomb going off, nor can they find the bomb within 24 hours.
So, even though the man admits that he is hiding something illegal, and the feds have very strong evidence for thinking that this might be the trigger, they really can't force the man to open the box?
Really...?
I mean, really?

 

[isometry]

Okey, I'm not from the US, so can someone PLEASE explain to me what the 5:th Ammendment is all about? Because after reading this, I imagined a scenario.
Imagine that there is a man that the feds know of, that have a trigger locked in a small box. If the trigger is not pressed within 24 hours, a bomb goes off somewhere, and a lot of people get killed. The feds know this, they have the man, he knows how to open the box, but he denies that there is a trigger in the box (though he confirms that there is something illegal in there, and that he can open the box, but he won't, because it would "incriminate himself"). The feds can not open the box without the bomb going off, nor can they find the bomb within 24 hours.
So, even though the man admits that he is hiding something illegal, and the feds have very strong evidence for thinking that this might be the trigger, they really can't force the man to open the box?
Really...?
I mean, really?

How would your country force the man to open the box?

The fifth amendment is about court trials. It says you can't be forced to provide information that will help the court prosecute you.

If there is enough evidence that there is a bomb in the box and this guy planted it, then you can probably prosecute him without needing to open the box. The fifth amendment usually only applies when the cops don't know / can't prove what is in the box, so they can't put you in jail for what they think might be in there, and they can't force you to tell them what's in there.

Also it's important to know that if we're talking about an actual locked box, the cops can seize it with a search warrant. Therefore prior to these digital encryption cases, the "locked box" in 5th amendement cases is usually always a person's memories.

 

[Albino Boo]

And great day for fraudsters, drug dealers, corrupt politicians, the various mobs, hit men, the Ku Klux clan, the Aryan nation and the other terrorist groups out there. So if Enron had just encrypted all their data they could have walked away scot free after defrauding ten of thousands of poeple. Rod Blagojevich should have sent an encrypted email instead of selling Obama's senate seat on the phone and he wouldn't be doing 14 years and the democratic process would have been for sale. But hey data privacy is way more important than protecting the democratic process.

Uh oh, you are in danger of being in the minority on an internet forum, beware.

In all seriousness though. The fifth amendment isn't about criminals protecting themselves from Crime A when they are guilty. It's about protecting themselves from Crime B in the case where they are innocent of Crime A. Also though, it can apply to Crime A. If a guy pleads not guilty, he is within his right to not say, "I murdered John Doe". It would be contempt of court and obstruction if he had, but it has to be proven that he did it, at which point contempt and obstruction do not matter. No one can say if what he is protecting is proof of guilt in said crime or not. But the important thing to remember is that these laws do not exist to protect criminals, they exist to protect innocent people of being convicted of crimes. All the Prosecution is trying to do is catch somebody for a crime, if they are the one's, great. If they are not the one's, great. All they are trying to do is connect you with the crime in question, regardless of guilt. Being a suspect is good enough for most people to ruin a life anyway. That is what due process is all about. Innocent until proven Guilty. It's far more important that innocent people have the tools to prove their innocence than the prosecution has the tools to put away anybody they see fit to lock up.

I hear people talk the talk about the "cost of freedom". But, by and large, they have it wrong. The cost of freedom is that occasionally guilty men go free in order to protect innocent men from being jailed for crimes they did not commit. If he is guilty, then that sucks. But, that is the cost of freedom, and I am more than happy to pay that.

Like it or not, this is a win for every innocent person who the police have ever wrongly accused of a crime and any future instances of that same thing.

Also, in reference to the security: It's supposed to stop people from getting into your data. A lot of people like to encrypt data so NO ONE but them can access it. Just because I don't want someone getting into my data doesn't mean I'm a terrorist or a criminal, it means I feel the data is private and that is the end of the story.

You have still ignored my main point. Why should something the that has been encrypted have great legal protection than something that isn't. If you had the same information in safety deposit box a court order will grant access to it, if you do the electronic equivalent why should that have greater legal protection. All you guys going on about this being a victory are simply ignoring the fact that all other methods of storing information and exchanging are legally discoverable why shouldn't encrypted data be also legally discoverable. If you write on piece of paper your plan to rob a bank, that document is capable of being used in evidence against you. If you do the same thing on a computer and encrypt it you cant be touched. Why is it any different?

 

[Realitycrash]

Okey, I'm not from the US, so can someone PLEASE explain to me what the 5:th Ammendment is all about? Because after reading this, I imagined a scenario.
Imagine that there is a man that the feds know of, that have a trigger locked in a small box. If the trigger is not pressed within 24 hours, a bomb goes off somewhere, and a lot of people get killed. The feds know this, they have the man, he knows how to open the box, but he denies that there is a trigger in the box (though he confirms that there is something illegal in there, and that he can open the box, but he won't, because it would "incriminate himself"). The feds can not open the box without the bomb going off, nor can they find the bomb within 24 hours.
So, even though the man admits that he is hiding something illegal, and the feds have very strong evidence for thinking that this might be the trigger, they really can't force the man to open the box?
Really...?
I mean, really?

How would your country force the man to open the box?

The fifth amendment is about court trials. It says you can't be forced to provide information that will help the court prosecute you.

If there is enough evidence that there is a bomb in the box and this guy planted it, then you can probably prosecute him without needing to open the box. The fifth amendment usually only applies when the cops don't know / can't prove what is in the box, so they can't put you in jail for what they think might be in there, and they can't force you to tell them what's in there.

Also it's important to know that if we're talking about an actual locked box, the cops can seize it with a search warrant. Therefore prior to these digital encryption cases, the "locked box" in 5th amendement cases is usually always a person's memories.

As for how my country would deal with it, I honestly don't know. I am not aware of a "5th Ammendment"-esq law in our constitution, though one might exist. I think, however, that if there is enough evidence pointing to that the box contains the trigger, the authorities can order the man to open it. If he says "no", they can put him in jail untill he decides to do such.
And oh, yeah, the can seize it, but they can't open it (because in my example, it can't be opened, or the bomb would explode), so it becomes pointless.
And okay..If you can have a seach-warrant for a box or a car or whatever, why not for encrypted files?

 

[isometry]

As for how my country would deal with it, I honestly don't know. I am not aware of a "5th Ammendment"-esq law in our constitution, though one might exist. I think, however, that if there is enough evidence pointing to that the box contains the trigger, the authorities can order the man to open it. If he says "no", they can put him in jail untill he decides to do such.
And oh, yeah, the can seize it, but they can't open it (because in my example, it can't be opened, or the bomb would explode), so it becomes pointless.
And okay..If you can have a seach-warrant for a box or a car or whatever, why not for encrypted files?

It basically comes down to whether a password for encrypted data is "incriminating information" (protected by the 5th amendment) or whether it is just a key (so the police can demand it be handed over with a search warrant).

If the police have a search warrant and you refuse to give them the key then they can arrest you here too. What they can't do is force you to share incriminating information, like "where were you last night?", they can't arrest you just because you refuse to answer.

And okay..If you can have a seach-warrant for a box or a car or whatever, why not for encrypted files?

I agree it's surprising, that's what this court case is about so it's still be decided I guess.

 

[Tumedus]

You have still ignored my main point. Why should something the that has been encrypted have great legal protection than something that isn't. If you had the same information in safety deposit box a court order will grant access to it, if you do the electronic equivalent why should that have greater legal protection. All you guys going on about this being a victory are simply ignoring the fact that all other methods of storing information and exchanging are legally discoverable why shouldn't encrypted data be also legally discoverable. If you write on piece of paper your plan to rob a bank, that document is capable of being used in evidence against you. If you do the same thing on a computer and encrypt it you cant be touched. Why is it any different?

The difference is that you aren't needed to get into a safe deposit box. The correct analogy, rather than a locked box, would be if you wrote something in code in a journal. You cannot be compelled to reveal the cypher to your code. Similarly, you should not, and by this ruling cannot, be forced to offer the encryption key to your drive. They can have the evidence, but it is their job to make use of it, not yours.

 

[ph0b0s123]

For people talking about safes and lock boxes as an analogy. The Supreme Court already ruled sometime ago, that a suspect can be compelled to produce a key to unlock a safe with a key lock, but cannot be forced to provided a combination to a combination safe, as the combination is stored in the mind.

It think the analogue to pass code and HDD drive as combination and safe are fairly obvious for people to see.

I don't think this ruling means that the police cannot do their jobs in arresting child abusers etc. It just means they have to find other ways of gathering the evidence, than just assuming it will be be there ready for them to use on suspects seized PC's.

Even in this case, they knew where and when he was uploading illegal material. A timely raid would have given them the PC's with a lot of the data unencrypted temporally, which could have been recorded separately. This would have given them justification to force the guy to decrypt the evidence again later, if that was needed for a conviction.

 

[WanderingFool]

I find the FBI's decryption abilities far more contemptible than this guy's refusal to surrender the information.

Huh, I never saw that word used in a sentance before...

Also, as I have no clue what TrueCrypt is (save so much as a program that encrypts files), I thus dont have any idea of whether or not it is actually simple to break and the FBI suck, or it is insanly secure, and the FBI did their best.

 

[OldNewNewOld]

I hope they do this in the UK too, as far as I know they can force you to unencrypt your data.

Couldn't you just say you don't know how or don't know the password?
They can't prove you know or don't know it.
If they ask you hod you accessed it, you say you had it written on a piece of paper and lost it.


Just asking.

 

[Cecilthedarkknight_234]

nice to see the law catching up with the tech. Now.. i wonder whats on the fbi data bases lol

 

[Marcus Thomas]

If you are ordered by a court to produce a printed document you shred it not only are you guilty of contempt the shred document can be put together and used in evidence against you. Why should the process of encryption be treated any different from shredding? It is also clear that he was ordered to by a court after due process. The FBI didn't walk and demand he decrypt without a warrant is the same way that they bugged Rod Blagojevich phone. Why should it be treated any different, in both cases due process occurred. In encryption case he actually knew that and order was beginning potentiality made against him and had an opportunity defend himself in court which is more than Rod Blagojevich had. Why should data held on disk have greater legal protection than the same information held on paper or the same information exchanged by spoken word?

But encrypted data does get the same legal protection as other documents. A court can't just order someone to turn over documents that might not even exist, that would be like ordering someone to make up false evidence just to incriminate themselves. In this case the FBI seized his computers with a warrant, but they don't know that there is actually any evidence in the encrypted volumes, if anything at all. All they know is that he is using Truecrypt.

 

[RhombusHatesYou]

I find the FBI's decryption abilities far more contemptible than this guy's refusal to surrender the information.

How is it contemptible that the FBI aren't able to pull of something (cracking TrueCrypt assuming that the key is unknown) nobody on the planet has every succeeded to do yet?

Hmmmm... Considering TrueCrypt offers AES encryption in 128, 192 and 256 bit flavours and with current tech brute force cracking (trying every possible combination) 256 bit AES would take longer than the lifespan of the Universe, apparently the FBI suck because they've don't have a pocket universe where time flows a million+ times faster in which they've built a planet sized quantum supercomputer. The US taxpayers should be up in arms over the FBI's horrendous lack of foresight and inability to break the laws of physics at will.

 

[Therumancer]

My basic thought on the subject is that the goverment should be able to force people to decrypt files gained during a legitimate search. I understand why a lot of the anti-goverment, anti-law enforcement sorts on these forums will disagree, but the bottom line here is that to do otherwise is to basically say it's okay to commit crimes a long as you can hide the evidence well enough that the police can't access it.

I understand the bit with the 5th Amendment, but it's really a semantics game, and is definatly violating the spirit in which it was intended. I think it was Thomas Jefferson who mentioned that the Constitution/Bill Of Rights needed to be redone every 19 year or so, and this kind of shows why ours dearly needs an update as this is so far out of context to what that law had in mind and the spirit in which it was intended as to be ridiculous.

I'd point out that coded documents and such were not unknown to our founding fathers even that early, and when they captured guys like whits (British Loyalists) they didn't just say "oh well, I guess we can't break the code and prove anything, so we'll let it go" no, they tortured the guy until he decrypted it or died. It's been a while but I've read some stuff about how ruthless our founding fathers are and what their intent was, never mind when I took Criminal Justice and read about the early days of US law enforcement which was closer to the intent. I don't think we should go all the way back to that level of barbarity, but someone pleading the 5th Amendment here shouldn't work or be taken seriously. Someone needs a thump in the head.

Simply put if common sense eludes everyone, they should probably put it into law that legal seizure of data includes access to that data. Meaning any protection this guy had to protect his privacy/property was overruled by the warrent. It's not "self incrimination" as the information was already theirs. Either the person decrypts the data for analysis and the trial continues, or he suffers the full weight of the accusations against them. Basically if it's someone involved in a real estate scam and the records key to the whole thing are encrypted and the person refuses to provide that information, the trial proceeds as if the documents reinforced the most beneficial case to the prosecutor. This would motivate people to cooperate because even if found guilty they are not nessicarly going to be nailed by the worst possible interpetation of the data and accordingly suffer maximum penelties.

To put it into perspective if you were the victim of say a real estate scam, like the lady mentioned above (the secondary case, not the primary one the article is about) is accused of, I doubt you'd be in support of her getting away with it because she protected her records too well for the cops. As far as I'm concerned if a Judge already approved a warrent (which can be difficult to get in the US) that's good enough for me.

I'm not making some half arsed "only the guilty need to fear" arguement here, because I'm big on pivacy as a general principle. It's all about context with the computers having already been seized legally under warrent, and the case apparently going to court. This isn't the police randomly snooping through computers or anything, it's a stupid technicality based on an antiquidated law to which it is out of context to, being used to avoid the repercussions of crimes.

I mean you can't even really argue unrelated data, because in general such searches are limited by scope. If they saw open a computer for real estate charges and find kiddie porn, as much as I'd like to see the person charged, I'd imagine the limited scope of the warrent (to seek out information related to... ) would probably prevent it from being used. Of course then again I don't know how that applies to data, it's been a while. If it would allow them to be prosecuted I wouldn't much care mind you, as I've always thought warrents and search and seizure laws limited the police too much. One of the reason why our country is so frakked up is we play too many games letting the guilty go free, and get away with stupid crap.

 

[Telperion]

Hm...I use TrueCrypt...so, yay?
Nice to know that the software actually works!
And, no: I only crypt stuff that's really important to me. Nothing criminal.

 

[mrdude2010]

This is a great day for all who value the right to data privacy.

And great day for fraudsters, drug dealers, corrupt politicians, the various mobs, hit men, the Ku Klux clan, the Aryan nation and the other terrorist groups out there. So if Enron had just encrypted all their data they could have walked away scot free after defrauding ten of thousands of poeple. Rod Blagojevich should have sent an encrypted email instead of selling Obama's senate seat on the phone and he wouldn't be doing 14 years and the democratic process would have been for sale. But hey data privacy is way more important than protecting the democratic process.

"They who can give up essential liberty to obtain a little temporary safety deserve neither"- Benjamin Franklin

 

[Athinira]

But hey data privacy is way more important than protecting the democratic process.

You could make the same argument for warrantless phone taps, searches without any sort of probable cause and pretty much anything else. How far are you willing to go in the name of security? What are you willing to sacrifice?

Well, I'm a bit on edge about this ruling, as it particularly is something that has so much criminal potential. Plus your day to day lay-person doesn't encrypt your computer, which pretty well separates this from phone tapping.

My computer (and hard drives) are encrypted by TrueCrypt as well (with a strong password) and I'm your day to day lay-person. Except maybe a bit of pirated material (which isn't much) i have nothing illegal on my computer. No child porn or anything.

Don't make assumptions about what the "average" person does. Plenty of people who have done nothing wrong encrypts their computer. It protects your data in the case of theft. Also, encryption is becoming rapidly available to the everyman. Not only are several laptop-companies (ASUS, HP, Fujitsu Siemens) offering laptops with encryption capabilities (for example through BitLocker, which comes with the Ultimate/Enterprise-editions of Windows 7, or sometimes their own encryption software), but even hard-drive or SSD-companies build in encryption into their products. For example Intels SSD series has built in hardware-based encryption which can be activated and then requires a password before the drive can be used. It's readily available to the everyman who buys their SSD's (i have an Intel 320 series SSD myself, although i don't use the Encryption there in favor of TrueCrypts protection).

Encryption is becoming very common, including for your everyday-man.

Also...

I can't help but have a slight fear that arrest rates on child pornographers will probably take a drop after this. Hopefully it won't be too bad, and while I'm not particularly incensed by this, I hope other things of this ilk don't happen. I'd say we're just on the line.

You, and some other people, also seem to be misunderstanding what this ruling means. You see, even if the court had ruled against the man, the FBI would still not be able to decrypt the files without his help. Sure, they would be able to throw him in jail for not decrypting the files (contempt for court), but they still wouldn't be able to prove that there was actually something illegal on the computers/hard drives until they are actually decrypted. So all that would succeed doing is putting a possibly innocent man (or woman) in jail.

In addition, this would open up for innocent people being thrown to jail for not decrypting content they are unable to decrypt (on the basis that the court BELIEVES they are able to decrypt it, even if they are not). This could be the result of having forgotten the password (unlikely, but possible), lost the keyfiles for the encrypted content (much more likely) or simply not having been the person who encrypted the stuff in the first place (also a possibility).

Imagine the following scenario: The FBI arrests you and confiscates some computers from your home because they believe you have committed some sort of digital crime. One of the computers confiscated actually belongs to someone else (could be a friend who left it there), but the FBI believes despite your claims that it belongs to you. It's encrypted, so the feds ask the court to order you to decrypt it. You testify that you cannot decrypt it because it's not yours. The court doesn't believe you, and jails you for contempt of court. This is the type of can you'll be opening if people cannot invoke the 5th amendment in these cases.

Constitutional rights are there for a good reason.

 

[Marcus Thomas]

In addition, this would open up for innocent people being thrown to jail for not decrypting content they are unable to decrypt (on the basis that the court BELIEVES they are able to decrypt it, even if they are not). This could be the result of having forgotten the password (unlikely, but possible), lost the keyfiles for the encrypted content (much more likely) or simply not having been the person who encrypted the stuff in the first place (also a possibility).

You forgot to mention the possibility that empty space on a drive (perhaps left by securely deleting a file) might be mistaken for encrypted data.