Encryption and password privacy is an entirely unsettled area of US law. The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. So, for instance, say you had encrypted files of plans to build a bomb and detailed schematics of the White House. The judge can order you to decrypt the files without forcing you to reveal that the password was "K1llt3hPr3zn0w!"
As a practical matter, I've wondered what would happen if someone simply claimed they couldn't remember the password. Especially if one could make it look like the encrypted files hadn't been accessed in over a year.
But yeah: by simply refusing, you'd be thrown in jail for contempt and your only way out would be appellate review of the order. You'd have to challenge the contempt citation on the basis that the original order was unlawful.
I was a grad student in CS at Cambridge when this law was introduced. A nice man from the police came to lecture us about it.
We asked about proving that say the results from a Monte Carlo simulation, or even just a blank disc weren't encrypted - we were told not to worry the law would only be used against terrorists.
Since this was before 911 - the 'terrorists' in question were presumably the IRA, not sure they had much of an online presence back then.
A policeman came to visit our social education class in highschool, and my friend asked was it illegal to have an encrypted file that you don't know the password for. The policeman just looked at him like 'WTF are you talking about?'
Yes, but I'm assuming the UK didn't draft a law in the mid 90s to prevent Islamic attacks on the US.
The fact that their plans would be written in a foreign language (never mind a foreign alphabet) would have been more than adequate to keep it secret from British intelligence.
ps. You do know that we have been having terrorist attacks for almost a century.
>The fact that their plans would be written in a foreign language (never mind a foreign alphabet) would have been more than adequate to keep it secret from British intelligence.
This is one of the stupidest statements I have ever seen.
Why? Given that in 2010, nearly a decade after 9/11 and almost 7 years after the invasion of Iraq, the US military, State Dept, domestic law enforcement agencies and presumably intelligence agencies still have a severe shortage of Arabic-speaking staff, why do you find the statement stupid? The UK before 9/11 was much less focused on terrorism than the US is now. Developing robust foreign language capability in large organizations is very hard. That's why we often fail at it.
Plus, in my experience, Arabic is a difficult language for people who grew up speaking romance languages to learn. Perhaps not as difficult as Japanese, but still much more difficult than German or French.
Of course most police forces and so on will not have speakers available, but the comment said "British intelligence". Every intelligence agency has translators for all major languages, and have for decades (Arabic was an important language in the Cold War almost from the start). And they have translators for minor languages on tap - I bet they could find a Basque, Lapp, or Chukchi speaker if they needed one quicker than most universities.
We may have a stifling bureaucracy and an overstretched military, but at least the British Foreign Office actually has local knowledge and people who speak the language.
How easy would it be for an officer to present an encrypted computer and say - if you don't unlock this, you're getting thrown in jail. This is no different than a witch hunt, it's totally unprovable and throwing people in jail over not knowing a piece of information is unethical.
In the US, the prosecution is going to have to prove beyond a reasonable doubt that there is, in fact, encrypted information and that the suspect knows the key.
Yes, there are going to be gray areas. But if Bob has one computer in his house with his and only his finger prints all over it, wear that indicates that the computer has been used extensively, and the computer hard drive is filled with an encryption scheme wrapped around otherwise useless gigabytes of random data, then I am sure beyond a reasonable doubt that there is encrypted data on the hard drive and Bob has the key.
To establish reasonable doubt all the defense has to do is come up with some alternative way all of your facts can be true without Bob having the key. I can think of two from the top of my head.
1. Bob has mischievous friends, or worse, enemies at school. He leaves his laptop unattended/exposed where someone installs the encryption then wipes their fingerprints, or perhaps has worn gloves. Bob takes his laptop home and tries to regain access to the computer.
2. Bob unwittingly acquires the laptop from a criminal (he may have bought it, or maybe he fixes computers) who encrypted the drive and wiped away all fingerprints. Bob tries to gain access to the computer.
To be free from self-incrimination Bob can simply refuse to answer any questions about the laptop in question at all.
Doesn't work; it's an age old argument ("wasn't me guv, was my mate wearing my clothes") and it will be struck from the record if you claim it with no evidence.
Remember; reasonable doubt is not just the production of an alternate theory, it requires legitimate evidence to verify.
Both the example theories you cite would usually be easy to disprove as well. The first because you could look at various aspects of activity on the computer either side of the creation of the encrypted file and show that it resembles their usual activity (for example, there are numerous other ways to do it).
Now, this is where it gets clunky. I'm speculating here, but from direct experience so... take it with caution.
If you're under investigation for something and refuse to hand over a password then you're unlikely to automatically go to jail over it. The case that probably exists is that there is evidence to support the accusation, but no actual images/material. The latter is needed for a prosecution to succeed. I've never seen a case that looks like a blank go as far as demanding encryption keys - unless you are insanely careful there will always be traces left outside the encrpted file.
(BTW, Pro Tip - if you want to be secure from investigation, scrap windows (it logs way too much) and switch to Linux. Much of the forensics stuff is Windows focused so you instantly throw the [get the right file system and the main forensic tools won't even recognise it...]. Couple that with encrypted containers and you're on to a winner)
I think you're confusing "reasonable doubt" with "any doubt at all." Postulating malicious data-encrypting malfeasance is not reasonable doubt, it's conspiracy theory.
>One of the earliest attempts to quantify reasonable doubt was a 1971 article by Rita Simon and Linda Mahan, "Quantifying Burdens of Proof: A View from the Bench, the Jury, and the Classroom." In a later analysis of the question ("Distributions of Interest for Quantifying Reasonable Doubt and Their Applications," 2006[10]) , three students at Valparaiso University presented a trial to groups of students. Half of the students decided the guilt or innocence of the defendant. The other half recorded their perceived likelihood, given as a percentage, that the defendant committed the crime. They then matched the highest likelihoods of guilt with the guilty verdicts and the lowest likelihoods of guilt with the innocent verdicts. From this, the researchers gauged that the cutoff for reasonable doubt fell somewhere between the highest likelihood of guilt matched to an innocent verdict and the lowest likelihood of guilt matched to a guilty verdict. From these samples, they concluded that the standard was between 0.70 and 0.74.
People did that as a protest when the law was introduced - they emailed random numbers to the then home secretary (the minister in charge of the police in the UK)
> The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th.
This is a really subtle point, but in the US this is not (usually) the case, because this is still self-incrimination. You see, by entering the password, you are demonstrating that you have access to the encrypted information, and demonstrating that you have that power is technically self-incrimination. The password is one piece of information that you can't be compelled to divulge, and the fact that you have the password is a separate piece of information, and you cannot be compelled to reveal either. This is also a really important piece of information too, because in order to stick you with any legal consequences associated with the encrypted information, they generally have to prove that you have control over or access to the information. If a file is encrypted it is still possible to reasonably doubt that you have access to its contents despite having access to the physical drive it is on.
While it is (currently, as far as I am aware) untested in the court of law, it may be possible to compel someone to use or divulge their password if this does not incriminate the person to do this. I can think of two ways this could happen: a) access/control to the encrypted information has already been proven, so the testimony is of null value b) the prosecution is not allowed to use the fact that you know the password in court, and takes the gamble that they can prove access/control some other way (possibly by using contents of the information).
This is, of course, assuming that passwords are classified as "testimony" and therefore protected by the 5th Amendment. If the password is ever recorded on a physical medium such as a piece of paper, that piece of paper is probably not testimony, but rather evidence. This means that, like the key to a safe, it is protected by the 4th Amendment rather than the 5th, and you can be compelled to give up the paper via a warrant. This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick?
This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick?
Considering that the record for number of decimal places memorized for Pi appears to be 67,890 I'd argue memorizing a 128-character random sequence would be both possible and most secure. ;)
For symmetric ciphers, 128 bits, not characters is considered secure. Assuming the uuencode character set [A-Za-z0-9+/] it's 6 bit per character, so 22 chars only. Quite doable.
Yes, this is the "act of production" privilege. The Fisher decision established that content is not protected as 'testimonial'.
"but the Court has never on any ground, personal privacy included,
applied the Fifth Amendment to prevent the otherwise proper
acquisition or use of evidence which, in the Court's view, did not
involve compelled testimonial self-incrimination of some sort."
"The taxpayer cannot avoid compliance with the subpoena merely by
asserting that the item of evidence which he is required to pro-
duce contains incriminating writing, whether his own or that of
someone else"
"The existence and location of the papers are a foregone conclu-
sion and the taxpayer adds little or nothing to the sum total of
the Government's information by conceding that he in fact has the
papers. Under these circumstances by enforcement of the summons
'no constitutional rights are touched. The question is not of
testimony but of surrender.'"
Fisher largely overturned the earlier (1886) Boyd decision. The court did not expand the Fisher limits until 2000, when the Hubbell decision expanded the testimonial aspect of production and limited the scope of the "foregone conclusion" rationale. For more on the act of production privilege, see http://www.georgemasonlawreview.org/doc/17-3_Cowen.pdf
But this all relies on a particularly narrow reading of the role of the password in these questions. You have no right (Boyd being long overturned) to withhold physical evidence that may incriminates you.
Anyway, this is an interesting area of law and definitely worth watching.
For those seriously interested in this area of law, I highly recommend http://cyb3rcrim3.blogspot.com, as it's a really good source of info on the topic . Susan Brenner is a law prof, and her analysis of current cases is a constant treasure trove of interesting nuggets of insight into the law as it pertains to computers, electronic devices, and digital media. It's broken down enough for the layman to grasp, yet heavy enough in vocabulary and citations/references, that a you'll have a decent understanding of the law and how the justice system works.
Claiming forgetfulness concerning the key would give you a way out unless they could manage to crack it - at that point you would have dodged the self-incrimination bullet but could not be legally bound to simply "decrypt it."
I agree though - the entire thing is an absurdly mucky business. Apparently however the English law doesn't have much like that in the way of loopholes, or he simply refused to decrypt it outright.
I believe there is a specific law in the UK that mandates key escrow -- the government must be able to decrypt anything.
This has been floated in the US before, but it has not gotten good PR. As it stands now, it is a Constitutional law issue -- does the fifth amendment mean that you can't be compelled to get up in the witness box and talk, or does it mean that you don't have to assist the prosecution in any way? Right now, the courts seem to be split 50/50, but I feel that practicality dictates that you don't have to give up your key. First they have to accuse you of a crime and bring it to trial, then you have to refuse to decrypt the key, then the first trial has to stop, then the government has to prove that you know the key, then you have to be convicted and sentenced, then you can go back to the original trial after analyzing all of the decrypted "evidence". If encryption becomes widespread, this just isn't practical. It's easy to prove that you sell drugs; someone goes up to you and buys them. It's not easy to prove that you didn't forget your encryption key, because we have no way to observe someone's mind. Laws that prohibit crimes that can't be proved tend not to do well.
I believe the law in the UK allows for a jail sentence of up to two years for not revealing a password or encryption key.
While it's a dubious law in may ways, when you hear a UK politician calling for longer detention without trial and stating needing to break encryption you can at least point to this law and say that their claims about longer detention are nonsense.
On February 19, 2009, Judge Sessions reversed the
magistrate's ruling and directed Boucher "to provide an
unencrypted version of the Z drive viewed by the ICE agent.
That case was goofy because he initially typed in his password in front of law enforcement and provided them access, which nullified any claims of self incrimination.
It'd be similar to confessing to murder, telling the cops where the body is, and then invoking your right to remain silent, and expecting them not to look for the body under "fruit of the poisonous tree" logic.
You might be right. The wikipedia page said "the laptop was powered-up", which is a little ambiguous ("was [already?] powered-up"). But I think the principal is the same in either case. He already volunteered the information once.
Lying under oath is a criminal offense. Proving you're lying may be tricky, but if it were to somehow become obvious you were lying, you'd then have to answer for that offense as well as whatever other charges you were dealing with before.
This is really common advice, but I'm not sure it's the best option.
it was tongue in cheek. of course you don't have the right to lie to protect yourself from a legitimate investigation where probable cause already exists.
But some people are ASKING about the US, and everything I've said above is as it pertains to US law. Which is a worthwhile discussion anyway, as US readers are the largest single group of HN readers.
Apologies... If you had replied to a question, I wouldn't have felt compelled to post that. But in the UK, it's illegal to refuse to give up your password.
What happens if you say you forgot the password, and the files in question haven't been accessed in over a year? This is a question in my initial post that's still relevant to UK jurisprudence; an answer to which could move the conversation forward in a way far more productive than imagining I didn't know the article was about something that happened in the UK.
I'm not the one downvoting you. But I want a conversation that's adding information or content to which I wouldn't easily have access. So for instance, an answer to the question I pose above (or, if not a concrete answer, something along the lines of what would probably happen).
As a practical matter, I've wondered what would happen if someone simply claimed they couldn't remember the password. Especially if one could make it look like the encrypted files hadn't been accessed in over a year.
TrueCrypt's Plausible Deniability (http://www.truecrypt.org/docs/?s=plausible-deniability) makes these issues even more complicated.
But yeah: by simply refusing, you'd be thrown in jail for contempt and your only way out would be appellate review of the order. You'd have to challenge the contempt citation on the basis that the original order was unlawful.