Posted on 01/24/2012 12:06:01 AM PST by LibWhacker
American citizens can be ordered to decrypt their PGP-scrambled hard drives for police to peruse for incriminating files, a federal judge in Colorado ruled today in what could become a precedent-setting case.
Judge Robert Blackburn ordered a Peyton, Colo., woman to decrypt the hard drive of a Toshiba laptop computer no later than February 21--or face the consequences including contempt of court.
Blackburn, a George W. Bush appointee, ruled that the Fifth Amendment posed no barrier to his decryption order. The Fifth Amendment says that nobody may be "compelled in any criminal case to be a witness against himself," which has become known as the right to avoid self-incrimination.
"I find and conclude that the Fifth Amendment is not implicated by requiring production of the unencrypted contents of the Toshiba Satellite M305 laptop computer," Blackburn wrote in a 10-page opinion today. He said the All Writs Act, which dates back to 1789 and has been used to require telephone companies to aid in surveillance, could be invoked in forcing decryption of hard drives as well.
Ramona Fricosu, who is accused of being involved in a mortgage scam, has declined to decrypt a laptop encrypted with Symantec's PGP Desktop that the FBI found in her bedroom during a raid of a home she shared with her mother and children (and whether she's even able to do so is not yet clear).
Colorado Springs attorney Phil Dubois, who once represented PGP creator Phil Zimmermann, now finds himself fighting the feds over encryption a second time.
"I hope to get a stay of execution of this order so we can file an appeal to the 10th Circuit Court of Appeals," Fricosu's attorney, Phil Dubois, said this afternoon. "I think it's a matter of national importance. It should not be treated as though it's just another day in Fourth Amendment litigation." (See CNET's interview last year with Dubois, who once represented PGP creator Phil Zimmermann.)
Dubois said that, in addition, his client may not be able to decrypt the laptop for any number of reasons. "If that's the case, then we'll report that fact to the court, and the law is fairly clear that people cannot be punished for failure to do things they are unable to do," he said.
Today's ruling from Blackburn sided with the U.S. Department of Justice, which argued, as CNET reported last summer, that Americans' Fifth Amendment right to remain silent doesn't apply to their encryption passphrases. Federal prosecutors, who did not immediately respond to a request for comment this afternoon, claimed in a brief that:
Public interests will be harmed absent requiring defendants to make available unencrypted contents in circumstances like these. Failing to compel Ms. Fricosu amounts to a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) that encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers to obtain such evidence through judicially authorized search warrants, and thus make their prosecution impossible.
While the U.S. Supreme Court has not confronted the topic, a handful of lower courts have.
In March 2010, a federal judge in Michigan ruled that Thomas Kirschner, facing charges of receiving child pornography, would not have to give up his password. That's "protecting his invocation of his Fifth Amendment privilege against compelled self-incrimination," the court ruled (PDF).
A year earlier, a Vermont federal judge concluded that Sebastien Boucher, who a border guard claims had child porn on his Alienware laptop, did not have a Fifth Amendment right to keep the files encrypted. Boucher eventually complied and was convicted.
Prosecutors in this case have stressed that they don't actually require the passphrase itself, and today's order appears to permit Fricosu to type it in and unlock the files without anyone looking over her shoulder. They say they want only the decrypted data and are not demanding "the password to the drive, either orally or in written form."
Because this involves a Fifth Amendment claim, Colorado prosecutors took the unusual step of seeking approval from headquarters in Washington, D.C.: On May 5, Assistant Attorney General Lanny Breuer sent a letter to Colorado U.S. Attorney John Walsh saying "I hereby approve your request."
The question of whether a criminal defendant can be legally compelled to cough up his encryption passphrase remains an unsettled one, with law review articles for at least the last 15 years arguing the merits of either approach. (A U.S. Justice Department attorney wrote an article in 1996, for instance, titled "Compelled Production of Plaintext and Keys.")
Much of the discussion has been about what analogy comes closest. Prosecutors tend to view PGP passphrases as akin to someone possessing a key to a safe filled with incriminating documents. That person can, in general, be legally compelled to hand over the key. Other examples include the U.S. Supreme Court saying that defendants can be forced to provide fingerprints, blood samples, or voice recordings.
On the other hand are civil libertarians citing other Supreme Court cases that conclude Americans can't be forced to give "compelled testimonial communications" and extending the legal shield of the Fifth Amendment to encryption passphrases. Courts already have ruled that that such protection extends to the contents of a defendant's minds, the argument goes, so why shouldn't a passphrase be shielded as well?
Fricosu was born in 1974 and living in Peyton as of 2010. She was charged with bank fraud, wire fraud, and money laundering as part of an alleged attempt to use falsified court documents to illegally gain title to homes near Colorado Springs that were facing "imminent foreclosure" or whose owners were relocating outside the state. Some of the charges could yield up to 30 years in prison; she pleaded not guilty. Her husband, Scott Whatcott, was also charged.
True. The government can search all they want. They can't require you to tell them where or what everything is that they might be looking for. The situation is analogous.
So am I understanding from this thread that it is the advice of Freepers that child pornographers should just hide their evidence in an encrypted laptop with a wipe password? and that the government has no right to get the password of the laptop involved in a crime because of the FIFTH amendment?
Ah yes, the old bugaboo of child pornography, trotted out to justify the taking of our liberties by government.
It is unfortunate, that technology can be useful to this type of scum, but that's just too freaking bad. The government is constantly trying to use any excuse it can to eliminate our freedom. I'm not buying their crap anymore. Many of us aren't.
I draw the line using a “rag doll” model. They can compel fingerprints, physical keys, DNA, etc. insofar as they can manipulate your limp unresitive (albeit uncooperative) body to take fingerprints, extract keys from pockets, snip a hair, extract a blood sample, etc. They cannot, however, compel you to act on their behalf and against your own interests - to wit, they cannot demand you speak (type, write, press buttons) words the whole point of which can and will be used against you. If they can find the password, fine; if it exists only in your head, no.
“Rubber hose cryptology” (to wit: threaten you with harm unless you confess the keyword) is not an acceptable legal tool.
What evidence do you have that the NSA can break PGP? I've not seen any. All they could really do is brute-force the passphrase, which might work if a weak passphrase was used. They'd have hell breaking mine. They'd probably manage it before the heat death of the universe, I'd be quite content to wait.
If you mean they have actually cracked the algorythms that underlie PGP, I and many others would be extremely interested in knowing that. Personally, I doubt it. Used to be the best crypographers worked in government. That's not necessarily the case any more.
I like your “rag doll” analogy. I think you’re on to something there. The court can allow the state to inspect, search, and take things— even as you say with fingerprints and DNA. But that logic does not extend to compelling a defendant or witness to say anything. I can’t think of any other example of somebody being forced to say or write some specific thing.
They tried but the FBI overreached & demanded to be able to read the encrypted data of the federal reserve & they said no & let it be known in terms that left no doubt that there would really really ugly economic fallout if push came to shove.
Remember all the things Hillary “forgot” about Whitewater, the Rose law firm, the 900 FBI files, ad nauseum ?
Lol, you sound like me. Mine was about 40 characters long. Bit of a pain to type in, but I type reasonably well... a few seconds and I'd be in business.
Well, the first 30 or 40 times I typed it, it was slow. After that, it pretty much just flies from my fingers.
People think really long passphrases are hard to use, but as long as you don't have some silly corporate policy to change them every 30 days (which is what they require now at where I work!!!!!) you can actually use decent passphrases that are easy to remember and quick enough to type that even someone shoulder surfing ain't getting much out of it.
Actually someone already sells that. Not PGP brand, can't remember who it is.
Just use the Hillary Clinton defense; “I don’t recall”:
http://www.freerepublic.com/focus/f-news/1584592/posts
I haven’t read the underlying case documents or the court’s opinion, but it seems to me that if the prosecutors can make out a probable cause argument for a search warrant to search the contents of the laptop, then the defendant here can be compelled to decrypt the contents of the laptop just as she could be compelled to turn over the keys to a locked filing cabinet if prosecutors could make out a probable cause argument for claiming that incriminating evidence was contained in that locked filing cabinet.
The question here, it seems to me, is more a matter of whether the prosecutors have made out a probable cause argument that there is incriminating evidence in the laptop and not merely whether or not an individual can be forced to divulge the decryption passkey to a laptop.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.