Judge: Americans can be forced to decrypt their laptops

CNET ^ | January 23, 2012 | Declan McCullagh

[LibWhacker]

American citizens can be ordered to decrypt their PGP-scrambled hard drives for police to peruse for incriminating files, a federal judge in Colorado ruled today in what could become a precedent-setting case.

Judge Robert Blackburn ordered a Peyton, Colo., woman to decrypt the hard drive of a Toshiba laptop computer no later than February 21--or face the consequences including contempt of court.

Blackburn, a George W. Bush appointee, ruled that the Fifth Amendment posed no barrier to his decryption order. The Fifth Amendment says that nobody may be "compelled in any criminal case to be a witness against himself," which has become known as the right to avoid self-incrimination.

"I find and conclude that the Fifth Amendment is not implicated by requiring production of the unencrypted contents of the Toshiba Satellite M305 laptop computer," Blackburn wrote in a 10-page opinion today. He said the All Writs Act, which dates back to 1789 and has been used to require telephone companies to aid in surveillance, could be invoked in forcing decryption of hard drives as well.

Ramona Fricosu, who is accused of being involved in a mortgage scam, has declined to decrypt a laptop encrypted with Symantec's PGP Desktop that the FBI found in her bedroom during a raid of a home she shared with her mother and children (and whether she's even able to do so is not yet clear).

Colorado Springs attorney Phil Dubois, who once represented PGP creator Phil Zimmermann, now finds himself fighting the feds over encryption a second time.

"I hope to get a stay of execution of this order so we can file an appeal to the 10th Circuit Court of Appeals," Fricosu's attorney, Phil Dubois, said this afternoon. "I think it's a matter of national importance. It should not be treated as though it's just another day in Fourth Amendment litigation." (See CNET's interview last year with Dubois, who once represented PGP creator Phil Zimmermann.)

Dubois said that, in addition, his client may not be able to decrypt the laptop for any number of reasons. "If that's the case, then we'll report that fact to the court, and the law is fairly clear that people cannot be punished for failure to do things they are unable to do," he said.

Today's ruling from Blackburn sided with the U.S. Department of Justice, which argued, as CNET reported last summer, that Americans' Fifth Amendment right to remain silent doesn't apply to their encryption passphrases. Federal prosecutors, who did not immediately respond to a request for comment this afternoon, claimed in a brief that:

Public interests will be harmed absent requiring defendants to make available unencrypted contents in circumstances like these. Failing to compel Ms. Fricosu amounts to a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) that encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers to obtain such evidence through judicially authorized search warrants, and thus make their prosecution impossible.

While the U.S. Supreme Court has not confronted the topic, a handful of lower courts have.

In March 2010, a federal judge in Michigan ruled that Thomas Kirschner, facing charges of receiving child pornography, would not have to give up his password. That's "protecting his invocation of his Fifth Amendment privilege against compelled self-incrimination," the court ruled (PDF).

A year earlier, a Vermont federal judge concluded that Sebastien Boucher, who a border guard claims had child porn on his Alienware laptop, did not have a Fifth Amendment right to keep the files encrypted. Boucher eventually complied and was convicted.

Prosecutors in this case have stressed that they don't actually require the passphrase itself, and today's order appears to permit Fricosu to type it in and unlock the files without anyone looking over her shoulder. They say they want only the decrypted data and are not demanding "the password to the drive, either orally or in written form."

Because this involves a Fifth Amendment claim, Colorado prosecutors took the unusual step of seeking approval from headquarters in Washington, D.C.: On May 5, Assistant Attorney General Lanny Breuer sent a letter to Colorado U.S. Attorney John Walsh saying "I hereby approve your request."

The question of whether a criminal defendant can be legally compelled to cough up his encryption passphrase remains an unsettled one, with law review articles for at least the last 15 years arguing the merits of either approach. (A U.S. Justice Department attorney wrote an article in 1996, for instance, titled "Compelled Production of Plaintext and Keys.")

Much of the discussion has been about what analogy comes closest. Prosecutors tend to view PGP passphrases as akin to someone possessing a key to a safe filled with incriminating documents. That person can, in general, be legally compelled to hand over the key. Other examples include the U.S. Supreme Court saying that defendants can be forced to provide fingerprints, blood samples, or voice recordings.

On the other hand are civil libertarians citing other Supreme Court cases that conclude Americans can't be forced to give "compelled testimonial communications" and extending the legal shield of the Fifth Amendment to encryption passphrases. Courts already have ruled that that such protection extends to the contents of a defendant's minds, the argument goes, so why shouldn't a passphrase be shielded as well?

Fricosu was born in 1974 and living in Peyton as of 2010. She was charged with bank fraud, wire fraud, and money laundering as part of an alleged attempt to use falsified court documents to illegally gain title to homes near Colorado Springs that were facing "imminent foreclosure" or whose owners were relocating outside the state. Some of the charges could yield up to 30 years in prison; she pleaded not guilty. Her husband, Scott Whatcott, was also charged.

[NELSON111]

Maybe I am missing something here...but I do not see where this is a 5th amendment issue.

If a person has done something illegal...and the evidence for it is on a laptop...is that no different than a person doing something illegal and the evidence being in their house? The 5th does not protect an individual from the authorities getting a warrant and searching a house, car or business...and as far as I know...this person isn't a cylon.

So am I understanding from this thread that it is the advice of Freepers that child pornographers should just hide their evidence in an encrypted laptop with a wipe password? and that the government has no right to get the password of the laptop involved in a crime because of the FIFTH amendment?

Someone help me out here. Am I missing a point in this case?

[em2vn]

More of the police state’s growth. I hope this ruling ends up in the dust bin along with the police GPS stunt from yesterday’s SCOTUS opinion. This is clearly a case of self-incrimination. Take the contempt hit. It has to be better than turning over something that may put you away for many, many years.
It’s disappointing that the policing authority can’t find someone in government or out who can crack the code. With enough Red Bull and candy bars you can get some college students to do the job.

[Styria]

This isn’t a Fifth Amendment issue. It has to do with the Fourth and the right to be secure in her papers; a hard drive is just the media they’re stored in. There’s a valid court order and it’s not unreasonable. She needs to produce the password or go to jail.

[KrisKrinkle]

******It strikes me that this is a clear 5th amendmment issue... If YOU are forced to decrypt the drive, then YOU are being forced to self incriminate. Isn't that exactly what the 5th amendment is about? The actual relevent wording of the Fifth Amendmant "nor shall be compelled in any criminal case to be a witness against himself"****

Right. If you can be forced to self incriminate by decrypting the drive thereby revealing incriminating evidence, can you be forced to self incriminate by taking law enforcement officials to the location where you buried the cougar or wolf or other protected species you may or may not have killed, or by walking them through the scene of the crime you may or may not have committed, or by taking them to the location of the unregistered fully automatic Uzi you may or may not have hidden?

All of the above could be done without actually speaking, but could still be incriminating.

It won't stop with this.

[zeugma]

I could see the creation of “chameleon” PGP systems that when brought up with one passphrase have all the naughty bits, but when brought up with another one have naughty bits permanently erased.

That already exists.

The government really wants to be able to compel you to give up your keys.  Personally, I think we ought to tell them to bugger off.

[MD Expat in PA]

Someone help me out here. Am I missing a point in this case?

Yes. The person in question has not been convicted of doing anything illegal but at this point has only been accused of committing a crime.

The police and prosecutor can obtain a search warrant from a judge and any incriminating evidence found in such a search can be entered into trial but the accused cannot be compelled to self incriminate, i.e. say giving them the keys to their house, telling them all their bank account numbers and in this case decrypting their own computer or telling them the password for the convenience of the police and prosecutor looking for evidence. If the police can figure them out and under a search warrant, it’s fair game. But you can’t compel someone one divulge information contained in their own head or thoughts that might incriminate or further incriminate themselves.

[Pollster1]

I’m not a fan of criminals, but I am a fan of the “Supreme Law of the Land”. The court got this wrong. The government should turn the laptop over to NSA and see if they can get in (they can), but the accused should not be compelled to produce incriminating evidence.

[Magnum44]

Exactly...i forgot my password your honor...I tried to remember...gave it my all...really I did...

Oh, and I used to own guns...but they all got lost in a tragic boating accident...

[expat1000]

>>More along the idea you mentioned, I’ve seen programs for iOS devices (and I’m sure they exist elsewhere) where it uses a pair of passwords: a “dummy” password that unlocks a “safe” set of files and a “real” password that unlocks the real hidden content.

Truecrypt is one.

[NELSON111]

OK...that makes more sense. Thanks for the explanation. Knew I was missing something and the "house" explanation clears it up. It's easy for the po-po to break into a house without you telling them where the key is. Not so easy for a laptop.

Thanks again.

[zeugma]

Just a portion of the pass phrase awould enable most cracking algorithms a 98% chance to succeed....

 

It won't help you at all with PGP providing you have a robust enough passphrase. I could give you 10 characters of my PGP passphrase, and you'd still need millenia to decrypt my stuff. That is, if what you're talking about is gaining bits of the passphrase to reduce the size of the brute force attack you'd need to make on it. If you're saying that providing part of the passphrase gains you anything in actual cryptanalysis of the cyphertext, you're way off.

PGP is industrial strength encryption provided you take care with your secret key and passphrase.

[expat1000]

The very first thing the feds always do is make a bit-level copy of the hard drive

With operating systems becoming more complex, it is increasingly important to protect fragile computer evidence. Be confident about maintaining the integrity of your data during examination with hardware write protection devices from Digital Intelligence. Digital Intelligence designs and offers parallel IDE, serial ATA and SCSI hardware write blockers, as well as other custom solutions, to effectively address specific write blocking requirements. Learn how our UltraKit, UltraBlock, FireFly, FireBlock, SCSIBlock and FireChief devices can maintain the integrity of your evidence.

[Magnum44]

Agreed, and this persons attorney should be pointing this out. While the judge should know better, many think they are the law in their own court (which is partly true) and will make demands that go beyond the protections in the constitution. But even such a lazy judge will usually concede if the attorney makes good arguments in law as to why such an order can be problematic.

[mo]

thats easy...two pass phrases...a “throw-down” and the real one...the first opens files anybody can look at ...

[Thomas Truxtun]

I am unable to locate the original article on CNET. Hmmmmmmm.

Nothing in the Constitution says that I can be forced to incriminate myself.

[PapaBear3625]

Exactly...i forgot my password your honor...I tried to remember...gave it my all...really I did...

Better yet: stand mute. Say nothing at all, and let your lawyer do all the talking. Never say a false statement in court yourself. Let your lawyer do it for you, that's what you're paying him for.

[ctdonath2]

Already exists (dunno about PGP, but...)

TrueCrypt can be set up with “plausible deniability” http://www.truecrypt.org/docs/?s=plausible-deniability where an encrypted volume may have another encrypted volume hidden therein, and write operations on the former can encroach on and destroy the latter.

Convincing the adversary that you’ve handed over the key and revealed everything, however, may be a different problem. Beware “rubber hose cryptology”.

[TalonDJ]

Anyone who wants to avoid turning their data over just needs to sign a license to FES that will exclusively and completely and irrevocably sell all of the content of their hard drives, clouds, phones, personal computers etc etc to FES. For $20 a month, FES will lease access to that content and the drives/cloud/phone etc back to you, encrypted.

Then every time you install something or save something you have to fill out export licensing paperwork.

[Ramius]

It’s an interesting case, and I don’t think it’s necessarily obvious. A judge can compel someone to provide the contents of a locked safe. What’s the difference? Just because in some cases the state might be able to open a safe themselves without help from the defendant, it seems that the operative portion of the event is the valid court order. If (hypothetically) someone had an unbreakable safe such that the only way in was the use of a combination I think that same court could compel the defendant to open it or provide the combination. Is that self-incrimination? Or is it contempt of court to refuse?

It’s a good question. It seems clear too that if somebody just “forgets” the encryption key it’s impossible to prove otherwise. I can’t see how someone could be held in contempt for a failure to recall something. The court can’t compel someone to do the impossible.

[mo]

Unfortunately, IMHO, the judge here needs a “We the People” moment...and a reminder from his employers what the Fifth Amendment is all about....