Comments on: Judge orders defendant to decrypt PGP-protected laptop

Federal court orders defendant accused of having illegal data on his laptop to type in his PGP passphrase so prosecutors can access decrypted files.

[Marcus Westrup]

This is a strange case: Is the border guard claiming he had access to the encrypted drive before it was activated? And if so - could the defendant not then claim that "someone else" could have put images onto the drive after the fact?

Could get messy.

[awl168]

wow

[SeizeCTRL]

Shouldn't ICE be more worried about the actual immigration problem than what may or may not be on some guy's hard drive? With millions of illegals in the US, it seems their focus is in the wrong place.

[timber2005]

The whole concern over immigration died with the economy... very unfortunate.

[frobozz42]

My friend, I believe Canada right now has a far bigger problem with US Citizens crossing our border and using our medical services illegally while posing as Canadians in these trying times (and even before when the annual numbers were in the thousands costing us millions each year). The US has just a big a problem with world immigration as we do and Canada is not a haven for unsafe immigrants. All 9/11 terrorists came from other nations. NONE WERE FROM CANADA.

I am sick and tired of Americans complaining about Canada when they know absolutely nothing about it. Especially the fact that we are the world's largest trading partners economically speaking (no, it;s not China/US or Japan/US).

I also would like to point out that criminals from both sides of the border like to cross to safety when tough times come calling. So it;s not a Canadian to US issue. We have many American criminals in our streets and we get lots of wonderful (almost all) weapons imported illegally from the US. Just like Mexico gets for that matter which is why those little cartels are so heavily armed. America buys the products, supplies the ammo, guns and then people die.

Is this constructive? No. I could go on and on about what America does with respect to immigration and relationships with its neighbors. Stop pointing the fingers at "immigrants" (whatever that means today) and start looking deep inside your heartland. Otherwise the accusations will just be endless.

[dannyaq]

well, i think they should be focused on crime and enforcement of the law. they make sure nothing illegal comes across the border whether it is people, drugs, or pictures. undocumented people are not the only things illegal coming across the border, why should they only be concerned with that?

[::G]

frobozz42: Point me to a source documenting that Americans cross the border into Canada for medical services. I've heard of cheaper drug prices in Canada, but everything I've read is the other way around, i.e. Canadians sneaking into the U.S. for better medical care.

"We have many American criminals in our streets and we get lots of wonderful (almost all) weapons imported illegally from the US. Just like Mexico gets for that matter which is why those little cartels are so heavily armed."
Most of the weapons imported illegally by the Mexican cartels are illegal for Americans as well. (Believe me, I'd love to have some of those guns, but the ATF is the Gestapo!) If you get our criminals, do what we do when baddies rear their ugly heads -- shoot them!

[texaslabrat]

"I cannot recall that password". Worked wonders for Al Gonzales...why not this guy? I realize the difference between a court of law and Congressional testimony..but I think any court would be hard-pressed to show contempt of court for a forgotten fact.

[Vegaman_Dan]

I would think the very stressful conditions of the court could very easily cause him to forget the password- there are so many out there and... yeah. Let's see, was it "Password" ? No? Okay, let's try "pAssword". Still nohting? Well, there's only a few trillion more combinations. I've got time, do you?

[Endbringer]

Congressional testimony is not really that different from a court of law. You can still go to jail for perjury for either one.

[mrcjacobs]

This is troubling on so many levels. Suffice it to say that I hope this is overturned on appeal. If not this is just another case of how judges don't understand how to apply old law to new technology.

[briggman]

Attorneys for the defendant have filed an interlocutory appeal on February 20 to the Court of Appeals for this Circuit.

[scottthesculptor]

Wow indeed

"The Fifth Amendment says nobody can be "compelled in any criminal case to be a witness against himself,""
And
"defendants can be compelled to turn over a key to a safe filled with incriminating documents, or provide fingerprints, blood samples, or voice recordings"

Seems to be another legalese interpretation of plain english.
Same way they interpret the word "free".

[Edward_Virtually]

The entire TSA is illegal because it violates the 4th Amendment: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. " So it should be no surprise the 5th Amendment is also not respected by our government and "justice" system.

[CLStan]

OK...Lets say that his Z-Drive does, in fact, NOT contain pornography...but confidential customer information. Lets also say that the defendant also has Non-Disclosure Agreements (NDA) with those customers. By encrypting that data...he is protecting the confidential information that he agreed would be protected.

NOW take this case...where this defendant is being forced to produce his PGP key to decrypt the drive. If the defendant DOES produce the key for the government...now can he be sued by his customers for breaking the NDA?

Sounds like he is between a rock and a hard place either way he goes.


I can agree with most people about the new rulings on searching laptops or iPods or anything else electronic. Spend more time protecting our borders...don't worry about what we may or may not have on our laptops or MP3/Video players.

[sanenazok]

No, all NDA's have an exception for court orders.

[Stormspace]

NDA"s don't apply when a subpoena is used to compel information because a contract cannot compel you to do an illegal act.

[Vegaman_Dan]

If that data is confidential or proprietary in nature, that might be a problem because the entire drive's contents would be made public.

[mailbox001]

TRUECRYPT-HIDDEN VOLUME "It may happen that you are forced by somebody to reveal the password to an encrypted volume. There are many situations where you cannot refuse to reveal the password (for example, due to extortion). Using a so-called hidden volume allows you to solve such situations without revealing the password to your volume." http://www.truecrypt.org/docs/?s=hidden-volume

[Seaspray0]

right click my computer, select manage. select disk management. in disk management, right click the partition you wish to be "hidden". Remove the drive letter assigned. Now it doesn't show up as a drive in explorer. If you wish to access it without it showing up as a drive, then mount it as a folder in some obscure path. I'm not sure what truecrypt does, but this method will give you a hidden volume.

[pentest]

Seaspray,

That is weak, hiding something in WE doesn't make it hidden in any way, shape or form.

[rklrkl]

I'm surprised no-one's mentioned the draconian Regulation of Investigatory Powers Act (RIPA) in the UK yet. RIPA compels accused to reveal their encryption keys or face 2 years in jail (or 5 years if it's a national security matter). Apparently, this overrules the self-incrimination defence arbitrarily, though a recent appeals court ruling that an encryption key is the same as a physical key seems woefully incorrect (one can only exist in the person's head, the other has a physical presence separate from the person!).

I think it's outrageous that the UK has a law on its books that effectively means that you're guilty until proved innocent. As an earlier poster said, the best defence to this is to simply say that you've forgotten the encryption key - very hard for the prosecution to prove you know it, especially if they can't retrieve timestamps of the encrypted files (i.e. if they were dated very recently, it suggests that you do know the key, but if they're old or they can't find the dates, the "bad memory" defence gains weight).

[tanis143]

You know, I'm all for privacy, but if the drive did not have anything illegal, why fight it? If the guy is innocent, whats the big deal. He provides the key, they search the z drive, find no child pornography, and he is set free. Its the same as if a police officer asks if he can search you car. You say no, they find a reason to search it anyways. If you have nothing to hide, why be so uppity about it?

I know people are going to slam me with arguments like "Its our right to privacy, the government wants to strip us of that!" But honestly, that argument is bunk. If you are accused of a criminal act, the government should have every right to seek evidence of that crime. Of course, this is just my humble opinion, take it for what its worth. I guess since I have nothing to hide I dont "value" my privacy like others do.

[abering]

So you won't mind if the police search your house every week based on some trumped up criminal charge? Stop you and search your car every day making you late for work because they think you're a criminal?

The rules are in place for a reason. To prevent abuses by law enforcement. They exist for a reason (think USSR, Cambodia, Libya, etc). In many regimes the police need no reason to hold someone in jail and to search everything they own. You may want to live like that but I sure don't.

[::G]

So you have no problem at all with a police state? Why don't you move somewhere else? Better men than you died to preserve us the freedoms you'd so willingly **** away. Hmm, I bet you're a Democrat!

By your logic, if I want to search your property, all I have to do is make some bogus accusation and I wouldn't even need a warrant (although in the presence of a stack of mala prohibita laws, a warrant would be easy to manufacture).

[The_Rude_Bellman]

Why would this guy be a Democrat? Liberal groups, like the ACLU, regularly fight against illegal searches and draconian governmental regulation. If anything, he's a mindless follower of the last administration.

[newgun2000]

tanis142
please from now on when your on the internent
provide us with
Full name and address
currecnt place of work and contact number.
for now
we may need your drivers licence and SSN later on .
Don't worry if you don't need to hide anything you will not have any problem with the following request.
Oh ya if you could also make your C drive a shared file that would be nice too
:)

[Seaspray0]

However it works out, just remember... In the USA, we elect the officials that propose and enact the laws, we have a judicial system that applies those laws, and we have police agencies that enforce the laws. If we, the citizens, are not happy with the laws as they are applied and enforced, then we can elect other officials that will change the laws. It can happen. Don't forget about the consitutional amendment which started prohibition and the very next amendment that repealed it.

[pentest]

You don't value your privacy because you are willfully ignorant of history.

The founders put these rules in place for a good reason: experience.

[sciontcya]

Simple: "Sorry, I forgot my pass"
What are they going to do - waterboard the guy?
Not now!

[Bitwise]

This thread is moot - if you don't want to give your private encryption key, say you forgot it. End of story...unless they waterboard you, then you'll aparently sing like a canary. ROTFL

[pulstarjwc]

A broken tail light can be used to stop a car. During the stop, any other criminal infractions of the law can be legally brought against the person since stopping the car was a lawful act. Once another infraction is discovered, the car can be inpounded and searched. The problem of encryption is intentionally hiding information, etc. in the open. Because it is there, law enforcement has an expectation to search after inpounding a car, or taking posession of a laptop. The person does not have to comply, but he is refusing to allow access to something that exists. The contents are debateable, but there. Because there is supposedly illegal items found in the other drive/ partition for this particular case, the right to continue hiding information in plain sight is no longer a right.

[abering]

What proof do you have his Z: drive exists? The existence of PGP does not in and of itself prove the existence that any data on his laptop is encrypted. It is entirely plausible that the government is attempting to extract a non-existent password to a non-existent encrypted volume. And someone is sitting in jail for this?

[chrispix99]

Actually using that same logic. Say I get searched and they find my memoirs typed in a notebook (paper). Unfortunately I have come up with my own new language, and they can't read it. Should I be forced to decipher this for them? I don't think so. They have all the information they need. Aside I am curious as to what an 'animation of an adult and child' is really. Is that a movie? GIF animation? Hand drawn animation?

All PGP needs to do is issue 2 passwords, one deletes the information on the drive, and the other allows it to be decrypted on the fly. Actually he should take his laptop, format it, then start copying files over it. That should mess up the drive good and plenty. I am against child porn, but also against being forced to give the prosecution their case on a silver platter. Why don't they take it to the FBI, copy the partition, and do a brute force on it?

[TyvdAheksy]

It's a hand drawn or done on computer most likely it's lolicon images which are legal in quite a few places because it harms no one. I'm quite angry that they're wasting man hours over such a harmless thing.

From Wikipedia
""Lolita complex".In Japan, the term describes an attraction to young girls, or an individual with such an attraction Outside Japan, the term is less common and most often refers to a genre of manga and anime wherein childlike female characters are depicted in an erotic manner."

[pentest]

What if I was transporting a safe? You really think I will open for him, even if it is empty?

[pentest]

The guy obviously is smart enough to use a strong passphrase. Unless there is a known flaw in PGP brute forcing encrypted files using a strong passphrase could take millions of years to crack, even on a supercomputer. Unless, they get extremely lucky, like winning the lottery 1000 times in a row lucky.

Obviously they can't crack it in a reasonable time, which is why they are going through the totalitarian way. As long as this guy stands strong, he will eventually win out.

[czmyt]

"I could have sworn that my password was 'Go f yourself." Why don't you try that, 'Go f yourself!"

[gggg sssss]

so we need a self destroyning encryption system - type in the self destruct password and poof - scrambled data.

[LordSnotrag]

Encrypted or not, I'm sure they can copy the contents of the drive.

"Oops, I must've typed in the wrong password." "That's okay, here's a copy of your encrypted data. You can type it in correctly this time.

[CLStan]

Why not use something like "LoJack for Laptops" self-destruct feature? You can buy a LoJack License that allows you to self-destruct your data if the laptop is reported to be stolen. So you call LoJack and report it stolen and wait for an ICE agent to connect it up to one of their computer networks (to I guess copy the data off). The laptop frequently "phones home" and will receive the destruct command from the LoJack's servers. Thereby deleting the possible incriminating data as well as erasing all tracks that it even HAD a LoJack software installed. (("Oh...the HD crashed...and all the data is gone...I'm so sorry but it looks like you no longer have a case...Can I have my equipment back now?"))

http://www.lojackforlaptops.com/products/data_delete.asp

[ralfthedog]

1. Find the Open Source version of PGP.

2. Write a program that creates a random number of encrypted archives. These archives will be given a random passphrase .

3. Generate a number of real encrypted archives. Put stuff in them.

4. When they ask for your passphrase's , give them the ones you want them to have. Tell them the ones you don't want them to have are random decoys.

[texaslabrat]

As has been mentioned previously, Trucrypt already does this sort of thing in a more elegant fashion:
http://www.truecrypt.org/docs/?s=plausible-deniability
http://www.truecrypt.org/hiddenvolume.php

Best thing is...there are no "obvious" decoys to try to explain away under penalty of perjury ;)

[schizophreud]

I fail to see how:

a) this is self incrimination

b) the example the judge gave is not valid

Everyone is entitled to their own privacy but if you are linked to a crime (even tenuously) then you lose some of that privacy.

People are pointing fingers at the wrong place anyway. The judge, the lawyers, yada, yada, can only work with what they have. Why was his laptop searched in the first place? Why do border agents have the power to search items without warrant or cause? What's more, it is disconcerting that this border agent just casually looked through everything on the computer - this is not a forensically sound method and should be challenged rigorously in court.

[umbrae]

Maybe you should watch the laws that pass more closely. Not only can they search your stuff they can completely seize it and never return it for NO REASON. Seriously, they need no proof of wrong doing. They can even delete content (mp3, videos, etc) if they THINK they may be pirated.

Welcome to a world ruled by fear.

What this ruling means is that if you let police into your house they also have the right to open any locked door and open any safe. Guess the police will be standing out in the rain if they ever come to my house.

[pentest]

When you are linked to a crime, you don't lose your rights.

How is this different then a judge issue a court order to force the defendant to confess?

That is why it is self-incrimination.

[Dalkorian]

by schizophreud February 27, 2009 3:40 AM PST
Everyone is entitled to their own privacy but if you are linked to a crime (even tenuously) then you lose some of that privacy.
---------------------------------------------------------------
I claim you are a child rapist. Therefore you are now linked to a crime, though quite tenuously. When the police come breaking down your door to search every nook and cranny in your home at midnight, worry not about your privacy because you now have to prove your innocence.

Get it yet? Retardicons like you should be prevented from ever voting until you can prove you have a brain.

[codynews]

The ACLU is defending someone that was proven to have child porn on his laptop? WHAT A SHOCK!

Jack Bauer could get his password :)

Cody

[Endbringer]

You must not have read the article. He has not been proven to have child porn; they are currently trying to prove it by way of litigation. Innocent until proven guilty and all that. Kind of hard to understand that concept with the way our government indoctrinates our youth nowadays.

[pentest]

Endbringer,

For totalitarian right-wingers, accusation is the same thing as proof.

In their small minds, the cops never lie.

[martusfine1]

Choe buddy, Jack is a mere puppet, DAMMIT CHLOE!

[jimmyjdood]

Wow, that judge must be on some kind of 'government is always right' power-trip. I bet that ****** has more kiddy porn then this retard who got caught. The real question is WHY DID THE BORDER GUARD LOOK AT PORN ON THIS DUDE'S COMPUTER?! Seriously. On the job buck-o. Apparently if you're in the government you can just confiscate anything you fancy.

Either way this dude is screwed. The justice system is NOT innocent until proven guilty; unfortunately, it is the exact reverse. They send people to jail for crimes they didn't even commit for a generation and when they are let out they just say sorry.

Brute force attacks will take decades unless his password is like 'playground' or 'neverlandrules' or 'p0l35MokErS'.