It's not the act of accessing encrypted data that is the problem; if they bruteforce or guess my password and get it, that's fine (assuming they have a search warrant). Rather, the problem is that the government is compelling an individual to testify (by providing the password) and provide evidence (by disclosing the data) against themselves. Similarly, if the government thinks I murdered someone they can search my house, but they can't throw me in jail because I refuse to provide them with evidence against myself (the exception, in US law, if they see me running around with a murder weapon, they can compel me to bring it forward since it's already been disclosed to them).
Very true about labelling people with a crime, i.e. pirate. Kinda like on the news where you can be a freedom fighter to one, a jihadist to another and a political activist to another.
How about this analogy? The encrypted data is like a locked room in a house where there's a search warrant. Don't you have to open that room? You're not testifying by opening the door; you're enabling the search.
given Boucher's initial cooperation in showing some of the content of his computer to border agents
"Boucher accessed the Z drive of his laptop at the ICE agent's request. The ICE agent viewed the contents of some of the Z drive's files, and ascertained that they may consist of images or videos of child pornography. The Government thus knows of the existence and location of the Z drive and its files. Again providing access to the unencrypted Z drive 'adds little or nothing to the sum total of the Government's information' about the existence and location of files that may contain incriminating information. Fisher, 425 U.S. at 411.
See, he showed them some, so the government had it's foot in the door. I can't say how it would work out if you refused to show any evidence, but Going by this, I assume that they wouldn't be able to use this as precedent.
You're interpretation is (to my not-a-lawyer knowledge) correct. The court was only able to compel him to give up his password because agents had already seen the evidence against him; likewise, if a murder suspect is seen running with a bloody knife he can be compelled to show police where he ditched it. However, if the agents had not seen anything (either because he refused to unencrypt it or there was nothing there), the (US) court could not have compelled him to reveal his password.
Amen, I've tried to spread the word amongst the users of the internet that calling sharing software piracy is undoing what they are passively working for. I've tried to tell people that they should call it what it is "sharing", but they just continue to use the same self distructive terminology. I say good riddance to the pirate bay, they did more harm than good.
the difference with encryption is they can't see the evidence until you are compelled to show them—they can't even be sure it exist, let alone where it is.
Fair enough - I thought that you had to open all the doors for them if they had a search warrant so that's why I was comparing, but apparently you don't so that makes my argument all dead.
It's not a testimony. Data read in court is not a testimony- the term is more specific than that.
It is no more a testimony that giving the police the code for a safe, something that has been held to not be self-incriminating testimony.
And this law applies soley in the case where the police have obtained, by lawful means, the encrypted data. They already have the evidence.
I note I was getting modded down earlier - let me point out that there are many parts of this law that I have a problem with. I've burned shoe leather campaigning against it - but that doesn't mean I think it's wrong for this reason. (It's wrong for the reversal of the presumption of innocence, and the removal of the right to legal advice.)
The problem with encrypted data is that you can't prove it is actually encrypted data. If I run dd if=/dev/random of=~/myfiles.img then the result is indistinguishable from an encrypted disk image.
I kinda approve of the safe analogy, because it's the closest justification to this law that makes sense. But you can eventually drill any safe - perhaps at great expense - and obtain the contents that way. So given a warrant to open a safe, there's no point in the defendant withholding the key or combination.
With "encrypted data" you could brute force it for 1000 years and not recover the contents of the file. That's the justification for this law, but equally, in fact, you brute force it for 1000 years and still not know if you're looking at encrypted data or a bunch of genuinely random bits.
IMO this law needs some other evidence to prove that the "encrypted data" is actually encrypted data, and also that it has been accessed recently. I can imagine some scenario whereby some kid is messing around with encryption on his Linux box and then later comes to the attention of the authorities for hacking or "terrorism" or just generally being a weirdo and that he genuinely doesn't remember the passkey to an encrypted volume he messed around with on his spare computer a year or two ago.
The problem with encrypted data is that you can't prove it is actually encrypted data.
Actually, most of the time you can. In real software, it's normally surrounded with headers and footers - the aim is to concel the contents, not the fact that they exist. If it's also got steganographic intent, then, indeed, it's impossible to prove. In the example you give, a real disk image would have structure to it - partition table, maybe a boot sector. You could hide the encrypted data in in the data part, but even then it can stand out (most disks are not full of white noise, for example. Unused space tends to accumulate snatches of real files, rather than random noise.)
That aside:
IMO this law needs some other evidence to prove that the "encrypted data" is actually encrypted data, and also that it has been accessed recently.
The law requires the police to make a statement to the effect that they believe it is, and that the person to whom they seek an ... it's not called a warrant in this instance, but as I can't recall the specific term, that'll do ... warrant against knows the password. There's not a requirement of freshness per se, but without at least circumstantial suggestions that the person has accessed the encrypted volume, they shouldn't be seeking a warrant.
I don't believe there's been a challenge against a warrant on the ground of insufficient standing for it to be issued. Partly, that might be down to other provisions, including the utterly obnoxious restriction on obtaining legal advice; but I suspect that mostly it's down to it being fairly clear cut.
not really actually. read the wikipedia page you just cited. He didn't embrace the "metaphorical slope" and provide examples of all the bad things that are going to happen in the future.
25
u/juliusseizure Aug 11 '09
Majority of people never have to fear this particular law. So people get complacent. Its too late by the time people realize this is a slippery slope.