
Court rules that people can't be locked up indefinitely for refusing to decrypt - danso
https://www.techdirt.com/articles/20200210/14173343897/appeals-court-rules-that-people-cant-be-locked-up-indefinitely-refusing-to-decrypt-devices.shtml
======
ereyes01
> The Fifth Amendment gives witnesses a right not to testify against
> themselves. Rawls argued that producing a password for the hard drives would
> amount to an admission that he owned the hard drives. But the 3rd Circuit
> rejected that argument. It held that the government already had ample
> evidence that Rawls owned the hard drives and knew the passwords required to
> decrypt them. So ordering Rawls to decrypt the drives wouldn't give the
> government any information it didn't already have. Of course, the contents
> of the hard drive might incriminate Rawls, but the contents of the hard
> drive are not considered testimony for Fifth Amendment purposes.

It sounds like this ruling is more against indefinite detention than a ruling
that allows you to invoke the 5th before handing over your passwords. The
quoted text above [1] tells me that the courts have thus far not recognized
any right to keep your data encrypted against the wishes of law enforcement.
Maybe it means they can only lock you up for 18 months, but I don't see how
this changes things appreciably. I guess if the crime you're accused of
carries a sentence worse than 18 months, it might be worthwhile, but who
knows...

[1] [https://arstechnica.com/tech-policy/2020/02/man-who-
refused-...](https://arstechnica.com/tech-policy/2020/02/man-who-refused-to-
decrypt-hard-drives-is-free-after-four-years-in-jail/)

~~~
thaumasiotes
> Rawls argued that producing a password for the hard drives would amount to
> an admission that he owned the hard drives. But the 3rd Circuit rejected
> that argument. It held that the government already had ample evidence that
> Rawls owned the hard drives and knew the passwords required to decrypt them.
> So ordering Rawls to decrypt the drives wouldn't give the government any
> information it didn't already have. Of course, the contents of the hard
> drive might incriminate Rawls, but the contents of the hard drive are not
> considered testimony for Fifth Amendment purposes.

This would seem to imply that if the government has ample evidence that you
murdered someone, they can require you to admit to it in court.

~~~
SpicyLemonZest
They can't require you to personally admit to it, but if they know about a
notebook where you wrote it they can require you to give up the notebook. (The
rule makes more sense if you think about it in terms of financial crimes; it'd
be hard to ever prosecute someone for fraud if they didn't have to give up
their books.)

~~~
baddox
> it'd be hard to ever prosecute someone for fraud if they didn't have to give
> up their books.

I'm pretty sure it's relatively simple for police to break into offices and
take financial records. I would imagine it happens relatively often, because
simply asking a suspect to give up their books seems more likely to result in
them attempting to hide or destroy their books.

The reason police and prosecutors don't like encryption is because they can't
use violence to acquire what they want, at least directly. They need new (or
at least specifically-clarified) laws about what they can do to you to make
you decrypt your data.

~~~
ajross
> attempting to hide or destroy their books

This is precisely why "Obstruction of Justice" is a criminal offense with
severe penalties available. The question then becomes: is deliberately
encrypting and refusing to provide access to those books obstruction?

I know the folks here would argue otherwise, but IMHO it's not at all a clear
argument legally. The original reasoning behind the fifth amendment was that
without that protection the government would be tempted to use coercive
tactics to induce a false confession. It's designed to prevent the torture of
accused witches, not to be a literal get-out-of-jail-free card for crypto
nuts.

~~~
thatcat
To not encrypt your books for a business would be negligence; I assume you
leave all your valuable information as clear text for the convenience of
future investigations?

~~~
ajross
I wrote "is deliberately encrypting _and refusing to provide access to those
books_ obstruction?". And again, I don't think that argument is anywhere near
as clear cut as you want it to be. The fifth amendment, again, is intended to
prevent torture, not to prevent the collection of evidence in a criminal
investigation.

So technicalities like you're invoking (is refusing to do something
"obstruction" or not?) need to be balanced against technicalities on the other
side (is providing a decryption key "testimony"?). And when courts have had to
make decisions like this they've almost always done it by splitting the
difference in some way instead of finding an absolute interpretation on one
side or the other.

~~~
thatcat
Oh, after the fact? I would agree that is definitely obstruction. Before the
fact - maybe for business, but not for personal. 5th amendment is to protect
against forcing someone to provide evidence against themselves whether that is
through torture or coercion, it does not matter.

~~~
ajross
But again you face the technicality: is providing access to already-existing
documents "testimony" in the sense the fifth amendment intends? You can't
torture someone into producing documents that don't exist, obviously! Nor is
going to jail for obstruction of justice "coercion", effectively by
definition.

I'm not saying I disagree with you in principle, I'm saying that very
reasonable courts might not. This isn't a cut and dry argument, at all.

------
nwallin
The idea of being locked up for not handing over a password terrifies me.

I was deployed a few years ago and living in the conexes. I was bored and
decided to go all out on encrypting everything. I picked a completely random
16 character password (I piped the output from /Dev/urandom through some tr
command that only allowed typeable characters through) and committed it to
muscle memory. I used this laptop every day for about a month before I went
home. I took about a one week vacation midway home.

With the break and change in surroundings I completely forgot the password. No
idea what it was. I tried for about a week before I have up and reformated it.
I don't encrypt my computer any more.

That's a crime they can lock you up for life for? Crazy talk.

~~~
donny2018
My understanding is that if there is evidence that you were committing crimes
with connection to this encrypted data, there is a problem for you. Otherwise,
this is not a problem.

~~~
Nasrudith
That sounds like a very dangerous assumption. You don't get to decide that you
have nothing to hide. They do.

------
supernova87a
The problem with this new territory is exactly the unsettled issue of whether
providing a password is testimonial and protected.

The protection against self-incrimination is/was a protection against being
put on trial and being forced to say or give testimony that you took part in
or committed a crime. It is not a protection against any and all evidence from
being produced against you.

In a previous age, not saying words was enough protection, because evidence
was usually physical (objects). The novel problem now is that the types of
evidence being protected by passwords (and the method of protection) now are
so closely linked that it's quite difficult to say whether being compelled to
reveal a password is testimonial.

Suppose a suspect murdered someone and was seen putting the weapon in a safe,
where the combination was known to be written in a person's private papers.
Those papers could be compelled to be revealed without jeopardizing privilege
because the discovery of the combination is not forcing a person to testify.
Even compelling the person to reveal the combination might not be testimony.
And in any case, the safe could be opened with much effort and a blowtorch.

But now, the safe can never be cracked, and the person's knowledge of the
password is the only thing that will open it. The person revealing the
password will surely confirm his/her guilt, so it now feels very much like the
info/knowledge is self-incriminating testimony.

Modern problems. They need some court resolution at a high level.

~~~
skrause
In Germany is rule is simply that you are not required to do _anything_ to
actively help our own prosecution.

They want to take your fingerprints? You don't need to help by lifting your
arm. They want you to open a safe? No need to tell them the combination,
through they will crack it open if you refuse. Same with encryption keys, you
don't need to say anything. Telling the truth? As the accused you're allowed
to lie in court however you want.

If you do get sentenced you can get a reduced sentence if the court thinks
that you've been cooperative. But you can never get punished simply for the
fact that you didn't help with your own prosecution.

~~~
supernova87a
> As the accused you're allowed to lie in court however you want.

Really? I'm interested to know how this works, and how it is not perjury.

~~~
freddie_mercury
Lying is not illegal. Lying _under oath_ is illegal. In Germany, judges rarely
require witness to swear under oath.

There also aren't juries in Germany.

There also isn't cross-examination in Germany.

The English way of law isn't the only way.

------
Hnrobert42
According to this article, the court can’t seem to understand why the
prosecution is going to such lengths to compel production of password. Is they
court willfully ignorant or is the article misleading?

It seems pretty clear the prosecution was trying to use this case to set a
precedent that not producing a password means you stay in jail forever. That
the accused is all but convicted for child porn makes it easy, from a PR
standpoint, for the prosecution to play hardball. If it was a journalist or a
whistleblower, amicus curae brief would be stacked to the rafters.

------
hedora
I wonder if it is possible to get the charges dropped because he was denied
the right to a speedy trial.

The government’s behavior on this is reprehensible, and, frankly, I’m more
worried about abusive prosecutors than pedophiles.

------
Supermancho
I wish people would stop linking to Tech Dirt, when there are alternatives
([https://arstechnica.com/tech-policy/2020/02/man-who-
refused-...](https://arstechnica.com/tech-policy/2020/02/man-who-refused-to-
decrypt-hard-drives-is-free-after-four-years-in-jail/)). Tech Dirt is a self-
proclaimed rumor mill site, similar to the The Sun.

~~~
etrabroline
Advocacy groups wear their bias on their chests proudly. "Neutral" news
purveyors hide their bias behind misleading headlines and selective reporting.
I would much prefer to read about something related to digital privacy in Tech
Dirt. Not that I have anything against arstechniaca in particular.

Can you link me to an example of a false rumor Tech Dirt has spread?

EDIT: As danso points out, this issue probably wouldn't even have been
reported by ars if Tech Dirt hadn't done the actual work of digging up the
court documents, so complaining about the admittedly outraged tone of their
articles is just petty.

------
ineedasername
There's a certain irony in the coincidence of the defendant's name being
"Rawls", who was a political philosopher [0] that sought to define what
"justice" should be within political society...

his work "Justice as Fairness" _" describes a society of free citizens holding
equal basic rights and cooperating within an egalitarian economic system."_

[0]
[https://plato.stanford.edu/entries/rawls/](https://plato.stanford.edu/entries/rawls/)

------
Causality1
A surprising but welcome ruling. This case is yet another example of the
government using the repugnancy of a crime to attack fundamental rights. It's
happened before, it's happening now, and it will happen again.

~~~
1000units
Alleged crime.

And this is braindead simple application of the Fifth Amendment. The courts
are a joke.

~~~
gamblor956
This is not braindead simple 5th amendment stuff. Among the unsettled the
questions in this case: (1) is providing a decryption key a testimonial act?
(2) are the contents of the drives would constitute testimony protected by the
5th Amendment?

Courts have come to different conclusions on both questions. Experts disagree
on both questions. Even the precursor question (is requiring a defendant to
provide the combination for a safe subject to the 5th Amendment?) is
unsettled.

The court in this case came down on the side of treating the decryption key as
a testimonial act, but avoided dealing with the 5th Amendment issues.

~~~
1000units
(1) is obviously true. Nobody can dispute this in good faith, even if the
jurisprudence is hard to settle among bad actors. Prosecutors are simply upset
technology makes the 5th powerful.

(2) is obviously false. You can't get to it without testimony, though, so too
bad. This is the intention of the 5th.

The court avoided the 5th Amendment issues because, again, the courts are a
joke.

~~~
gamblor956
(1) is not obviously true. Even judges known to favor defendant's rights can't
agree whether this would constitute a testimonial act. Claiming otherwise
suggests that you don't understand how the law works, how the technology
works, or both.

(2) is not obviously false, because you're conflating two separate things: the
encryption key and the contents of the encrypted device. Using the analogy of
a locked safe: a picture taken by the defendant, for example, would be
testimonial, but a picture taken by a third party would not. There's no way to
know without actually reviewing the contents.

If you have a simplistic understanding of the law, it's easy to make black and
white statements. But the law is not deterministic code, and has never worked
that way.

~~~
pbecotte
I dunno what the law says. However, it is very easy to imagine a situation
where someone LEGITIMATELY cannot decrypt the device. Is indefinite detention
without even a criminal charge a valid punishment for that? We can make
analogies all day "is it testimony? Is it like the code to a safe?"... But
there is a real concrete fact that the government wants to be able to imprison
someone indefinitely, without a jury trial, for claiming not to know something
when there is certainly a reasonable doubt about them knowing it.

So, whatever they have to do with the analogies, this decision cannot go the
way the prosecutor wants it to.

~~~
gamblor956
_Is indefinite detention without even a criminal charge a valid punishment for
that?_

The defendant was charged with child pornography offenses.

 _But there is a real concrete fact that the government wants to be able to
imprison someone indefinitely, without a jury trial, for claiming not to know
something when there is certainly a reasonable doubt about them knowing it._

The defendant was claiming to forget the encryption key to a device because it
allegedly contained a massive trove of photos that would likely get him locked
away in prison for life. Said device was one he had owned and used for years,
including shortly before he was arrested and the device confiscated (based on
testimony of his sister). It's not reasonable to believe that he just
conveniently forgot his encryption key as soon as he was arrested, especially
when forgetting the key was beneficial to him in the underlying proceeding.

 _However, it is very easy to imagine a situation where someone LEGITIMATELY
cannot decrypt the device._

Yes, but this isn't that situation. And this ruling benefits that hypothetical
person.

 _this decision cannot go the way the prosecutor wants it to._

We agree on that, but it didn't need to. The prosecution already had a strong
case against him on the underlying criminal charges. They got what they wanted
-- a deterrent to others trying to do the same thing just to avoid jail time.

------
anonsivalley652
A minor miracle, while Chelsea Manning still rots in Alexandria City Jail for
not cooperating with the political persecution of Assange.

~~~
jessaustin
It's so great, that Obama "commuted her sentence". Clearly that was a
meaningful action that significantly affected something.

~~~
favorited
He commuted her sentence _for a different crime._ He didn't give her a pass to
commit contempt going forward.

~~~
Dylan16807
A different crime based on the same original actions. It's way too close to
double jeopardy for my liking.

------
murftown
As others have mentioned a lot of this boils down to the wording of the 5th
amendment. Specifically: "...nor shall be compelled in any criminal case to be
a witness against himself...".

I recently found out that, for example, the Texas Bill of Rights [1] has
stronger wording that addresses this. From section 10: "...He shall not be
compelled to give evidence against himself...".

1\.
[https://statutes.capitol.texas.gov/SOTWDocs/CN/htm/CN.1.htm](https://statutes.capitol.texas.gov/SOTWDocs/CN/htm/CN.1.htm)

------
p1necone
Idea: write malware that drops random data/encrypted files on the infected
devices drive but is otherwise harmless, distribute widely. Bam! Plausible
deniability for everyone.

~~~
hedora
We sort of already have this, since stegfs provides an existence proof:

[https://en.m.wikipedia.org/wiki/StegFS](https://en.m.wikipedia.org/wiki/StegFS)

~~~
Buttons840
One problem with this is even after fully cooperating, the prosecution can
still claim you're hiding more.

------
VectorLock
What about if your password itself is an admission of committing a crime? Like
your pass phrase is "IMurderedJeffreyEpstein"

~~~
arthurofcharn
"I can't, your honor, the password itself is a confession." Is now my newest
password.

------
itchyjunk
Maybe in this case, it is somehow clear that there is encrypted stuff and the
government is also sure who can decrypt it (who owns the key to decrypt it.)
But since a variety of Deniable encryption[0] exits, what happens when they
think there is something to decrypt when there isn't? Or when they can't prove
it but they want to believe there is something there?

[0]
[https://en.wikipedia.org/wiki/Deniable_encryption](https://en.wikipedia.org/wiki/Deniable_encryption)

------
onetimemanytime
>> _Since that day, more than four years ago, Rawls has been held in federal
custody. Rawls seeks release arguing that 28 U.S.C. § 1826 limits his maximum
permissible confinement for civil contempt to 18 months._

This much jail times ruins almost everyone, think of the mess it makes in your
life /job/relationship /fiances. But I guess it beats doing xx years if you
provide the passwords and evidence found there is used.

------
tylorr
If your password itself was an admission of guilt then would that count as
testimony and protected under the Fifth Amendment?

~~~
nneonneo
If you pleaded the fifth on your password, the court might be able to compel
you to _enter_ the password such that they don’t get the password but do get
the data.

The next question is, if doing so immediately decrypts a file (e.g. a text
file) which is a direct admission of guilt, can you plead the fifth against
the decryption process itself, esp. if the government isn’t already aware that
such a “guilt declaration” exists?

------
bougiefever
It's no mistake that they select the most unsympathetic people to try to
weaken the protections for us all.

------
blofeld
What if you testified that you forgot the password (if password was used).
Unbelievable it might seem, let’s say you set up the passwd 1 week before the
deed, it is a possibility and IMO they would have to prove otherwise (+ good
luck with the decrypting)

------
asymmetric
mods: can we edit the title to mention that this is about the US? US law !=
global law.

------
tsukurimashou
How can they prove that the person didn't forget the password / no longer has
access to it?

I'm pretty careful with that stuff but still it happened to me before.

------
classified
Came there to read the article, then saw their informed consent form. By far
the best one I've seen up to now, my commendation for that.

------
jamisteven
So 365 days or so, just not indefinite.

------
OrgNet
so they can keep you 4 years if they have nothing on you?

> Man Who Refused To Decrypt Hard Drives Is Free After Four Years In Jail

~~~
sp332
18 months is the new limit. It only applies to federal courts though.

~~~
OrgNet
it is still wayyyyyyyyyyyy too long.

