Hacker News new | past | comments | ask | show | jobs | submit login

What stops your users from getting subpoenaed via their ISPs?



Presumably, their users have the right to not incriminate themselves.


The US right against self-incrimination does not protect against being required to provide records which already exist.

It only protects against being required to give incriminating statements of a testimonial nature.

As an extremely contrived example, if you've spontaneously written a confession to a crime and the cops learn of this, they can subpoena you and order you to hand it over. But they can't just require you to write out a confession or speak one in court.

(Cops do get people to confess, of course, but there is some element of persuasion and choice involved in that decision.)

As a much more common example, with the right level of evidence to motivate this request they can require your fingerprints as part of a criminal investigation. This is true even if they do not arrest you and even if the fingerprints will incriminate you. But they can't require you to answer incriminating questions.


This doesn't work for client-side encryption, though–I cannot be forced to give up my keys or passwords.


Client-side encryption doesn't always solve this.

Two main exceptions:

First, if the encryption is unlocked by a physical device that doesn't require a memorized code, or by your personal biometrics, they can get that without violating your right against self-incrimination.

Second, if they know what information is being hidden by the encryption and just need a copy of it to prove their case, the foregone conclusion doctrine lets them demand it anyway. (They are not demanding the key or password in this case, just a decrypted version of information they already know exists.)

But sure, in other cases it can have the effect you say.


> Second, if they know what information is being hidden by the encryption and just need a copy of it to prove their case, the foregone conclusion doctrine lets them demand it anyway.

Note that they are then not allowed to use the fact that you could unlock it against you.


True, but they can do that with the actual contents of the information itself, and also with the fact (if true) that you owned or possessed the encrypted device on which it was stored. Just not the fact that you knew how to unlock it.


There was a recent successful challenge to the "foregone conclusion" bit (in Florida?)

I'd be surprised if that decision survives another level of appeals court.


Do you mean G.A.Q.L. v State of Florida, decided last month by their state court system's Fourth District Court of Appeal? Here's a link to that opinion:

https://www.4dca.org/content/download/404430/3468412/file/18...

It doesn't actually challenge the foregone conclusion doctrine as applied to the data behind the passcode!

It simply concludes that the order to produce the passcodes itself would be forbidden testimonial self-incrimination under the Fifth Amendment, and that the state didn't show that they knew "with particularity" what the passcode was protecting, so they couldn't order production of that under the foregone conclusion doctrine.

It appears that does it reject the foregone conclusion as a means to get the passcode itself, because that's not what the state is really trying to do. Matthew Heiman agrees with you here that this may not be a correct decision: http://reason.com/volokh/2018/11/05/foreign-governments-will...

My understanding is that, while the question of compelling passcode disclosure is not fully settled law at the SCOTUS level or in most US circuit courts of appeals, the trend of rulings mostly grants first amendment rights to them. Do you know otherwise?

(Note I'm not a lawyer, just a former law student who continues to geek out about this stuff.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: