Australia Man Receives Reduced Sentence Due to Encryption

From the Courier-Mail:

A man who established a sophisticated network of peepholes and cameras to spy on his flatmates has escaped a jail sentence after police were unable to crack an encryption code on his home computer.

[…]

They found a series of holes drilled in to walls and ceilings throughout the Surfers Paradise apartment with wires leading back to Wyllie’s bedroom.

Police seized his personal computer, but files were encrypted and a video camera was not plugged in.

[…]

In passing sentence, Judge Devereaux took in to account the 33 days Wyllie had spent in custody after being arrested and ordered that two years’ probation was sufficient punishment, given that there was no hard evidence proving he had secretly recorded his flatmates.

Tags: , , , , ,

Posted on October 21, 2009 at 7:19 AM • 50 Comments

Comments

noah • October 21, 2009 7:38 AM

Article is a little light on the details, but all they found were wires, yes? No recording devices at the end of those wires? How do we know the poor sod did anything except get pressured into a plea bargain? You can’t spy on anyone with just wires.

Roy • October 21, 2009 7:57 AM

This brings to mind something that worries me. Suppose the authorities have seized your computer and demand your password. You write it down for them — a forty-character string deliberately selected to be hard to pick up shoulder-surfing and guaranteed to defeat any dictionary attack — but when they try using it, the guy doing the typing cannot enter a ten-character string without making a few mistakes. After three tries, he decides you lied about the password, and now you’re in worse trouble. You offer to enter it correctly yourself, but they won’t let you near ‘the evidence against you’.

You have no legal protection against the incompetence of your accusers, who no longer have to prove your guilt: they just have to prevent you from proving your innocence.

Ken • October 21, 2009 7:58 AM

@noah: Correct. This is exactly why the judge sentenced the man to two years’ probation instead of prison time, even though the man pleaded guilty.

He noted that the man had already in effect served 33 days in gaol after being arrested and that there was no hard evidence to support the accusation.

A win for the Australian justice system. I really expected we’d see similar results to what the UK has observed when it comes to dealing with encryption keys and self-incrimination issues. I must say, I’m pleasantly surprised.

Although, it’s not clear in this case whether the police asked for the encryption key/s or how they asked for them.

Ken • October 21, 2009 8:03 AM

@Roy
“You have no legal protection against the incompetence of your accusers”

Isn’t this exactly what criminal defence attorneys, juries and judges are in place for?

Besides, when has no information become incriminating information? That’s not a line you can cross without causing an awful load of unintended consequences in future cases.

casey • October 21, 2009 8:05 AM

So it is okay to drill holes and spy on your flat mates as long as you don’t record it? If he records it, but encrypts it and does not share it with anyone else, isn’t it just the same as him remembering what he saw? What if he only drew pencil sketches? I am not sure what the crime is- the seeing itself or the transfer of information beyond the 1st person.

Jared Lessl • October 21, 2009 8:27 AM

Besides, when has no information become incriminating information?

In the UK, refusal to disclose encryption passwords is a felony unto itself, up to 5 years prison time.

Evil_Trev • October 21, 2009 8:52 AM

One cannot help but wonder about a few unresolved issues from this tale of woe, Did our hero have his computer and unorthodox wiring returned to him ?

Do the subjects of his interest still live in the appartment block with him ?

If instead of encryption, he had used, for example, a stenographic method, when asked for keys/password he would have to say he did not have any (truthfull) would that result (in the uk) of a conviction ?
(even if all he did was rename them ‘.doc’ or some such)

enquiring minds, that don’t want to be test case, want to know

Matt from CT • October 21, 2009 9:22 AM

You have no legal protection against
the incompetence of your accusers,
who no longer have to prove your guilt:
they just have to prevent you from
proving your innocence.

The police shouldn’t be trying to decrypt the original drive, anyways.

Step 1 (after determining you preserved any evidence you can that will be lost by powering off the computer) is to duplicate the hard drive. Original gets an evidence seal and locked away afterwards.

All further attempts, by the police or defendant, should be against the duplicated drive or the encrypted files pulled off the duplicated drive.

Grande Mocha • October 21, 2009 9:53 AM

What if you honestly don’t remember the key?

I forget my passwords all the time. How can a judge compel you to produce something you don’t have?

HJohn • October 21, 2009 10:13 AM

@roy: “You write it down for them — a forty-character string deliberately selected to be hard to pick up shoulder-surfing and guaranteed to defeat any dictionary attack — but when they try using it, the guy doing the typing cannot enter a ten-character string without making a few mistakes. After three tries, he decides you lied about the password, and now you’re in worse trouble. You offer to enter it correctly yourself, but they won’t let you near ‘the evidence against you’.”

Or you just type it to a text file and let them copy and paste it. I believe it would be hard for them to convince a jury beyond a reasonable doubt that the correct password wasn’t the correct password.

BF Skinner • October 21, 2009 10:33 AM

@Roy “You have no legal protection against the incompetence of your accusers”

Since when? You, or as Ken points out, your lawyer can assail any aspect of the evidence entered against you. That includes attacking the competence of the individual collecting it. A lot of the argument in OJ’s murder case were about the compentence of the criminologists collecting evidence.

At least in the US. Australian law likely differs but not in much degree…they strike me as reasonable blokes.

Muffin • October 21, 2009 10:46 AM

So they were unable to prove he did anything at all yet still sentenced him (albeit to a lighter sentence)?

That’s disturbing, actually. It’s easy to say “we know he did it, we just can’t prove it”, but if you can’t prove it, how do you actually know you know?

David • October 21, 2009 11:12 AM

@Muffin: They did find holes and wires, and apparently cameras, which are evidence of peeking. What they didn’t find was evidence of recording. It sounds like he got a reasonable sentence for the peeking, but would have gotten a harsher sentence for recording. It’s a matter of “we know he did A, we think he did B but we can’t prove it, we sentence him for A”.

AnonAttorney • October 21, 2009 11:24 AM

@Roy:

I’m an attorney who regularly handles encrypted evidence. When I encrypt, I often use a 36 character password generated by Password Safe. Sometimes the attorneys on the other side can’t type it in properly.

In a criminal situation, at least in the US, the defense attorney would get a copy of the hard drive. If the prosecutors can’t type it in properly, they’d likely complain to the defense attorney. The attorneys would likely fight it out and a jury would never learn about the prosecutors’ failure to properly type the password.

Roy • October 21, 2009 12:15 PM

@AnonAttorney

The defense getting a copy of the hard drive can be a scam. Simply take a hard drive, employ whole-disk encryption with a simple password, and foist that on the defense. When they try to unlock the encryption, they will fail, which of course proves that the defendant not only lied to the prosecution but he lied to his own attorney.

What the defense needs to be able to do is make their own copy of the hard drive, but the prosecution will not let them touch it. For fear, of course, that they will sabotage it. (Nudge-nudge, wink-wink.)

HJohn • October 21, 2009 12:18 PM

@Jared Lessl: “In the UK, refusal to disclose encryption passwords is a felony unto itself, up to 5 years prison time.”

I’ve had many fascinating conversations about things like this. One one hand, disclosing passwords can be seen (in the US anyway) as incriminating oneselft. On the flip side, if there is a duly processed warrant for the info, then it isn’t like they can break open a locked cabinet when the suspect refuses to unlock it.

Sometimes, these harsh sentences, like license suspension for refusing to take a breathalizer, in a way become double jeopardy. If you don’t do what we say, we’ll give you the same prison time as if you were convicted. Then again, it makes it difficult at times to investigate without cooperations. Ugh, one could go crazy.

Shreyas Zare • October 21, 2009 12:20 PM

“In the UK, refusal to disclose encryption passwords is a felony unto itself, up to 5 years prison time.”

This is why you got hidden volumes in TrueCrypt, isnt it Bruce ? 😉

HJohn • October 21, 2009 1:23 PM

@Roy: “Simply take a hard drive, employ whole-disk encryption with a simple password, and foist that on the defense. When they try to unlock the encryption, they will fail, which of course proves that the defendant not only lied to the prosecution but he lied to his own attorney.

The risk of fabrication/falsification of evidence is not a new risk. There are pretty harsh penalties for lawyers who falsify evidence, not to mention it is not as easy to do as you may think.

Jason • October 21, 2009 1:48 PM

Keep in mind the password / key is not evidence its more like the lock on your front door. Evidence would have some relevance to the case, it would be the data protected by the encryption not the key itself.

And for you US peeps, it’s also due to the fact that it is not evidence that it would not be protected by say the 5th etc etc.

So the short answer is yes they can make you give it up or you could end up like the dude in Cali that was sitting in jail for a long time till he gave it up.

David • October 21, 2009 2:26 PM

@Jason: What if I selected an incriminating password?

Heck, why (in the US) do I have to do anything that might incriminate myself? Can I be required to lead the prosecution to the place I buried the body? Do I have to tell the police exactly where in the house I hid the terrorist plans? If not, why can I be forced to tell the authorities the key to my encryption? It may not be evidence by itself, but it may lead directly to evidence of my crimes.

(Disclaimer: I have never committed any crimes, nobody saw me, and you can’t prove anything against me.)

HJohn • October 21, 2009 2:42 PM

@David: “Heck, why (in the US) do I have to do anything that might incriminate myself? Can I be required to lead the prosecution to the place I buried the body? Do I have to tell the police exactly where in the house I hid the terrorist plans? If not, why can I be forced to tell the authorities the key to my encryption? It may not be evidence by itself, but it may lead directly to evidence of my crimes.

That’s the $65,000 question. With two concerns on both sides.

The first being self-incrimination. One is not required to incriminate themselves. When an interogator asks you anything, you have the right to remain silent.

The second being with information they have a warrant for, but is encrypted. If it were locked in a safe, they can call a locksmith or they can get a warrant for your keys. If they ask you where the safe is, you don’t have to tell them. But if they have a warrant for your keys, you have to hand them over. The same can be said for files–you don’t have to tell them where your backups or CDs are hidden, but what happens when they have them and the files are encrypted? Should they be able to use your key (password) to unlock the safe (encrypted files) or not?

The question becomes, then, do we consider the password self-incrimination, or do we consider it a key? It’s an interesting paradox.

plausible deniability • October 21, 2009 4:06 PM

Who wants to bet on how the judge would have treated this if it had been a child porn case?

And who wants to bet how many of these cases will be necessary to get Australia to follow the lead of the UK?

Manxome • October 21, 2009 5:09 PM

Even if we decide that it is appropriate to compel the defendant to turn over encryption keys, exactly how are you going to compel him? You can’t seize them by force (unless they’re written down somewhere). If you threaten to do bad stuff to him if he doesn’t comply, how do you avoid punishing an innocent person who doesn’t remember (or even never knew) the key you’re looking for?

I suppose you could threaten really harsh punishment for people who refuse to divulge a key IF the prosecutor can prove that they are definitely currently capable of divulging it, but that’s probably impossible to prove in the overwhelming majority of cases. Even if you can prove that the person knew the key at some point in the past (which is probably close to simply proving them guilty of whatever the encryption hides), they could still have forgotten it since then.

Anon • October 21, 2009 5:55 PM

The danger here is that if I was to wire up a flat for playing music — Speakers in every room with a central mp3 player — and not complete the project, I’d have much the same deal of a bunch of holes and wires leading back to my room.

mark • October 21, 2009 7:27 PM

@Jared Lessl I am pretty sure this is the case in Queensland AU too

however after a quick search all I could find is this:

“power to require a person
to provide a password or decryption code that may lead to the gathering of
evidence of a serious criminal offence is a matter in the public interest and
will stop criminals from escaping prosecution merely because crucial
evidence is initially concealed electronically from police” (from http://bit.ly/1KmMUQ)

There are a few other sources were handing over passwords are mentioned, one (relating to electoral fraud) claims that “it is a reasonable excuse for the person to fail to answer the
question, or produce the document, if complying with the
requirement might tend to incriminate the person.” (from http://bit.ly/4DshuP)

I think a decent lawyer would have you sorted here.

R • October 21, 2009 7:47 PM

What is wrong with some good counter surveillance? In cases where it looks like encryption is being used, the police could simply install their own hidden camera. The situation looks like it justified a warrant for this.

This needs no new laws.

Then the police would have hard evidence and there would any of the complications arising from forcing people to hand over encryption keys or the impossibility of it.

Anonypussy • October 22, 2009 1:32 AM

“But if they have a warrant for your keys, you have to hand them over.”

Umm, no. If they have a warrant for your keys they can come in and search for them. If you hid them successfully, you are not obligated to disclose their location.

If they have a warrant for your safe, they can call all the locksmiths they want, but if your safe is made of cryptonite and they can’t get in, you are under no obligation to open it for them.

They can torture you until you give up the combination, but that’s about the limit of their authority.

Roger • October 22, 2009 6:50 AM

There is no question what the holes and cables were for; the defendant admitted that he had drilled the holes in an attempt to video his flatmates — because, he says, he feared they were plotting against him — but claims that he never completed any recordings.

Peter A. • October 22, 2009 7:54 AM

@HJohn, Anonypussy:

“But if they have a warrant for your keys, you have to hand them over.”

Ok, imagine two scenarios:

Police: “we have warrant for your safe keys”
Suspect: “I have lost my keys two days ago and I was going to call the locksmith, but had no time/money to do it yet”

P.: “Give us the encryption passphrase”
S.: “I don’t remember it – it is written down on a scrap of paper in my wallet”
P.: “It isn’t in your wallet”
S.: “Look between the AMEX and VISA cards there”
P.: “Nothing there”
S.: “SH*T I MUST HAVE LOST IT!”

What now? Is S. going to serve 5 years in UK prison?

Of course, the safe case is moot since it can always be opened by applying a sufficient (brute) force.

HJohn • October 22, 2009 8:53 AM

@Peter A. at October 22, 2009 7:54 AM

Admittedly, no analogy is perfect. The safe case would be moot, yet if the keys were in his pocket he could not deny the warrant.

That’s where it gets sticky. They have a warrant for files, but unlike a cabinet, they can’t call a locksmith or brute force it. So they try to subpoena the password. The issue then becomes is this self incrimination (telling them something that leads to his conviction), or is it simply forcing him to hand over the information (he didn’t confess or tell them where the bodies were, he just “unlocked” the cabinet).

This is a debate with great points on both sides and could keep intelligent, reasonable people debating for a long time.

Nostromo • October 22, 2009 9:28 AM

@Grande Mocha
“How can a judge compel you to produce something you don’t have?”

A judge can never compel you to produce anything. All he can make you do, is go to prison (in most developed countries).

pdf23ds • October 22, 2009 10:22 AM

“The issue then becomes is this self incrimination, or is it simply forcing him to hand over the information”

I think it’s silly and scholastic to argue about which scenario fits existing law better. The issue is really a new issue, and should be addressed by considering what’s in the best interest of society as a whole, without trying to stretch and beat analogies to safes or locks to the breaking point. Even there, though, I think there’s room for debate.

In other words, judges trying to apply existing jurisprudence to this are not going to come up with any useful framework; it should really be addressed by new legislation, one way or the other.

HJohn • October 22, 2009 10:25 AM

In regards to the threat of jail if on forgets their password, they would still have to convince a jury of 12 that they are lying about forgetting it.

If I were on a jury, I would believe someone who didn’t have the password to a file they haven’t used for a while.

On the other hand, if they had encryption set, and file modified dates indicated they had been encrypting decrypting files for months, including just days before they ‘forgot it’, a reasonable person could conclude they were lying.

Analogy: you are an investigator, and you need into a safe at a business. Only one person has the combination, and he tells you he forgot it. There is a surveillance camera, and the video is retained for 6 months. You prove he opened the safe at least once a week, every week, including the week before he “forgot” the combination, for the entire 6 months. Does anyone have a reasonable doubt that he is lying?

Forget for a moment they can call a locksmith or blow the safe open, the issue is proving the memory. Beyond all reasonable doubt, not all possible doubt. It is possible they forgot it after using it every day for 6 months, but not reasonable.

pdf23ds • October 22, 2009 10:54 AM

HJohn, a good encryption program makes sure the encrypted volume file’s metadata doesn’t get modified with access. OTOH, this only deters forensic proof of access/memory, not surveillance proof.

AnonAttorney • October 22, 2009 12:13 PM

@Roy:

Yes, the prosecution could theoretically fabricate evidence. This happens. It would be amazingly risky to do with computer evidence, however. I’m a tech attorney, and I don’t know a single attorney who would be capable of fabricating hard drive evidence that couldn’t be discovered. It’s simple in concept, but the devil is in the details.

However, I know plenty of attorneys who could figure out that a hard drive contains fabricated evidence. I know even more experts I could hire who would salivate at the chance to prove a hard drive was fabricated. They’d be like kids in a candy store.

If the prosecutor was found out, that’s the end of their professional career. The risk is just too great for the vast majority of attorneys.

HJohn • October 22, 2009 12:23 PM

@AnonAttorney: “I’m a tech attorney, and I don’t know a single attorney who would be capable of fabricating hard drive evidence that couldn’t be discovered. It’s simple in concept, but the devil is in the details.”

I agree. I’m a IT auditor (CIA and CISA) who works for an attorney. It’s difficult to do anything technical, let alone fabricate evidence to a level necessary for criminal prosecution, without leving behind the natural “polution” of IT, which is data. Sure, people can cover their tracks, they can encrypt their data, but they still leave a trail. (Similar to how paper documents can be burned, but evidence of burning them is left behind.)

Grande Mocha • October 22, 2009 1:13 PM

@AnonAttorney

So, since you are a Tech attorney, could you address my question of in the U.S. “can a defendant be compelled to provide a password he doesn’t have”? In other words, could a judge jail a defendant indefinitely for “contempt of court” if the defendant doesn’t provided a password? (Note: I am asking for the situation where the defendant really doesn’t have the password, not for the situation where the defendant is intentionally remaining silent to force a 5th amendment issue.)

Steve K • October 22, 2009 2:23 PM

(Also an attorney)

A suspect/defendant cannot be compelled to testify or give evidence against himself (US Const.) So, a court cannot order him to say where he hid the weapon (etc.)

If police have probable cause to believe evidence is in a container (e.g., a safe) they can get a warrant to open it, by force if necessary.

It is long settled law that we in the US have privacy of our mind but not privacy of our containers.

So, is the computer a container? Certainly. Is compelling the password a violation of the privacy-of-mind protection or merely the means to lawfully enter a container?

Stay tuned. There is no answer to this yet, but lots of thoughtful arguments on both sides. It will take a case that winds up on the Supremes’ docket to give us the answer.

By the way, if a judge issues a warrant compelling disclosure of the password and the defendant refuses, it is contempt. Interlocutory appeals (while the case is pending) could be attempted, but are unlikely. Contempt is a jail-punishable crime.

As for forgotten vs withheld, that’s a matter for the judge to decide. Facts vary.

Peter A. • October 22, 2009 2:41 PM

@HJohn at October 22, 2009 8:53 AM

The “keys in the pocket” is pretty the same situation as “scrap of paper in the wallet”. Both would be revealed by physical search when serving a warrant. While theoretically obliged to hand it over, a suspect would most likely try to hide/loose/destroy it if he has a chance – or lie about it. I was just asking what would it mean for him in legal terms – I am not familiar with American legal system. Would it trigger contempt of court/destruction of evidence/other charges?

I agree that encryption key problem is a new case. Before, courts looked for material evidence or took people at their word. It was considered proper to gather material evidence by force (obtaining a warrant beforehand) and NOT proper to force people to open their mouths. As I said I am not familiar with American or British legal systems – here, while a witness is first instructed by a judge that lying to the court is a crime by itself, a defendant is not; he has thus a right to lie and cannot be punished for doing just that. Even if a witness is not allowed to lie, one could quite easily get off by saying “I can’t remember” – it is quite impossible to prove he’s lying. (The latter has been seen evidently abused in some big gangs’ trials – witnesses simply beeing afraid of criminals’ revenge.)

Today, as the evidence is often getting immaterial (by the magic of information technology) and some of the information, and a crucial one, could be kept in one’s brain – it is going to be a long-standing controversy: is it a piece of “evidence” or a “testimony”?

Personally, I feel it very disturbing that one could be punished for mere silence or inaction when presented with criminal charges. The British law commented before is just a way of saying: confess and get punished or we punish you anyway even if we don’t have anything. Or otherwise: prove you’re innocent or we’ll throw you in jail.

HJohn • October 22, 2009 2:53 PM

@Peter A. at October 22, 2009 2:41 PM

I believe, as Steve K stated, that whether or not the password is considered information (and thereby protected by the right not to self incriminate) or considered a key to the container (and therefore not self incriminating) has not been determined.

It’s frustrating. On one hand, I would not like for someone to be tossed in jail for not basically confessing. That becomes a double-jeopardy type scenario. On the other hand, I am uneasy with the thought of authorities going through due process, having a warrant, having the file, but not being able to open the container. Neither side has particularly attractive consequences. I do think there needs to be dialogue and a resolution soon, so that we know definitively what our rights are.

As Steve K said, stay tuned.

Peter A. • October 22, 2009 3:10 PM

HJohn, Steve K: many thanks for your opinion.

Steve K: could you please elaborate why an appeal to a password disclosure warrant is unlikely?

If a judge were to issue a warrant compelling a defendant to hand over the weapon, the defence attorney would have turned it down in no time. It is so obvious that no judge would ever think of doing that. Why an attorney would “unlikely” try to turn down the warrant in not-so-obvious case?

AnonAttorney • October 22, 2009 4:25 PM

@Peter A.

Would it trigger contempt of court/destruction of evidence/other charges?

If you violate a court order and/or destroy evidence, you are subject to sanctions. There are different kinds of sanctions which can lead to different kinds of punishments. Some of them can rise to the level of jail time.

Whether you’ve violated a court order is often a matter for the judge to decide. So, for example, if you say you forgot the password, the judge gets to decide your credibility. If she believes you, you may not be sanctioned. If she doesn’t believe you, you may get sanctioned. The level of sanctions is often at the judge’s discretion.

I’m only familiar with destruction of evidence in civil, not criminal cases, so I don’t know what would happen in the above situation. If it were a civil case, the judge would likely either decide part of the case against you, assess a large monetary sanction against you, allow the other side to tell the jury you destroyed evidence, or tell the jury herself that you destroyed evidence (which, if that happens, the jury will hate you and likely rule against you).

Clive Robinson • October 22, 2009 4:52 PM

@ Peter A.,

“I feel it very disturbing that one could be punished for mere silence or inaction when presented with criminal charges.”

Saddly the law has a history of doing exactly this.

Further,

“The British law commented before is just a way of saying: confess and get punished or we punish you anyway even if we don’t have anything.”

It has been made abundently clear to UK polititions of all levels that this is a serious problem.

I take a collection of data encrypt it under a random key that I immediately discard. I then put the encrypted data into PGP or GPG as a raw data file and encrypt it again using your public key and send it to you.

If you use your private key to unlock the PGP encryption then you are potentialy in trouble.

You and I realise that you do not have a hope in hell of being able to decrypt the data file.

However lets find two common ways it can be likend to.

1, Opening an envolope sent to you as “junk mail”.

2, Unlocking the boot/trunk of a loan car or company car pool vehical.

Which is a judge most likley to associate the PGP decryption with?

Junk mail is almost entirely “unsolicited” and recognised as such therefor opening it shows no responsability to it’s contents. Where as having the keys to a vehical shows some level of responsability for the contents of the vehical.

If the judge goes with the former then they are likley to accept you have no responsability for the resulting encrypted data files. If however the judge goes with the second view point then you are sunk…

But that is not all, the UK authorities can because the (any) message has been sent to you. Can intern force you to not only disclose your private key but in some cases your signing key as well.

Which means that you can be impersonated by the authorites but you are not allowed to communicate this fact to anybody and nor are you allowed to change them (as this may well be regarded as communicating..).

If you think that the UK authorities are not going to “impersonate” think again the Met police amongst others have been known to send SMS’s on arrested suspects mobiles to other suspects to try to either elicit further information or to discredit the suspect.

Neither polititions or legal people in the UK understand enough about encryption to make valid judgment calls. Nor in the main do they want to, they have their own “quaint” notions of what does and does not constitute evidence and proof, which has absolutely no conceivable contact with the technical reality.

Which brings us around to,

“Or otherwise: prove you’re innocent or we’ll throw you in jail.”

You cannot prove you are innocent under normal circumstances, only that you where not there etc.

In reality the only way to prove you are innocent is to prove somebody else is “beyond reasonable doubt” guilty of the “crime” without any other person being involved.

For instance it is possible to be found guilty of murder without even any creditable circumstantial evidence let alone proof such as actuall having a body…

The law runs by rules and procedures a lot of which make no sense what so ever outside of a very narrow set of circumstances. However judges and those drafting new laws like the “comfort” of their existing “rules and procedures” and will bend logic and reason beyond breaking point to stay in their comfort zone irrespective of if it has relevance or not to a new situation.

AnotherAnon • October 23, 2009 6:40 PM

People get into all types of neat hypotheticals–but it could really go further than that.

If I have really sensitive materials, I tend to use a sentence or a short haiku as a passphrase. Now–I might be required to produce these, despite the fact that some passwords are formed as “I killed jimmy hoffa. [rest of password]”. Maybe they could compel me to produce the decrypted materials, despite the fact that part one of the passphrase is incriminating and nobody should be able to make me write such a thing in the US.

So now it gets complicated–I need to use that passphrase to decrypt my actual key–which I don’t know…I just use that to decode a hugely long password I could never remember and would have to copy/paste on a random disk…

Now, I can honestly say “I don’t know the encryption password to the file named “/home/ENCRYPTED_VM_IMAGE_5b” on my system, and have never known it.”

Even then though, the legal system will take is as an attempt to short circuit their craptastic logic and LART you anyway for the effort.

What we really need is a nice tool that creates a deniable N-K sharing scheme, wherein a minimum of N actors and a password can recover a key, but less than the minimum number, a single bad actor, or a single bad password will trash it. There’s probably literature out there somewhere…

Then I can just fill a drawer up with 100 really cheap SD cards, pick out the 5 that I know work to login, and let somebody else have fun trying the permutations. Because for whatever reason, the US legal system sees fit to to force people to provide keys to a safe, but not the combination to one with a dial.

DT • November 19, 2009 12:16 AM

Could the government argue that refusing to supply the encryption key is obstruction of justice? I have a feeling either more jurisdictions will follow the UK example of punishing those who do not supply the key and/or renewed calls for a key escrow system.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.