Judge: Americans can be forced to decrypt their laptops

[Mirrorshades]

Judge: Americans can be forced to decrypt their laptops
by Declan McCullagh January 23, 2012 3:35 PM PST

Judge: Americans can be forced to decrypt their laptops | Privacy Inc. - CNET News

American citizens can be ordered to decrypt their PGP-scrambled hard drives for police to peruse for incriminating files, a federal judge in Colorado ruled today in what could become a precedent-setting case.

Judge Robert Blackburn ordered a Peyton, Colo., woman to decrypt the hard drive of a Toshiba laptop computer no later than February 21--or face the consequences including contempt of court.

[photo]
PGP Desktop: Even the FBI can't crack it!
(Credit: Symantec)

Blackburn, a George W. Bush appointee, ruled that the Fifth Amendment posed no barrier to his decryption order. The Fifth Amendment says that nobody may be "compelled in any criminal case to be a witness against himself," which has become known as the right to avoid self-incrimination.

"I find and conclude that the Fifth Amendment is not implicated by requiring production of the unencrypted contents of the Toshiba Satellite M305 laptop computer," Blackburn wrote in a 10-page opinion today. He said the All Writs Act, which dates back to 1789 and has been used to require telephone companies to aid in surveillance, could be invoked in forcing decryption of hard drives as well.

Ramona Fricosu, who is accused of being involved in a mortgage scam, has declined to decrypt a laptop encrypted with Symantec's PGP Desktop that the FBI found in her bedroom during a raid of a home she shared with her mother and children (and whether she's even able to do so is not yet clear).

[photo]
Caption: Colorado Springs attorney Phil Dubois, who once represented PGP creator Phil Zimmermann, now finds himself fighting the feds over encryption a second time.

"I hope to get a stay of execution of this order so we can file an appeal to the 10th Circuit Court of Appeals," Fricosu's attorney, Phil Dubois, said this afternoon. "I think it's a matter of national importance. It should not be treated as though it's just another day in Fourth Amendment litigation." (See CNET's interview last year with Dubois, who once represented PGP creator Phil Zimmermann.)

Dubois said that, in addition, his client may not be able to decrypt the laptop for any number of reasons. "If that's the case, then we'll report that fact to the court, and the law is fairly clear that people cannot be punished for failure to do things they are unable to do," he said.

Today's ruling from Blackburn sided with the U.S. Department of Justice, which argued, as CNET reported last summer, that Americans' Fifth Amendment right to remain silent doesn't apply to their encryption passphrases. Federal prosecutors, who did not immediately respond to a request for comment this afternoon, claimed in a brief that:

Public interests will be harmed absent requiring defendants to make available unencrypted contents in circumstances like these. Failing to compel Ms. Fricosu amounts to a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) that encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers to obtain such evidence through judicially authorized search warrants, and thus make their prosecution impossible.

While the U.S. Supreme Court has not confronted the topic, a handful of lower courts have.

In March 2010, a federal judge in Michigan ruled that Thomas Kirschner, facing charges of receiving child pornography, would not have to give up his password. That's "protecting his invocation of his Fifth Amendment privilege against compelled self-incrimination," the court ruled (PDF). [1]

A year earlier, a Vermont federal judge concluded that Sebastien Boucher, who a border guard claims had child porn on his Alienware laptop, did not have a Fifth Amendment right to keep the files encrypted. Boucher eventually complied and was convicted.

Prosecutors in this case have stressed that they don't actually require the passphrase itself, and today's order appears to permit Fricosu to type it in and unlock the files without anyone looking over her shoulder. They say they want only the decrypted data and are not demanding "the password to the drive, either orally or in written form."

Because this involves a Fifth Amendment claim, Colorado prosecutors took the unusual step of seeking approval from headquarters in Washington, D.C.: On May 5, Assistant Attorney General Lanny Breuer sent a letter to Colorado U.S. Attorney John Walsh saying "I hereby approve your request."

The question of whether a criminal defendant can be legally compelled to cough up his encryption passphrase remains an unsettled one, with law review articles for at least the last 15 years arguing the merits of either approach. (A U.S. Justice Department attorney wrote an article in 1996, for instance, titled "Compelled Production of Plaintext and Keys.")

Much of the discussion has been about what analogy comes closest. Prosecutors tend to view PGP passphrases as akin to someone possessing a key to a safe filled with incriminating documents. That person can, in general, be legally compelled to hand over the key. Other examples include the U.S. Supreme Court saying that defendants can be forced to provide fingerprints, blood samples, or voice recordings.

On the other hand are civil libertarians citing other Supreme Court cases that conclude Americans can't be forced to give "compelled testimonial communications" and extending the legal shield of the Fifth Amendment to encryption passphrases. Courts already have ruled that that such protection extends to the contents of a defendant's minds, the argument goes, so why shouldn't a passphrase be shielded as well?

Fricosu was born in 1974 and living in Peyton as of 2010. She was charged with bank fraud, wire fraud, and money laundering as part of an alleged attempt to use falsified court documents to illegally gain title to homes near Colorado Springs that were facing "imminent foreclosure" or whose owners were relocating outside the state. Some of the charges could yield up to 30 years in prison; she pleaded not guilty. Her husband, Scott Whatcott, was also charged.

Last updated at 4:30 p.m. PT

[1] http://docs.justia.com/cases/federal...pdf?1269990661

[photo]
Declan McCullagh
Declan McCullagh is the chief political correspondent for CNET. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.

Comments:

Declan has made reference to the case of Sebastien Boucher in his article, and reported (correctly) that Mr. Boucher was forced to give-up his password to his PGP Whole Disk encrypted laptop.

There are significant differences between this case and the Boucher case -- in the Boucher case:

1) He consented to the search of his laptop by a Customs and Border Patrol (CPB) agent

2) He admitted to ownership of the laptop

3) The CPB agent allegely observed images/videos of child pornography

4) He waived his Fifth Amendment rights.

In the present case:

1) The laptop was found in the suspect's bedroom; to the best of my knowledge she has never acknowledged ownership of it

2) She did not consent to a search, nor did she relinquish her Fifth Amendment rights

3) Finally, and perhaps most importantly, there is no immediate evidence to indicate that materials of interest may be on the encrypted drive. Unlike the Boucher case, where a government agent was said to have observed the presence of contraband, there is no evidence of any illegality -- rather, there is only the presumption of same on the part of the prosecution and the DOJ.

Essentially, the prosecution/DOJ wants to carry out a fishing expedition to see if they can come up with any incriminating evidence, and this court ruling, if upheld, would force the defendant's participation in just such an exercise.

Mirrorshades

[Rebred]

Hm...

[prime]

I'm sorry but handing over your own laptop and key is providing evidence against oneself. Don't quite understand the logic of some of these judges. It's always an erosion of some rights we currently have but won't have after rulings. Just think 200 years from now, we won't have any rights.

[WetWorks]

Originally Posted by prime

I'm sorry but handing over your own laptop and key is providing evidence against oneself. Don't quite understand the logic of some of these judges. It's always an erosion of some rights we currently have but won't have after rulings. Just think 200 years from now, we won't have any rights.

I doubt its going to take that long. maybe 1/4 of that time at best, if we're lucky.

[Replicator]

Originally Posted by prime

I'm sorry but handing over your own laptop and key is providing evidence against oneself. Don't quite understand the logic of some of these judges. It's always an erosion of some rights we currently have but won't have after rulings. Just think 200 years from now, we won't have any rights.

Originally Posted by WetWorks

I doubt its going to take that long. maybe 1/4 of that time at best, if we're lucky.

We dont have any rights now ......any we do have can easily be overturned/overuled due to some fuckin legal appendix somewhere

[powerman]

We have absolutely no rights now. This will be nation wide soon not just Colorado

Ive got 900 pages of documents on wire taps, email account intercepts/access by DEA , cameras, thrash picups ( in other words they go thru your garbage) etc


Securnym will fight law enforcement the longest( thus the best sevice out there) but eventually has to cave in the rest will give you up in 20 seconds or less..This is why some of the good sources require securenym accounts to order

Securenym is encrypted, and they have been forced to give up accounts but will fight it tooth and nail to hold them off as long as they can

[Mirrorshades]

Originally Posted by powerman

We have absolutely no rights now. This will be nation wide soon not just Colorado

Ive got 900 pages of documents on wire taps, email account intercepts/access by DEA , cameras, thrash picups ( in other words they go thru your garbage) etc

I'd LOVE to go through that stash! Just out of curiosity, if you don't mind, how'd you get 'em? Are they from FOIA requests, court documents, etc?

Originally Posted by powerman

Securnym will fight law enforcement the longest( thus the best sevice out there) but eventually has to cave in the rest will give you up in 20 seconds or less..This is why some of the good sources require securenym accounts to order

Securenym is encrypted, and they have been forced to give up accounts but will fight it tooth and nail to hold them off as long as they can

Best thing to do is just encrypt your own stuff -- that way it doesn't matter if they are foced to give up stuff or not.

Found an excellent project: GPG4USB. Just unpack the .zip file contents onto a flash drive, run the shortcut for the Windows or Linux executable. When you run it for the first time, it will prompt you to generate a PGP key. (You can also run it from a hard drive, if you wish.)

The main interface is an editor, with a window showing PGP keys on your keyring on the right hand side. To encrypt just type your document (or paste-into the editor window) and check the boxes beside the keys you want to encrypt to. Click the Encrypt button, and the text in the editor window is replaced by the encrypted text.

I was working on a tutorial on how to use GPG; when I saw this, I abandoned the effort, as these guys have done a far better job than I did.

GPG4USB homepage: gpgusb-project - news

Documentation link: gpg4usb - Documentation

These guys have done such a good job on the interface, that I hardly think it can be improved.

Mirrorshades