-Submitted by David Drumm (Nal), Guest Blogger
With the Fourth Amendment a mere shadow of its former self, its time to apply the same erosional process to the Fifth Amendment. The Justice Department has asked a federal judge to compel Ramona Fricosu, charged with bank fraud, wire fraud, and money laundering related to a mortgage scam, to decrypt the files on a laptop found during a raid on her home. Fricosu now faces the cruel trilemma: perjure herself by claiming she doesn’t know the passphrase, incriminate herself by decrypting the files, or face contempt of court for refusing to decrypt.
The key phrase in the Fifth Amendment is, “[no person] shall be compelled in any criminal case to be a witness against himself.”
To get around Fricosu having to reveal the contents of her mind, the Justice Department would permit Fricosu to decrypt the files via a secure link, without actually revealing the decryption passphrase.
The first opinion to directly address the issue was handed down by Magistrate Judge Jerome Niedermeier in Vermont. From In re Boucher, Judge Jerome Niedermeier wrote that entering the password is testimonial:
Entering a password into the computer implicitly communicates facts. By entering the password Boucher would be disclosing the fact that he knows the password …
Many acts of production, such as providing fingerprints, blood samples, or voice or handwriting samples, are not protected by the Fifth Amendment, even though that production could provide a link to incriminating evidence. It is undeniable that a person possesses fingerprints, blood, and a voice, so production of those items gives no evidence of a person’s thoughts. However, the decryption of the files reveals the fact that the password is known, and that reveals the contents of a person’s mind.
One document published in the University of Chicago Legal Forum in 1996 says:
Because most users protect their private keys by memorizing passwords to them and not writing them down, access to encrypted documents would almost definitely require an individual to disclose the contents of his mind. This bars the state from compelling its production. This would force law enforcement officials to grant some form of immunity to the owners of these documents to gain access to them.
Prosecutors in the Fricosu case are refusing to grant her full immunity for whatever appears in the decrypted files.
In Maness v. Meyers, Chief Justice Burger, in the majority opinion, wrote:
This Court has always broadly construed its protection to assure that an individual is not compelled to produce evidence which later may be used against him as an accused in a criminal action.
…
The protection does not merely encompass evidence which may lead to criminal conviction, but includes information which would furnish a link in the chain of evidence that could lead to prosecution, as well as evidence which an individual reasonably believes could be used against him in a criminal prosecution.
H/T: Fourth Amendment.com, cnet News, Orin Kerr.
ARE,
That may very well be true…but if they can’t find the diary’s….what can be proven….
Peoples diaries have NOT been protected under the law. So I doubt that this will be any different.
Nal,
Great post. It seems to me to violate the Fifth, but would make mostyou lawyers are better equipped to wrangle that out. For a great view of where we are heading cyberwise in Law Enforcement check out Charles Stross’ new novel “Rule 34”. It’s a Sci-Fi mystery set about 20 years from now. Stross who is a certified geek, projects a law enforcement future that would seem to make the right against self-incrimination moot by its’ irrelevance.
I’ve often wondered when a case similar to this would appear. Clinton’s administration tried to force the Clipper encryption/decryption scheme as the only legal method in which the government would keep all the public keys in escrow and it would be illegal for any business or individual to use any other encryption mechanism.
Clipper was essentially triple-DES and is easily brute forced today. It was cracked in the mid-nineties by some students at UC Berkeley with a network of some 500 PCs in under ten hours. There are now known flaws, that along with published rainbow tables, allow one to crack in within hours on a modern PC.
AES is about the best mechanism available today, though flaws in how the algorithm uses it’s hashing tables have been found (specifically AES-256, not AES-128). But even with these flaws it would still take an astronomical amount of time to brute force AES.
I encrypt everything on my PCs, in case they are stolen. I don’t keep extremely sensitive information on any of them as a rule, but even given this there is data there that I don’t want casual access to.
It will be interesting to see if Ramona Fricosu will be compelled to decrypt the files in question.
ARE,
I think that there are major differences between the contents of a safe and a password on a computer hard-drive. One can be opened without destruction of the evidence….the other requires the person to actively enable the assistance to telling the government where, what and when some act was performed legal or not. I think that this steps over the line of the line of collection of DNA and the contents of a safe.
What was the name of the cyborg cop that convicted you of pre-anticipated crimes?
Capt. Erb, I think you are missing the point. It is her laptop, found in her home when her home was raided. She has her files encrypted and the authorities want to force her to reveal her password. She is resisting. If it were a lockbox with a physical key, she can be compelled to produce the key. This key, however, exists only in her mind. If she is forced to reveal it, the question gets into both Fourth and Fifth Amendment issues.
Some of the stronger encryption techniques are virtually unbreakable. One encryption technique I read about recently could resist a brute force attack by a supercomputer for 1×10^51 years. That exceeds the age of the universe. That is the one used by WikiLeaks for that “insurance file” document dump.
Sorry, but I do not see any justification for not revealing the password. If there were some question as to WHO owned the computer, THEN it would be a valid point since you would be forcing a person to not only own up to the ownership of a major piece of evidence, but then acknowledging ownership of the contents. This is no different from demanding that a suspect open a locked door or safe in their home with a valid search warrant. Now you might fight the search warrant, and THAT would provide 5th amendment protection too. The main reason for the 5th amendment is to functionally discourage the use of torture to obtain evidence. If there is a serious question as to whose computer that is, THEN I would be against forcing a person to say what the password is because there is a GOOD chance that they do NOT know it. Thus the only way to get it is to use force or torture to try and get something that the person has no knowldge of.
Frank, the idea is that production of a physical object does not require you to disclosethe contents of your mind, while production of something you know does.
Under normal circumstances, I’d say stick to your 4th Amendment rights and let the stick fall where they may, but given the rather “interesting” take our current Supreme Court has demonstrated regarding the Constitution, it might not make any difference.
If you have paper documents “somewhere” that the Government wants to read, do they have the right to coerce you to produce them? Or say where “somewhere” is?
Oh, culheath… Now they’ll be checking our wallets…
Take out your sim card and put it in your wallet before going through the line. Works for me.
And……..you know how much maggie uses cell phones:) Well i used it a few time to call frank to ask wtf??? LOL Im a funni old lady! by the way did i tell you all once i woke up to 2 huge otters in my swimming pool in a fenced back yard! and they slid out made themselves like a sheet of paper! I have to say this ,,,sometimes u cant slide out of a mess like those otters did!
Otteray & eniobob,
I keep a cellphone mainly for emergency purposes when I travel. I rarely use it. I don’t send text messages or take pictures with it. maybe you could call me Lud-lite.
eniobob, some might think we are Luddites, but nothing could be further from the truth. I just want to keep the risk of security breaches to a minimum because of my work.
The other thing I have noticed about the so-called smart phones. The people I know who have them seem to waste far too much time fiddling with them. The guy at the phone store tried to convince me that possessing a smart phone makes one more productive. I just laughed at him.
OS:
“My cell phone has one function. I can make and receive calls. I do not have a voicemail set up and I do not send or receive text messages.”
I am also a member of that club.
I know you can’t trust the moronic sludge spewed by the media but one thing I heard in relation to this story makes me wonder if it is true – can one of the lawyers comment?
The courts have ruled that you have to provide a key to a safe if there is one but you don’t have to provide a combination. !?!
I would tend to view an encryption key as a combination not a key (caveat, I am an IT security engineer) but am confuse why the 4th would see any difference.
Did you know they can suck stuff off your laptop and cell phone at airports in just a matter of seconds? I recall reading an account of some political activist who was traveling out of the country. When he was going through the TSA checkpoint, they noticed he did not put his cell phone in the basket. The TSA inspector asked him where his cell phone was. He told them he had left it at home, that he did not need it while traveling and if he needed one at his destination he would get one there. He described the TSA people as being very upset with him for not having his cell phone.
My cell phone has one function. I can make and receive calls. I do not have a voicemail set up and I do not send or receive text messages. I do not have photographs on it either. They guy at the phone store has been trying to get me to buy a smart phone, but my view of smart phones is they are an accident waiting for a place to happen.
I will be waiting to see what happens in the Ramona Fricosu case. I can see this one as probably headed to the SCOTUS.
Good point, good argument Nal. Perhaps there needs to be an interlocutory appeal or a petition for a writ of mandamus … should the court go into contempt citation mode.
Oh this is a tricky one…..this is stuff that they could get to if only they could get to it…seems like just a regular DNA analogy….but the fact is…they can’t get to it by hacking, stacking or backing….some software has a autodeletion after 5 or 6 failed attempts…..
But they can’t get to it without her password….I wonder if they would give her FULL transactional and use immunity….if supplied….but then if they are going after her…would the case hold any water…..
They have to get into her mind….clearly the 5th says otherwise….Great piece nal…..I have been following this for a while….