Passwords tangled in Fifth Amendment

[menotu]

By John Fontana | January 10, 2012 (zdnet)

Summary: A bank fraud case in Colorado could help determine the legal protection of users who password protect data. In the case, a woman is arguing that giving up her password to unlock encrypted data stored on a laptop is a violation of her Fifth Amendment rights.

They are two tenants of multi-factor authentication.

Something you know. And something you have.

Under a legal lens, however, they are distinctly separate and now either one could influence how the Fifth Amendment, which in the U.S. protects against self-incrimination, evolves to reflect the digital world.

And in fact, either could help set legal precedence going forward as access controls evolve from passwords to secure tokens and biometrics.

The issues are woven into a nearly two-year-old bank fraud case currently being heard in U.S. District Count in Denver. In the case, prosecution likely will hinge on whether the defendant’s password is ruled to be something she knows or something she has. Federal prosecutors want the court to force the woman to unlock her computer and reveal stored documents.

Basically, if the password is a physical thing she has, than the Fifth Amendment does not protect it. But if the password is deemed to be something the defendant knows, it is protected.


Full article

[pupthai]

Something she knows are facts that might incriminate her - the password is just a key and not the facts that incriminate and it is the facts in the account (a thing) which is a thing she has been ordered to give and ordered to do so via due process. 

If my car opens only by voice command it does not make it search proof.  That account resides in the form of data on a drive and is a thing and so is the information on it.  The need of the information for the case would require a warrant already vetted by the court.  You can't rule a paper as just knowledge because the words are in ink anymore the if they are in 1's and 0's.

She has information, facts, that she knows but those facts and knowledge (the password) don't them self incriminate her - they simply allow access to an account (a thing)  which if on paper and found in her car would be allowed into evidence every time.

A password is a thing.  It is not a testimony about your thoughts, actions or your activity, what you said or did.  I think the worse question is - if the key is not provided how do you get in - water boarding?

What if the contains of the drive were video proof of the rape of a child and a witness stated they are on that drive.  I don't think you could simple say sorry that is not a thing anymore because only I know the password.  Just don't fly.  They are not on a hunting trip they have reasonable cause which is why they can order her to open it.

Don't put evidence of wrong doing on your PC.  The best way to do that is to not do wrong in the first place - like scamming mortgages.

I think they need to find a less clear case if they want to narrow the defines of the rules as this one itself is pretty wide open.

I am betting the rule is not in her favor, but like Pres. Jackson said: "The court has ruled - now lets see them enforce it"

[Wildman]

I agree, however, if "speaking" the password will incriminate her, she has protection under the fifth.   

[pupthai]

That being my point - that speaking it does not anymore incriminate then handing them a key would.  It is the contains of the drive that are evidence not the password spoken or written down that does that.  If I allow the search of my car and they have no cause I am still protected - what is found is worthless in court - even if I give them a key.  I know this based on a real case.  There was no reasonable cause to search - so even if the key was given to them (and it was) they had no right to use it or even ask for it in the first place - in this case they do have cause and a valid warrant to obtain a thing that is data on a drive.   If she speaks it and they use it and they had no cause then it is worthless in court and she is protected - with cause she is in contempt for not opening the door for a warrant.

[chilly]

In the UK pupthai they can search your body,car,home if they think you are involved in a crime and all will be admissible in court,now the lady in question,is it her personal property?and if so is it a thing.The mind boggles

[johnmart]

Call me nit-picky, but I was trying to figure out the phrase;

They are two tenants of multi-factor authentication.

This makes more sense;
They are two tenants tenets of multi-factor authentication. 

Back to the point: If the question is whether the password is something she knows, or something she has the solution is so simple.

She should just forget it! 

[pupthai]

Exactly - the more important question is what do you do about it.  Water board - jail - can you prove that they don't remember it.  I think allowing it to be requested i.e. even demanded is a clear yes with cause - but what then?  I think they would be limited as to resource that can be put to use in getting it.  Maybe a hearing that evolves the question of a persons ability to recall the password - I think if they say "I don't know"  they had better not change their story and they are OK. but "I won't" does not work for them or "you can't make" because it says they know and refuse which is contempt.

[Crow]

I say: Wait until judge decides.
If judge decides against her give a password (just any password)
If it doesn't work argue that you forgot the password and give other three
Didn't work? just say "sorry, seems I don't remember the password"  it works, Reagan proved it.

[djohnston]

In the UK pupthai they can search your body,car,home if they think you are involved in a crime and all will be admissible in court,now the lady in question,is it her personal property?and if so is it a thing.The mind boggles

Even though it's illegal under the Fourth Amendment to our Constitution, the "authorities" still do it here in the U.S., even if there is no suspicion of a crime being committed. It's called a TSA airport search. Unfortunately, it's no longer confined to just airports. The TSA recently conducted patdowns of high school students attending their senior prom.

In my wildest dreams, I couldn't make this stuff up.

[menotu]

In my wildest dreams,

Please dj lets not go there...........       (let's hope they're encrypted dreams  )

[menotu]

By David Kravets - January 23, 2012  (wired)

Judge Orders Defendant to Decrypt Laptop

A judge on Monday ordered a Colorado woman to decrypt her laptop computer so prosecutors can use the files against her in a criminal case.

The defendant, accused of bank fraud, had unsuccessfully argued that being forced to do so violates the Fifth Amendment’s protection against compelled self-incrimination.

“I conclude that the Fifth Amendment is not implicated by requiring production of the unencrypted contents of the Toshiba Satellite M305 laptop computer,” Colorado U.S. District Judge Robert Blackburn . - ruled Monday - pdf

The authorities seized the laptop from defendant Ramona Fricosu in 2010 with a court warrant while investigating financial fraud.

The case is being closely watched (.pdf) by civil rights groups, as the issue has never been squarely weighed in on by the Supreme Court.

Full disk encryption is an option built into the latest flavors of Windows, Mac OS and Linux, and well-designed encryption protocols used with a long passphrase can take decades to break, even with massive computing power.

The government had argued that there was no Fifth Amendment breach, and that it might “require significant resources and may harm the subject computer” if the authorities tried to crack the encryption.

Assistant U.S. Attorney Patricia Davies said in a court filing (.pdf) that if Judge Blackburn did not rule against the woman, that would amount to “a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) that encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers to obtain such evidence through judicially authorized search warrants, and thus make their prosecution impossible.”


Full article and links - pdfs

[AS]

The judge ordered Fricosu to surrender an unencrypted hard drive by Feb. 21. The judge added that the government is precluded “from using Ms. Fricosu’s act of production of the unencrypted hard drive against her in any prosecution.”

May be I'm unable to fully translate/comprehend the above statement ... Look like the hard disk content can't be used against her ...
Am I missing something ?

[NoIBnds]

The judge ordered Fricosu to surrender an unencrypted hard drive by Feb. 21. The judge added that the government is precluded “from using Ms. Fricosu’s act of production of the unencrypted hard drive against her in any prosecution.”

May be I'm unable to fully translate/comprehend the above statement ... Look like the hard disk content can't be used against her ...
Am I missing something ?

I read as they can use the contents of the drive against her, BUT have to prove those facts against her. They can NOT use the fact she unlocked the drive to prove the drives contents are hers.

[AS]

The judge ordered Fricosu to surrender an unencrypted hard drive by Feb. 21. The judge added that the government is precluded “from using Ms. Fricosu’s act of production of the unencrypted hard drive against her in any prosecution.”

May be I'm unable to fully translate/comprehend the above statement ... Look like the hard disk content can't be used against her ...
Am I missing something ?

I read as they can use the contents of the drive against her, BUT have to prove those facts against her. They can NOT use the fact she unlocked the drive to prove the drives contents are hers.

Sound meaningful!  Thank you! 

[Crow]

The judge ordered Fricosu to surrender an unencrypted hard drive by Feb. 21. The judge added that the government is precluded “from using Ms. Fricosu’s act of production of the unencrypted hard drive against her in any prosecution.”

May be I'm unable to fully translate/comprehend the above statement ... Look like the hard disk content can't be used against her ...
Am I missing something ?

I read as they can use the contents of the drive against her, BUT have to prove those facts against her. They can NOT use the fact she unlocked the drive to prove the drives contents are hers.

Sound meaningful!  Thank you! 

I'm happy the stories of my patients were less confusing