Passwords tangled in Fifth Amendment

[menotu]

By David Kravets -  February 6, 2012  (wired)

Defendant Ordered to Decrypt Laptop May Have Forgotten Password

A Colorado woman ordered to decrypt her laptop so prosecutors may use the files against her in a criminal case might have forgotten the password, the defendant’s attorney said Monday.

The authorities seized the Toshiba laptop from defendant Ramona Fricosu in 2010 with a court warrant while investigating alleged mortgage fraud. Ruling that the woman’s Fifth Amendment rights against compelled self-incrimination would not be breached, U.S. District Judge Robert Blackburn ordered the woman in January to decrypt the laptop.

“It’s very possible to forget passwords,” the woman’s attorney, Philip Dubois, said in a telephone interview. “It’s not clear to me she was the one who set up the encryption on this drive. I don’t know if she will be able to decrypt it.”

...........................................

And now the case is even more complicated and raises the question of what might happen if the woman does not comply with the judge’s order.

If she does not decrypt the drive by month’s end, as ordered, she could be held in contempt and jailed until she complies. If the case gets to that point, Judge Blackburn would have to make a judgement call and determine whether the woman had forgotten the code or was refusing to comply.

“The government will probably say you need to put her in jail until she breaks down and does what she is ordered to do,” Dubois said. “That will create a question of fact for the judge to resolve. If she’s unable to decrypt the disc, the court cannot hold her in contempt.”

Prosecutor Patricia Davies said in a telephone interview that the defendant has not said in any court document that she might have forgotten the password.

“She has not taken that position in court,” Davis said. “When she does, we’ll figure it out.”

Full article
http://www.wired.com/threatlevel/2012/02/forgotten-password/

[Bald Brick]

It seems she's taken Crow's advice. 

[djohnston]

Defendant Ordered to Decrypt Laptop May Have Forgotten Password

She won't have to plead the Fifth. She can rely on the Ronald Reagan defense. "I, I don't remember." 

[parnote]

Sounds like it's time for a new encryption strategy. Two passwords. One decrypts the files. The other blanks the hard drive. With either one, there is no difference with the screen display ... it just shows progress bars and a message that it is working. In the end, however, there either are files or there aren't.

I'm not at all against going after criminals who have stored information related to their illicit activity on a computer's hard drive. But what I **am** against is an expansion of those demands to inspect the hard drives of innocent computer users in a "witch-hunt" atmosphere. It's only a matter of time, IMHO.

[AS]

Sounds like it's time for a new encryption strategy. Two passwords. One decrypts the files. The other blanks the hard drive. With either one, there is no difference with the screen display ... it just shows progress bars and a message that it is working. In the end, however, there either are files or there aren't.

Technically speaking this already exists, actually a passphrase is used to access one or more decryption keys, and the key is used to decrypt the hard drive. Simply deleting the "key" (which is stored on few sectors) will make the content impossible to be decrypted, it is an instant process, so no progress bar. 

I'm not at all against going after criminals who have stored information related to their illicit activity on a computer's hard drive. But what I **am** against is an expansion of those demands to inspect the hard drives of innocent computer users in a "witch-hunt" atmosphere. It's only a matter of time, IMHO.

+1

AS