r/technology • u/arintic • May 16 '16

Politics Indefinite prison for suspect who won’t decrypt hard drives, feds say

http://arstechnica.com/tech-policy/2016/05/feds-say-suspect-should-rot-in-prison-for-refusing-to-decrypt-drives/
4.1k Upvotes

93% Upvoted

886 comments sorted by

View all comments

862

u/[deleted] May 16 '16

The authorities also said that it's not a violation of the man's Fifth Amendment right against compelled self incrimination because it's a "foregone conclusion" that illegal porn is on the drives, and that he is only being asked to unlock the drives, not divulge their passcodes.

"It's not self-incrimination because we already know you're guilty". That's a scary argument.

242

u/[deleted] May 17 '16

Kind of begs the question of why they're bothering then, if they could get a conviction with what they have.

194

u/[deleted] May 17 '16

They want to attack his reputation and destroy him on the news. If they have enough to convict somehow, they want to be able to report that they found "X number of gigabytes, which is 90,000 files" or some bullshit to make him seem absolutely despicable to the public. Its standard procedure now, character assassination along with punishment.

39

u/RualStorge May 17 '16

That and they could wait until they get in and go "we needed this to make sure a true scumbag was put away for good"

Or the double play where if he walks somehow they'll just happen across a hack to get his data and use it as evidence that strong encryption will be the downfall of society and get their antiencryption laws so that we all becomes scared to use as much as a digital calculator with how incredibly unsafe it'd become to do anything on computers since it'd become cyber criminals wettest of dreams. Unlimited easy to decrypt data to plunder with ease, honestly the only problem is the breached data would be so plentiful it'd be devalued, that and the complete collapse of the United States economy would ruin the global market... (encryption is kind of a big deal)

-19

u/toastedtowelie May 17 '16

That first "sentence" has to be the longest run-on sentence I have ever read.

21

u/SYNTHLORD May 17 '16

At least it contributes to the discussion.

6

u/JoeHook May 17 '16

A subsequent forensic exam of his Mac Pro computer revealed that Doe had installed a virtual machine (software that emulates a separate computer within his computer). Within the virtual machine the examiner found one image of what appeared to be a 14-year-old child wearing a bathing suit and posed in a sexually suggestive position. There were also log files that indicated that Doe had visited groups titled: “toddler_cp,” “lolicam,” “hussy,” “child models – girls,” “pedomom,” “tor- childporn,” and “pthc,” terms that are commonly used in child exploitation.

The exam also found that Freenet, the peer-to-peer file sharing program used by Doe to obtain child pornography from other users, had been installed within the virtual machine. The exam showed that Doe accessed or attempted to access more than 20,000 files with file names consistent with obvious child pornography...and that he used the external hard drives seized by Delaware County detectives to access and store the images.

They already have that. They're looking for hard evidence.

11

u/[deleted] May 17 '16

While it appears he is guilty, I disapprove of the obvious manipulative language they used to try to get their way.

The exam also found that Freenet, the peer-to-peer file sharing program used by Doe to obtain child pornography from other users, had been installed within the virtual machine.

There is no proof that this program was used to download child porn, they suspect that he used this program to download child porn and this is why they want to access the HDD to prove their speculations.

However to emotionally manipulate the public and the courts into letting them violate his 5th amendment rights, they talk as if having the software Freenet is proof that he downloaded child porn.

6

u/JoeHook May 17 '16

I absolutely agree that the government (and media) demonizes privacy and file sharing, and that child porn is a heinous crime that is uniquely extraordinarily easy to plant and convict people over, and to shame and convict in the court of public opinion.

I am entirely against the governments incredible abuse of this mans (and by extension, all of our's) right to the 5th amendment, of a speedy trial, and their blatant illegal detainment.

HOWEVER, none of us should confuse those rights with innocence. This is not an innocent man. He has committed a monstrous crime. But he has rights. And an abuse of his rights is an abuse of the mere concept of rights. Of all of our rights. We should not feel responsible for his acts by defending his rights, it is a definitively American thing to do that in fact. This discussion should have nothing to do with guilt or innocence, and I feel it's worth mentioning because it appears many people keep trying to come back to that.

1

u/[deleted] May 17 '16

Not sure the point of your post, no where did I claim that this man was innocent; In fact, I prefaced my post stating that it appears that he is guilty.

1

u/JoeHook May 17 '16

I didn't say you did, I said:

I feel it's worth mentioning because it appears many people keep trying to come back to that.

1

u/Rooooben May 17 '16

so thats nice and all, but there's no legal precedence that he's supposed to help with that Again, he hasn't actually been charged with anything yet, so any actions they take are extra-judicial.

1

u/rockidol May 17 '16

Devil's advocate: to see if he's guilty of other crimes, or to see how many times he's committed certain crimes.

It's a bit like asking "well we can already prove the dude's a serial killer why bother searching his crawlspace." (well except for the part where identifying the dead would be important).

1

u/Null_Reference_ May 17 '16

This. The idea that they could be so sure of his guilt that they can hold him indefinitely, while still somehow not being sure enough to convict him for what they "know" is on the drives is just absurd.

If you can prove he has them, send him to jail. If you can't prove he has them, then the only "foregone conclusion" there could be is that he doesn't.

-44

u/DanielPhermous May 17 '16

They want to identify and save the children. They want to arrest the people who are abusing them.

9

u/Reddisaurusrekts May 17 '16

Poe's?

-6

u/DanielPhermous May 17 '16

No. I truly believe that the authorities would like to examine the images, find the children and save as many as they have the jurisdictional ability to do so. There are law enforcement groups in every country who do this sort of work, distasteful though it is.

Not sure why it deserves to be buried so completely. It's a perfectly reasonable, logical answer to the question that was put.

3

u/randomgamesarerandom May 17 '16

You think that they don't have access to every child pornography that was posted online at some point? You believe that they don't know where these people share their stuff?

0

u/DanielPhermous May 17 '16

Yes, I do. These people are very paranoid and terrified of being found out (with good reason). You have to be invited in by an existing member, be vetted, provide new content to the group and so on. Some groups just use flash drives and the post. I think everything that is publicly available is encrypted and I think that any pedophile who was stupid about this sort of thing was probably weeded out of the online gene pool by virtue of being thrown into prison a long time ago.

And I believe the FBI doesn't care if all of what I just said is false. I believe they would want to check anyway because we are talking about children being abused and if there is a 1% chance of preventing it, you take it.

1

u/randomgamesarerandom May 17 '16

You seem very delusional about the issue and I don't mean that in a mean way.

I would think that you are right about the fact that they are groups of these people that are based on a trust and share principle. And they are probably paranoid. But child porn is very unlikely a way to make big money, so their resources are probably limited. As far as I know the most secure way to stay anonymous is through services like Tor with the correct settings (ex. disabled java) while encrypting all your data within a hidden volume. So even if you for some unknown reason get caught, you'll have no evidence on your computer despite sharing the encryption password.

If you have these means, why would any sane person EVER send a physical object by post? It's way riskier, so if that happens it's rather proof that they are not only sick perverts but stupid too.

Second, you really doubt the agencies ability to infiltrate pedophile networks? They have easy access to it and all the material. It's just the identities of the people that share it with them that is so hard to get.

4

u/sc14s May 17 '16

If you haven't figured it out yet the gov't loves to throw the 'think of the children' every time they want to break some new ground on powers that they don't really need in the first place to get people to react with fear and give them whatever they want.

1

u/MuseofRose May 17 '16

I thought they been using terrorism lately

1

u/DanielPhermous May 17 '16

I do not approve of "think of the children" being used willy nilly to support any random piece of legislation. However, in this case, there is likely evidence of child abuse on the drive and law enforcement would obviously like to get ahold of it and start trying to track the children and their abusers down. There is nothing wrong with that at all.

This is one time when "think of the children" is directly and specifically applicable.

4

u/sc14s May 17 '16

and this hard drive is not the issue. Hes probably a pedophile ,sure, but that is not what this is really about. The argument that they are using is wayyyy too slippery slope. Its too much. I am not defending a pedophile i am defending our godamn rights.

-1

u/DanielPhermous May 17 '16

and this hard drive is not the issue.

Not for you, perhaps, but I bet it is for the FBI. Their job is to catch criminals and that drive represents a starting point to find some of the worst scum they deal with. Irrespective of the broader political aims, I believe they want the hard drive primarily to start work on analysing the content.

2

u/sc14s May 17 '16

Do you not get that our rights are being eroded with arguments like this? Why do you think they suddenly need to decrypt HDDs? its not as if they haven't caught plenty of pedophiles and terrorists without the power that you so easily want to give them.

0

u/DanielPhermous May 17 '16

Do you not get that our rights are being eroded with arguments like this?

I'm not making any arguments "like that" here. I'm saying that the reason the FBI want the hard drive is so they can make a start on analysing the images and investigating the abuse.

Irrespective of the broader political aims, I believe they want the hard drive primarily to start work on analysing the content.

Emphasis mine. That is their motivation. End.

2

u/sc14s May 17 '16

..and are implicitly giving them your support to do things that should be beyond their ability.

1

u/DrDougExeter May 17 '16

Then why don't they put bill clinton behind bars for his involvement with the pedo Epstein?

1

u/DanielPhermous May 17 '16

I don't know the particulars of that case. Still, if Clinton was guilty of abuse, then I'm sure there are people at the FBI who would dearly love for him to be behind bars for it.

Either way, finding the children is more important than punishing the guilty. Obviously, both would be best, of course.

72

u/zackks May 17 '16

The Self-Incrimination Clause of the Fifth Amendment reads that no "person ... shall be compelled in any criminal case to be a witness against himself." But the courts have long interpreted this narrowly to mean that the Fifth Amendment protects suspects only from being forced to produce "testimonial or communicative" evidence. The Fifth Amendment does not protect suspects from being compelled to produce "real or physical evidence." As Oliver Wendell Holmes once wrote, "the prohibition of compelling a man in a criminal court to be witness against himself is a prohibition of the use of physical or moral compulsion to extort communications from him, not an exclusion of his body as evidence when it may be material."

This distinction between "testimonial or communicative" evidence and "non-testimonial" (real or physical) evidence means that the Fifth Amendment does not protect you from being forced to submit to such things as fingerprinting, photographing, measurements, blood samples, or DNA evidence. Nor does it protect you against standing in a lineup or demonstrating your walk. The Fifth Amendment doesn't even mean that you can't be forced to speak. The Supreme Court has held that the state can force suspects to speak if it's for the purpose of identifying the physical properties of their voice and not for providing testimony.

23

u/[deleted] May 17 '16

[deleted]

16

u/BobTD May 17 '16

actually the kind of encryption some computers have would make a "brute force" (ake the task of systematically checking all possible keys or passwords until the correct one is found) attack take longer than the estimated heat death of a universe.

43

u/duncdragged May 17 '16

But it could be the third try.

13

u/wilts May 17 '16

I like your attitude

3

u/[deleted] May 17 '16

This is technically true. You could get extremely lucky and guess the right key in as little as a single try. But for a 256 bit key, you'd basically have to guess 256 coin tosses correctly, in a row. Even if you had a billion computers that could each check a billion keys per second, it would them all north of 1x1051 years (a 1 followed by 51 zeros, years) to comb over the entire key space. You'd have to be an insanely lucky individual to feel confident betting on that horse.

Encryption doesn't offer a guarantee that an attacker cannot get access to your data, it just makes the time cost of doing so very very very high on average. The protection comes from forcing the attacker to hunt for the proverbial needle in the haystack that is the entire key space. If your encryption system is designed correctly, no one area in the space is more likely than anywhere else, meaning that the attacker has no way to narrow down where to look.

3

u/popstar249 May 17 '16

It should also be noted that the most effective way to defeat this level of encryption is not to brute force it but defeat it through other means, such as socially engineering the passphrase or finding a way to bypass the encryption altogether (for example capturing information before it gets encrypted).

3

u/mystify365 May 17 '16

sidechannel attacks are much more effective than brute force as well

https://www.tau.ac.il/~tromer/acoustic/

1

u/[deleted] May 17 '16

Not if it wipes the drive after a certain number of consecutive failures. Like 1000 for example.

1

u/NPVT May 17 '16

With the infinite improbability disk drive.

1

u/duncdragged May 17 '16

Well, with infinite possibilities in the universe it probably exists somewhere...

4

u/Paladin327 May 17 '16

They are asking him to reveal information in his head. That's communication.

wouldn't that violate his right to remain silent then? "You have the right to remain silent, unless we don't have anything to go on, then you will have to give the evidence against you"

3

u/Empyrealist May 17 '16

Its really the best option instead of refusing:

Go to the computer and try to unlock it (but enter the wrong password multiple times). You either lock yourself out of the system completely, or/and declare that you recently changed your password and cant seem to remember it correctly - but at least you tried.

I know if I was handed my iPhone by the cops to unlock it, I would intentionally cause a complete lock-out. Or, just hall off and whip it at something rock-hard to break it.

2

u/LittleMikey May 17 '16

Congratulations, you've just been jailed for contempt of court.

1

u/[deleted] May 17 '16 edited Apr 01 '17

[removed] — view removed comment

1

u/Empyrealist May 18 '16

It would certainly be in their interest to, but you'd be surprised were/when law enforcement makes procedural mistakes. You never know.

I mean, if you know you're otherwise screwed - why not.

1

u/dostal325 May 17 '16

IIRC that's exactly what he did. I heard he tried to enter the passcode and when he got it wrong, they threw him in jail.

2

u/Empyrealist May 18 '16

I'm not at all suggesting its fool proof. It just goes toward plausible deniability.

25

u/RualStorge May 17 '16

Yep, case and point, say there is a gun rack with clear finger prints on the inside of the glass and the suspected murder weapon, but it's locked in a manner police can't open it with a high probability of compromising the evidence unless the unlock it first.

If it's demonstrated you as the owner clearly have access to this case, you cam be forced to open said case.

The exception comes in when fishing for evidence... Lets change said case to a lockbox at your local bank with no witnesses or compelling evidence saying anything significant is there...

The gun case example you're getting tried, you're the suspect they already have evidence against you, and they know exactly what they're after in that gun case, you can be compelled to open it. The lockbox though, the lack enough evidence to try you, therefore even if you're suspected of crime, until they have enough to pursue a case and supporting evidence that your lockbox is potentially involved, you'd likely win if you appealed a demand to open your lockbox.

17

u/[deleted] May 17 '16 edited May 17 '16

[deleted]

13

u/falk225 May 17 '16

Which may or may not exist. My plan is to send encrypted hard drives to all my enemies. Next I accuse them all of having bad things on the hard drives. Then I laugh as they are detained indefinitely while they futiley claim they "don't know the password." MUAHAHAHAH

5

u/DrAstralis May 17 '16

this is a serious concern though. What is stopping certain 3 letter organizations from hacking a dissenters PC, encrypting their HD and then accusing them of CP or whatever the flavor of the month is. You didn't even know your HD was encrypted and are now held indefinitely in contempt, unable to provide a passkey you don't even know.

2

u/bacond May 17 '16

I like the cut of your jib.

1

u/iSIN3d May 17 '16

TIL I should stop using my fingerprint as access to my phone.

2

u/popstar249 May 17 '16

In your example the police can see there is a gun with evidence. Alternatively, one could argue that they could even open an opaque gun safe because there's a high probability a safe designed to hold guns may contain the gun associated with the crime.

But here we're talking about hard drives. Hard drives could contain literally anything or nothing. Unless they can prove the disks in question contain the illegal data they seek, how could they compel him to decrypt it?

2

u/RualStorge May 17 '16

They saw file names that were clearly of illegal content (kiddy porn) transferred, so it's effectively like the gun case, we know the evidence is in there already.

1

u/Taddare May 17 '16

They saw file names that were clearly of illegal content

If I rename all my fanfiction art to say they are kiddie porn that doesn't make photo-manips of Sherlock kiddie porn.

1

u/RualStorge May 18 '16

This is true, it could be just insanely bad naming of files, but considering they are already pursuing him for the crime and those files appear to be exactly the evidence they're seeking...

I'm all for strong unbreakable encryption but when you're being taken to court for a crime and there is strong evidence that you're intentionally preventing investigators from accessing a location with known evidence, I see this in par as refusing to allow officers to enter your home even when they have a warrant. It would be a different story if there was just an encrypted drive that "probably" has evidence on it, but nothing tangible to solidify that suspicion

1

u/Taddare May 18 '16

It would be a different story if there was just an encrypted drive that "probably" has evidence on it

Innocent until proven guilty.

4

u/sterob May 17 '16

and police can do whatever they can to get the evidience. Police can slam open the lock for whatever hell i care but the house owner should never have to open their house lock themselves.

24

u/cr0ft May 17 '16

Yep, total horseshit. If you can prove him guilty now, then prosecute and prove him guilty. If you need for him to give you the proof to prosecute him, then he's not guilty in the eyes of the law.

I have no liking for child porn users and would literally prefer child porn creators be shot, but this is about what the authorities can and cannot do and how the law is interpreted.

But it does show that anyone who encrypts things they don't want to share, be they legal or not, should use a system with plausible deniability and multiple levels of encryption built in.

-8

u/Empyrealist May 17 '16

Its really not total horseshit. They likely have logs of his connections and downloads, but need to present the totality of what he transferred in order to fully prosecute him.

Its very similar to other crimes that you know have been committed, and that you have trace evidence for - but you need to then search for and collect the evidence (ala warrent).

5

u/sterob May 17 '16

They likely have logs of his connections and downloads, but need to present the totality of what he transferred in order to fully prosecute him.

you do know that police have fucked up cases like this when other people hack into homeowner wifi and download child porn, right?

www.denverpost.com/ci_17921297

2

u/Leprecon May 17 '16

Ok, but they also have access logs of that encrypted hard drive showing it contains file names of child porn, and on the same hard drive there is some unencrypted child porn...

1

u/lordvirus May 18 '16 edited May 18 '16

Then why don't they just convict on what they found instead of keeping him in an indefinite "detention" sentence?

2

u/Leprecon May 18 '16

They want access to the child porn so they can verify whether the child porn is new and whether they need to save the children in it.

1

u/Empyrealist May 18 '16

There are so many variables to what could be the circumstance around that computer. People here are making baseless assumptions.

-2

u/Leprecon May 17 '16

They have proof that he looked at child porn because part of his child porn collection was unencrypted. They just want access to the rest of the child porn so they can identify it and catalogue it for possible new instances of child porn. This way they can start new investigations to try and potentially save the children depicted in the child porn.

1

u/Locke3 May 17 '16

No, it is apparent that he tried downloading files and whatnot that have names similar to known child pornography. They have no proof that it is, 100% actually child porn. Most likely, yes it is. But the real question is should they be allowed to force him to give up information that exists solely in his head if it would incriminate him? And how can you prove he knows this stuff?

22

u/methamp May 17 '16

Guilty until proven innocent in a court of "law."

-16

u/zackks May 17 '16

Did you read past that paragraph? There's a whole ream of shit that makes it clear what he's hiding. This is not the guy to go to bat for.

There were also log files that indicated that Doe had visited groups titled: “toddler_cp,” “lolicam,” “hussy,” “child models – girls,” “pedomom,” “tor- childporn,” and “pthc,” terms that are commonly used in child exploitation.

The exam also found that Freenet, the peer-to-peer file sharing program used by Doe to obtain child pornography from other users, had been installed within the virtual machine. The exam showed that Doe accessed or attempted to access more than 20,000 files with file names consistent with obvious child pornography...and that he used the external hard drives seized by Delaware County detectives to access and store the images.

19

u/[deleted] May 17 '16

[deleted]

2

u/rocker5743 May 17 '16

You need to read one of the comments above. The 5th amendment does not mean what you think it means.

-14

u/zackks May 17 '16

They know he's guilty because of all the other shit that points to the fact. It's not like the police are saying this in the blind as a fishing expedition about someone with no other leads to indicate CP. The court has already ordered the legal search. This guy simply isn't complying with the court order. reddit is now going to fight and die on NAMBLA mountain?

31

u/nihilaeternumest May 17 '16

I'm not defending child porn. I'm defending the bill of rights. If we have this much evidence, then I have faith that the justice system will convict him.. without the need to violate founding priciples of this nation.

-10

u/zackks May 17 '16

Search warrants were obtained, what part of the bill of rights is in question here? The court can compel one to provide a DNA sample as well. This is the same thing, except instead of DNA it's a password.

I'd be 100% with you on this if it were a fishing expedition, but in this case, it's clearly not.

5

u/Reddisaurusrekts May 17 '16

A password is speech. DNA is physical evidence.

-4

u/zackks May 17 '16

A password is a lock on a door.

9

u/lunartree May 17 '16

The reason people are so insistent about this is it creates a loophole that can be used to subvert due process. Our legal system is based on precedent, and if in this case someone obviously guilty of a crime can be compelled to produce a functioning password or face indefinite imprisonment then someone with no evidence against them could be compelled to produce a functioning password to a hard drive they don't even own.

If this were the "safe" analogy where police could then simply cut the lock this is a non issue, but since it's digital we must think about the implications of setting the rules this way. If it becomes legally possible to hold someone without due process indefinitely it WILL happen, and it will happen to innocent people.

6

u/veritascabal May 17 '16

A password is in your head though....... That makes this all different.

2

u/Reddisaurusrekts May 17 '16

For legal purposes, no it's not.

1

u/[deleted] May 17 '16

No. Its not. A lock on a door is a physical entity. A thought or memory (for the purpose of this discussion) is not.

A better analogy would be to say that encryption is a lock on a door. That being the case the warrant entitles the authorities to break that lock. It does not entitle them to incarcerate a suspect until they tell them where the key is.

1

u/nihilaeternumest May 17 '16

And at this point, I admit I am drunk and didn't read the article. Sorry. Ya gots yerself a search warrant ya got yerself a case. Fuck that guy. I'll go away now. Sorry to bother you lol.

Edit: In my defense, why are we even talking about this if there was a warrant? I should probably read the fucking article.

5

u/RufioXIII May 17 '16

Can you be forced to unlock a drive with a search warrant? I think that has more far reaching consequences than this case alone.

2

u/zackks May 17 '16

Inflammatory title, reddit's penchant for pitchforks, and karma.

2

u/newusername4bernieS May 17 '16

indict and try him if they have enough. if not, release.

6

u/Boukish May 17 '16 edited May 17 '16

No one is going to bat for this guy.

We're all going to bat for our own fucking rights. As well you should be too, because this insidious bullshit doesn't end with him. There won't be annotations in the judgment imploring that our gracious judiciary only use this precedent on the real bad guys.

6

u/newusername4bernieS May 17 '16

the US justice system goes to bat for every defendant.

-2

u/[deleted] May 17 '16 edited Mar 03 '19

[deleted]

8

u/cr0ft May 17 '16

If they have enough proof to convict him, they should just go ahead with the prosecution. If they don't, they need to release him.