PDA

View Full Version : Password case reframes Fifth Amendment rights in context of digital world



Teh One Who Knocks
01-04-2012, 04:24 PM
By John Ingold - The Denver Post


Beyond the log-in screen of Ramona Fricosu's laptop computer lies what federal prosecutors say could be the key evidence in the bank-fraud case against her.

There's only one problem: Prosecutors don't know her password.

Thus, in an extraordinarily rare move, prosecutors in Denver are seeking a court order forcing Fricosu to unlock the computer so that they can obtain files they would use to try to convict her and her ex-husband.

Civil-liberties groups nationwide have taken notice, saying the case tests the strength of rights against self-incrimination in a digital world. Prosecutors, meanwhile, say that allowing criminal defendants to beat search warrants simply by encrypting their computers would make it impossible to obtain evidence in an age when clues are more likely held within a hard drive than a file cabinet.

Lawyers for the government and Fricosu argued the issue for a third time in the past six months Tuesday. U.S. District Judge Robert Blackburn is expected to issue a ruling on the matter soon.

"If the government wins in this case, and they are able to force her to decrypt the laptop ... it's the erosion of the Fifth Amendment," said Hanni Fakhoury, an attorney for the Electronic Frontier Foundation, which filed a brief in support of Fricosu. "It's seeing the Fifth Amendment not keeping up with advances in technology."

Prosecutors predict a different kind of doom if they lose.

"Failing to compel Ms. Fricosu," Assistant U.S. Attorney Patricia Davies wrote in a court filing, "amounts to a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) that encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers ... and thus make their prosecution impossible."

Mortgage scam

Fricosu and Scott Whatcott were indicted in 2010 on charges of bank fraud connected to what prosecutors say was a complex mortgage scam in the Colorado Springs area that targeted people facing foreclosure. In one court filing, prosecutors said the scheme defrauded banks of more than $900,000.

The Fifth Amendment protects people from being forced to be a witness against themselves in a criminal proceeding. But its protections are not unlimited.

The debate, then, is about which pre-decided scenario this new situation fits into. Is a computer password like a key to a lockbox, as the government argues? Or is it akin to a combination to a safe, as Fricosu's attorneys say?

While the key is a physical thing and not protected by the Fifth Amendment, the Supreme Court has said, a combination — as the "expression of the contents of an individual's mind" — is.

If Blackburn treats Fricosu's password like a key, "the meaning of 'search warrant' will be stretched and the rights to privacy and against self-incrimination shrunk," Fricosu's attorney, Philip Dubois, wrote in a court filing.

Prosecutors, though, say they don't really care about the password itself. They say they will allow Fricosu to enter the password without their looking and won't use whatever inference could be made by Fricosu's ability to unlock the computer against her.

"The government seeks the strongbox's contents," Davies wrote in a case filing, "not the ability to open the strongbox for itself."

PorkChopSandwiches
01-04-2012, 04:25 PM
If they cant get around a password, they have more problems then they know :roll:

Teh One Who Knocks
01-04-2012, 04:27 PM
I'm sure they could get around it if they wanted to, but they are more than likely worried that without an order from the judge, if they have someone hack her computer, that any evidence they find on it will be inadmissible in court.

PorkChopSandwiches
01-04-2012, 04:28 PM
They dont seem to have a problem raping your cell phone of data at a traffic stop these days, dont see why this would be an issue ;)

Teh One Who Knocks
01-04-2012, 04:30 PM
Hey, at least in this case the DA's office is going about it the right way...seems rare nowadays :lol:

PorkChopSandwiches
01-04-2012, 04:31 PM
thats true

Acid Trip
01-04-2012, 04:37 PM
Whole disk encryption for the win! :mrgreen:

I've had whole disk encryption on my home PC for ages. My bank also has it on every single laptop.

Muddy
01-04-2012, 04:41 PM
My password is QWERTY.

PorkChopSandwiches
01-04-2012, 04:42 PM
mines 12345 and my atm card has no password

Muddy
01-04-2012, 04:42 PM
My phone number is 867-5309.

Teh One Who Knocks
01-04-2012, 04:43 PM
My password is QWERTY.

From the list of the top 25 worst passwords of 2011:

1. password

2. 123456

3.12345678

4. qwerty

5. abc123

6. monkey

7. 1234567

8. letmein

9. trustno1

10. dragon

11. baseball

12. 111111

13. iloveyou

14. master

15. sunshine

16. ashley

17. bailey

18. passwOrd

19. shadow

20. 123123

21. 654321

22. superman

23. qazwsx

24. michael

25. football

http://finance.yahoo.com/news/25-worst-passwords-2011-revealed-202955980.html

Muddy
01-04-2012, 04:45 PM
I'll be honest and say when all the password stuff started I actually used qwerty on a few sites.. :d

Loser
01-04-2012, 05:05 PM
It's a known fact that the FBI can't crack AES 256bit encryption. They've unsuccessfully been trying to crack that encryption, used by truecrypt, for years now.

FBD
01-04-2012, 05:53 PM
:lol: what a concept! "forcing her to reveal her password" IS making her incriminate herself. explicitly forbidden by the constitution. if they want to seize the shit and try and crack it, that's different.

DemonGeminiX
01-04-2012, 10:44 PM
My phone number is 867-5309.

:hand:

You're no Jenny. You don't even have any sweater puppies.

:no:

Muddy
01-04-2012, 11:35 PM
:hand:

You're no Jenny. You don't even have any sweater puppies.

:no:
Obviously you havent paid attention to my user title.. :lol:

Goofy
01-04-2012, 11:37 PM
From the list of the top 25 worst passwords of 2011:

1. password

2. 123456

3.12345678

4. qwerty

5. abc123

6. monkey

7. 1234567

8. letmein

9. trustno1

10. dragon

11. baseball

12. 111111

13. iloveyou

14. master

15. sunshine

16. ashley

17. bailey

18. passwOrd

19. shadow

20. 123123

21. 654321

22. superman

23. qazwsx

24. michael

25. football

http://finance.yahoo.com/news/25-worst-passwords-2011-revealed-202955980.html

My shitty one for random site reg's isn't on the list :sad2: I always knew 'password1' was a solid password :face:

DemonGeminiX
01-05-2012, 12:57 AM
Obviously you havent paid attention to my user title.. :lol:

:hand:

I don't consider moobs to be in the same league as sweater puppies.

Teh One Who Knocks
01-24-2012, 11:34 AM
By David Kravets - Wired


A judge on Monday ordered a Colorado woman to decrypt her laptop computer so prosecutors can use the files against her in a criminal case.

The defendant, accused of bank fraud, had unsuccessfully argued that being forced to do so violates the Fifth Amendment’s protection against compelled self-incrimination.

“I conclude that the Fifth Amendment is not implicated by requiring production of the unencrypted contents of the Toshiba Satellite M305 laptop computer,” Colorado U.S. District Judge Robert Blackburn ruled Monday.

The authorities seized the laptop from defendant Ramona Fricosu in 2010 with a court warrant while investigating financial fraud.

The case is being closely watched by civil rights groups, as the issue has never been squarely weighed in on by the Supreme Court.

Full disk encryption is an option built into the latest flavors of Windows, Mac OS and Linux, and well-designed encryption protocols used with a long passphrase can take decades to break, even with massive computing power.

The government had argued that there was no Fifth Amendment breach, and that it might “require significant resources and may harm the subject computer” if the authorities tried to crack the encryption.

Assistant U.S. Attorney Patricia Davies said in a court filing (.pdf) that if Judge Blackburn did not rule against the woman, that would amount to “a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) that encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers to obtain such evidence through judicially authorized search warrants, and thus make their prosecution impossible.”

A factually similar dispute involving child pornography ended with a Vermont federal judge ordering the defendant to decrypt the hard drive of his laptop. While that case never reached the Supreme Court, it differed from the Fricosu matter because U.S. border agents already knew there was child porn on the computer because they saw it while the computer was running during a 2006 routine stop along the Canadian border.

The judge in the Colorado case said there was plenty of evidence — a jailhouse recording of the defendant — that the laptop might contain information the authorities were seeking.

The judge ordered Fricosu to surrender an unencrypted hard drive by Feb. 21. The judge added that the government is precluded “from using Ms. Fricosu’s act of production of the unencrypted hard drive against her in any prosecution.”

Loser
01-24-2012, 02:03 PM
Should have used truecrypt ;)

Teh One Who Knocks
01-24-2012, 02:18 PM
If they order you to enter the password to decrypt the files, it doesn't matter what you used to protect your files.

Loser
01-24-2012, 02:30 PM
Nah, truecrypt has hidden file systems. Meaning, you would create an empty encrypted partition on your hard drive, and in that space create another hidden encrypted file system. So you have two keys, and two encrypted file systems.

If you give them the pass to the first, it just shows up an empty encrypted area, while your real encrypted files stays hidden.

Plausible deniability.

Teh One Who Knocks
01-24-2012, 02:47 PM
You think the Feds don't know all the tricks of the software? Just because they can't crack it doesn't mean they don't know the ins and outs of it ;)

Acid Trip
01-24-2012, 03:00 PM
You think the Feds don't know all the tricks of the software? Just because they can't crack it doesn't mean they don't know the ins and outs of it ;)

I think you are giving the Feds too much credit. These the same Feds who can't keep the FBI and Justice Department websites from going down on the whim of Anonymous.

Muddy
01-24-2012, 03:02 PM
If they order you to enter the password to decrypt the files, it doesn't matter what you used to protect your files.

How can they order you to asides from a gun to the head?

Loser
01-24-2012, 03:05 PM
You think the Feds don't know all the tricks of the software? Just because they can't crack it doesn't mean they don't know the ins and outs of it ;)

You're missing the point.

They have to PROVE it's there.

When you encrypt a partition, in any file manager or operating system, it shows up as "used space".

Truecrypt hides another file system inside this "used space", so it doesn't show up.

So literally, unless you know it's there, you wouldn't know, and while they could speculate this in court, they would have to prove it's there. ;)

Plausible deniability.

Loser
01-24-2012, 03:06 PM
How can they order you to asides from a gun to the head?

Hold you in contempt of court and give you time in prison.

Pony
01-24-2012, 11:58 PM
Step one = Create an encryption program that has two passwords, one to access the files and one to auto wipe/overwrite the drive.

Step two = *evil laugh*

Step three = profit

Hal-9000
01-25-2012, 12:04 AM
"The judge added that the government is precluded “from using Ms. Fricosu’s act of production of the unencrypted hard drive against her in any prosecution.”

:confused:

Loser
01-25-2012, 01:22 AM
Step one = Create an encryption program that has two passwords, one to access the files and one to auto wipe/overwrite the drive.

Step two = *evil laugh*

Step three = profit

The only program I know of that has a self destruct is made by Ironkey, it's hardware based, and it's military only.

Hal-9000
01-25-2012, 02:03 AM
The only program I know of that has a self destruct is made by Ironkey, it's hardware based, and it's military only.

all hard drives should come equipped with an external coffee bladder that gets punctured in case a quick, clean wipe is necessary :)

Teh One Who Knocks
01-25-2012, 02:07 AM
My PC case is packed with C4...just in case :)

Hal-9000
01-25-2012, 02:15 AM
Mine is packed with a few sticks of dynamite from 1978.It's sweating a little because of all the heat I imagine... I'm sure it will blow up in a contained fashion, should the need arise :)

Hal-9000
01-25-2012, 02:17 AM
"The judge added that the government is precluded “from using Ms. Fricosu’s act of production of the unencrypted hard drive against her in any prosecution.”

:confused:

This part is still bothering me...is the judge talking about the act of being forced into entering the password or is he talking about precluding the entire act of her putting in the password and what's yielded from her hard drive?