Hacker News Reader

Comment by runningdogx | Hacker News Reader

What if your passphrase to your truecrypt container (let's say it contains, for the purpose of this thought experiment, child pornography) is the true statement: "I am [for this thought experiment] a child pornography collector."

Wouldn't it be a violation of the 5th amendment to be compelled to provide that passphrase, because it is an admission against interest and therefore would be admissible if you disclosed it? Wouldn't it also serve to waive 5th amendment privilege, and possibly put you at risk of being forced to take the stand?

If it were an admission of a different crime, a court could grant you immunity on those unrelated charges, but if it is relevant to the crime the government is investigating by asking you to reveal your passphrase... how can anyone, luddite judge or not, separate "key" from "testimony" in that circumstance?

View on HN

Philosophically it's not a problem:

http://en.wikipedia.org/wiki/Use%E2%80%93mention_distinction

In the context of testimony, I'd argue (as a philosopher, not a lawyer) that a mention does not count as testimony and cannot be used against you. Obviously, an observation of the mention could lead the police to consider other avenues of investigation however.

The 5th amendment doesn't mean you can block normal legal proceedings just because they would happen to incriminate you.

You do have the right to remain silent, however. That might be a stronger defense.

That only means you don't have to say anything to the police while you are in custody but have not yet been charged with a crime, and your lawyer is not present. It's not meant as a blanket protection against having to give testimony.

It is blanket protection from testifying during any phase except if you've been given immunity. Then your testimony cannot be used against you and you can be compelled to testify.

http://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_S...

"If the government gives an individual immunity, then that individual may be compelled to testify. Immunity may be "transactional immunity" or "use immunity"; in the former, the witness is immune from prosecution for offenses related to the testimony; in the latter, the witness may be prosecuted, but his testimony may not be used against him. In Kastigar v. United States, 406 U.S. 441 (1972), the Supreme Court held that the government need only grant use immunity to compel testimony. The use immunity, however, must extend not only to the testimony made by the witness, but also to all evidence derived therefrom. This scenario most commonly arises in cases related to organized crime."

Yes, it is in fact a blanket protection against having to give testimony.

Providing a password is not testimony. You're not testifying to anything.

My understanding is that whether or not providing a password is or is not testimony is not clearly defined.

There have in fact been a few instances where judges have determined that providing a password does constitute giving testimony.

http://www.easterndistrictblog.com/?p=57

and older

http://mises.org/Community/blogs/crypto/archive/2007/12/18/c...

"Providing a password is not testimony. You're not testifying to anything."

Where did you put your ex-wife's body Mr Johnson, we know you killed her? Just point at the map, you do not even have to say anything.

More like: "Give us the keys to this safe." and assuming they have a warrant, they can ask for such things.

You also are missing the point of TrueCrypt: Plausible Dependability and multiple passwords for different content. It'd be like "Give us the key to this safe that unlocks the incriminating evidence, even though we have absolutely no way of knowing if you're hiding more or giving us the full truth".

You could have cat pictures encrypted with passphrase A and incriminating evidence (that stands up to the best forensic analysis currently available) encrypted with passphrase B and they wouldn't know which is which, if they unlocked ALL the data, or what.

Truecrypt is AMAZING and anyone holding onto stuff that might get them into trouble (esp. w/ foreign gov'ts) should use it.

Then what is it?

Providing access to subpoenaed evidence.

The evidence is what it is, the court is there to judge it.

Compliance doesn't require that you provide them with the passphrase. It simply requires that you provide access to the material. Typing your password into the computer to let them copy the material would suffice.

What if you pass phrase was "I have child porn on my hard-drive", then could you plead the fifth?

You could try. The judge could also demand that you provide your lawyer with the pass phrase and that the lawyer then enter that pass phrase when required to by the digital forensics team in such a way that does not reveal the password to the forensics team. The judge also has the authority to strike things from the record and could simple demand that you provide the pass phrase and that any mention of the actual pass phrase not be used in court and that any such usage will not be a part of the trial records. Either way, the 5th is a weak shield to try to hide behind in this case.

Wouldn't it be the same if you had child porn in your house?

I don't see how providing a passphrase is an admission of anything. You're not stating a fact, you're just providing the passphrase, which could be anything (true or false).

5th amendment is the right against self-incrimination. The response could provide self-incriminating evidence of an illegal act punishable by fines, penalties or forfeiture. Giving a password to your encrypted database could easily be interpreted as testifying against yourself as defined in the 5th amendment.

Relevant: http://www.youtube.com/watch?v=i8z7NC5sgik#at=950

You're admitting you have a passphrase, and therefore that you have access to the information it protects. This piece of information is non-trivial, as it eliminates one avenue of plausible deniability, and actions that implicitly provide this information are recognized as testimonial in nature.

Reply on news.ycombinator.com