Comment by ldar15 | Hacker News Reader

Comment by ldar15 | Hacker News Reader

Parent Full thread

Detailed. But wrong. Although courts and DAs have tried to argue that a password is like a physical key, or tried to give you immunity for speaking the key, higher courts (e.g. the 5th circuit of appeals) regard giving the password as testimony - and therefor protected by the 5th.

Although passwords are new, combination locks are not. There is a lot of case law on this.

http://www.google.com/search?q=5th+amendment+combination+pas...

"In distinguishing testimonial from non-testimonial acts, the Supreme Court has compared revealing the combination to a wall safe to surrendering the key to a strongbox. The combination conveys the contents of one's mind; the key does not and is therefore not testimonial. A password, like a combination, is in the suspect's mind, and is therefore testimonial and beyond the reach of the grand jury subpoena. "

Edit: Why it matters in this case: FTA "the government seized an encrypted laptop from the home she shares with her family"

The government cannot prove that the laptop is hers. If she provides a password, and it works she has proven that the laptop is hers, and further that the contents are under her control. Therefor the act of provided the password would be testimony.

This is interesting. In all discussions on this subject, the comparison to physical keys comes up and the trivial conclusion is that passwords are not protected under the 5th amendment. If combinations to wall safes are protected by the 5th, I'd say the situation is clear cut: a password is exactly like the combination to a safe. You'd have to give up physical tokens required to login/boot a device, but not the subsequent password.

This interpretation is strengthened vastly by the fact that the EFF is arguing this case. They are not known for attempting to argue futile points.

a password is exactly like the combination to a safe

I disagree. A safe is a physical object that contains other physical objects. It can be forcefully open.

OK, maybe there are some very sophisticated safes that would act exactly like a password, not allowing to extract the objects inside without damaging them beyond recognition.

But I'd say it's the exception. Possibly helped by the safe manufacturers, the police will eventually access the contents of most safes.

This situation creates a different set of incentives. You can open your safe as soon as the judge requests it, or you can wait to be punished for refusing and the safe be opened forecefully later... that will uncover what you were hiding anyway.

Edit: I'd like to add that the punishment for not telling the password is a very, very, very bad idea. It's impossible to produce a password that you don't know. It's impossible to demonstrate that you don't know a password. It's impossible to demonstrate that a file is just a pile of random garbage instead of an encrypted one. Setting a punishment for things that are impossible to objectively know doesn't seem a good idea.

I suppose it depends on what it takes for the police to be allowed to forcefully open a safe. If the police obtains a warrant to search your premises, are they already allowed to forcefully open safes? I don't expect so, since they have only established 'probable cause' and are looking for evidence, contraband or what-have-you in general, but are not looking for anything specific of which they can reasonably suspect it is hidden in the safe.

I wouldn't expect the case law to be predicated on the fact that most safes can in fact be opened even if the combination is not supplied, specifically because, as you point out, there are safes that would destroy the evidence in such a case. The justification "meh, who cares if he gives the combination, we'll just open it forcefully and obtain the evidence anyway" doesn't hold for, probably the more important, cases.

> A safe is a physical object that contains other physical objects. It can be forcefully open.

A computer is a physical object. A hard drive contains data, physically, much like papers in a safe contain data, physically.

And it can be forcefully opened, too - it's merely a matter of magnitude of effort. Cracking a safe could take hours or days, cracking a password could take millennia. It should not be my problem that the government has locksmiths with drills on staff, but not supercomputers capable of breaking encryption.

The solution is to solve a technological problem with an analog solution -- don't know the password, and store it in behind a suitable physical barrier.

An example of this is a retail drop safe -- it can only be opened by specific people at a specific time.

At the end of the day, you need to weigh the options. If you are an attorney performing your ethical duty, you have an obligation to rot in jail while the illegal warrant is litigated.

"Detailed. But wrong...The government cannot prove that the laptop is hers."

I wrote, "the fact that a password works on a particular machine may be incriminating. This is the only line of argument that could work...it could...prove that they did have possession or knowledge of the drive." Seems like we're saying the same thing.

At issue here is likely the status of what constitutes a "Foregone Conclusion". In Fisher, the courts established that, "The existence and location of the papers are a foregone conclusion and the taxpayer adds little or nothing to the sum total of the Government's information by conceding that he in fact has the papers. Under these circumstances by enforcement of the summons 'no constitutional rights are touched. The question is not of testimony but of surrender.'"

In Boucher there's clearly not a foregone conclusion, and the motion to quash the grand jury subpoena was upheld because the password's production was "purely testimonial." Here, it might not be "purely testimonial."

Also, for what it's worth: having a password is certainly better than locking a system via biometrics. At least with a password, the law is (currently) indeterminate. Biometric locks: you're screwed.

Reply on news.ycombinator.com