Suspects can refuse to provide phone passcodes to police, court rules
arstechnica.com
arstechnica.com
In the past, pre-computer days, if the cops couldn't break your encryption you were not compelled to tell them how and that was their problem.
Now you are compelled. I feel that that should not have changed.
However I believe the court could eventually order you to produce the Rosetta Stone, after various proceedings. At that point you have to decide whether you want to comply with the order or not, and not doing so would likely have negative consequences like being held in contempt.
https://en.wikipedia.org/wiki/Book_cipher
for example: Article I, Section 9, Clause 2: The Privilege of the Writ of Habeas Corpus shall not be suspended, unless when in Cases of Rebellion or Invasion the public Safety may require it.
But it’s quite complex, see https://scholarship.law.edu/cgi/viewcontent.cgi?referer=&htt...
For example, when I add an account on my mac - not related to apple in any way - the computer will send information back to apple. Every time. I have cloud stuff turned off.
As far as my phone - most of this stuff is not only hidden, but apple doesn't let me run software to know who it is talking to, and what is being sent.
I would like to think not, as usually you cannot be made to compell against yourself. The famous right to silence.
https://en.wikipedia.org/wiki/Right_to_silence
Which was the base of this court case (and I think it is troublesome, that it had to be debated at all)
"One of the major issues in the law of digital evidence investigations is how the Fifth Amendment privilege against self-incrimination applies to unlocking phones"
It turns out there is but it's not enumerated in the first amendment, so it's called an "implied right." It's been derived by the courts (including the Supreme Court) as logically inferred by the rights which are enumerated in the 1st amendment. What I found interesting is the boundaries of this implied right to silence are currently less well-defined than than the other 1st and 5th amendment rights. Apparently, some cases the court will be deciding this year may involve further fleshing out these fuzzy edges. I'm not an expert but as I recall, the scenarios may include things like whether social media networks can be compelled by a legislative statute to disclose (ie 'speak') their content moderation policies and whether public universities can enforce codes of conduct which may compel speech.
Personally, I'm all-in on the vital necessity of robustly expansive free speech rights, so I'm also all-in on robust freedom of silence rights. I used to think I understood the limits of free speech in the U.S. but reading this article by 1st amendment expert Ken White on free speech tropes surprised me. Highly recommended: https://www.theatlantic.com/ideas/archive/2019/08/free-speec...
https://www.scotusblog.com/case-files/cases/salinas-v-texas/
In the US, case law has ended up more protective of people who invoke their right to an attorney than those who merely invoke their right to remain silent.
In certain cases the police can restart interrogations after invocation of a right to remain silent, but if you invoke the right to an attorney any interrogation must stop until your counsel is present. These exceptions are narrow, but “being interrogated by the police” is the last place to chance stumbling into one.
The magic words are: “I will not answer any questions without a lawyer present.”
I’m not interested in lying to the police, but when I know that they can lie to me, it’s a big disincentive to say anything to them at all. This is a problem.
> "you are not legally allowed to lie to the police."
I know that lying under oath in a court is perjury and in certain contexts some investigative agencies like the FBI can put you under oath and in that specific case materially false statements can be actionable. And I know that filing a false police report is against the law but I think that usually requires signing the report and it spells out that lying on the statement is perjury.
But, in the scenario of a police officer just walking up and asking you questions on a street corner, prior to arresting or detaining you, is anything you say about anything which is later deemed to be false or misleading cause for arrest? Maybe it is but I'm trying think of what law it would be violating. I do know that civil libertarians say that if a police officer talks to you, you can ask "Am I being detained?" and if they don't answer "Yes" you are free to just walk away.
My naive prior understanding is that things are more complicated and conditional than simply "Lying to a cop anytime, anywhere is always grounds for arrest and prosecution (even absent any other grounds for arrest)" but perhaps I was misinformed on this.
State laws about lying to police vary by state. Ask your lawyer.
https://www.popehat.com/2009/09/22/today-in-shut-up-moron-te...
Note that the "lawful duties" portion is apocryphal.
It’s shameful though how many false police reports are not prosecuted because they fall in line with the perceived powers of police forces.
I'm curious. How do people get a lawyer, if they aren't exactly prepared for being questioned, but just somehow unexpectedly found themselves in some weird situation?
Somehow, I doubt most common folks already have an established lawyer (especially not knowing what sort of situation they may get into - as I get it, different lawyers specialize on different matters) and remember their phone number (OP reminds me that one probably doesn't want to unlock any phone). Or I'm wrong? What's the general approach here?
Otherwise, you’ll be arrested and taken to jail for processing. Your bail will almost always be predetermined by a bail schedule. For minor crimes you can post bail to the jail and leave within hours. Some jails even take credit cards. Search for a lawyer on your own after you are out.
Otherwise the rules are varied across jurisdictions. “You get one call” is a TV trope” - but you can use any phone calls you are granted to secure an attorney. The state bar, as mentioned, will refer you. Call your family and have them secure one. Some jails have the yellow pages for your own selection. If you have a non-criminal attorney (a will, employment law, etc.) they can give you a referral.
https://slate.com/news-and-politics/2017/10/suspect-asks-for...
And or course on a recorded interview/questioning, right? Because if there was no recording then it’s my word against police’s, right?
(I am not from US).
Upon arrest, you're not obligated to speak or answer anything.
The police are not officers of the court, nor involved in court proceedings during their interactions with the public, so there is no expectation or explicit penalty for not answering. In court, while being questioned, you're compelled, under penalty of perjury, to testify in full and truthfully unless there is a reason you can or may not:
> Do you solemnly (swear/affirm) that you will tell the truth, the whole truth, and nothing but the truth?
The 4th (unreasonable search and seizure) is generally clearer, but I don’t know how it works online “stop and ID” states. IMO those laws are unconstitutional, but I haven’t looked into it because I don’t live in one.
To be clear, not if you're the defendant.
Yes, it means explicitly saying “I invoke my 5th amendment right.” Generally, if you’re being interviewed, this is surprisingly less of an issue, because you’ve already been read your rights, and the interview will be recorded (theoretically, they can disappear sometimes).
This applies to situations BEFORE an arrest, but you may have already been detained. (The 4th amendment and court precedent has more to say about this, but it’s an aside if you aren’t subject to it.)
If it’s your word against the police, with no recording or some other overwhelming evidence, you will lose in a US court. Police body cams help a lot here, but it’s still best to record every police interaction yourself. It’s an unfortunate situation.
Nope. You need to express your desire to stay silent early in the "arrest or questioning" process with the police. I'm not an expert, so I don't want to pretend when your words can be used against you, but if a cop hears you say something, they can quote you in court.
Also, here is a fun twist. Your words can be used against you in court, but not for you. For instance: if the cop writes down a bunch of stuff you said while being arrested, and your defense lawyer wants to look at it -they are not allowed to see it-. They can only see the stuff the cops use to charge you
This is incorrect.
Withholding exculpatory evidence can get cops & prosecution into a lot of hot water.
This is called the Brady or Brady/Giglio rule.
Brady v. Maryland (373 U.S. 83 (1963)
Giglio v. United States (405 U.S. 150 (1972)
> It cannot help you. You can't talk your way out of getting arrested, and contrary to what you might suppose if you never studied the Rules of Evidence, what you tell the police - even if it's exculpatory - cannot be used to help you at trial, because it's what we call hearsay. Under the rules of evidence - specifically Rule 801(d)(2)(A), if you want to look it up - everything you tell the police, as the saying goes, can and will be used against you but it cannot be used for you.
Professor James Duane, the speaker, refers to Federal Rules of Evidence Rule 801. Definitions That Apply to This Article; Exclusions from Hearsay [1]. My layperson understanding of 801(c) and 801(d)(2)(A) is: if you are the defendant, what you told the police prior to a trial is not hearsay when during the trial the prosecution (of their own volition) tells the court your words as evidence but is hearsay when during the trial you ask the prosecution to tell the court your words as evidence.
You have a First Amendment right to record the police, whether you're involved in a police interaction or you're a bystander [2]. If the police make you stop recording, try to make you delete the recording, or try to forcefully stop/delete/damage the recording/device, you sue them after the interaction is completely over. But regardless, beyond pleading the 5th Amendment, do not talk to the police at all, especially but not exclusively outside of a trial. You talk to your defense attorney, and your attorney handles the talking with everyone else. You can ask your attorney to admit your recording as evidence.
[1] https://www.law.cornell.edu/rules/fre/rule_801
[2] https://www.eff.org/deeplinks/2020/06/you-have-first-amendme...
Extra notes for personal reference. The first speaker in the "Don't Talk to the Police" video is Professor James Joseph Duane of the Regent University School of Law [E1]. The second speaker is Officer George Bruch of the Virginia Beach Police Department (time 26:51 of the video [E2]).
Where would such a precedent leave things in terms of codes of conduct and open source?
The idea that code of conduct can’t exist is nonsense. The idea that it violates free speech is also nonsense, as it has been well settled that you don’t have free speech on private land.
I'll admit, the internet is everywhere, so every asshole is on the internet. I just remember before the Code of Conduct, there was definitely one less potential layer of assholes above, despite an ever present layer of assholes below, and there seemed to be more crazy and less conformist people.
Would write more but I need to go yell at a cloud.
Public universities are part of the (state) government, so are bound by the first amendment.
Open source projects are not part of the government, so their freedom to associate with whoever they choose (with some limitations implied by eg the 14th amendment, but nothing likely to affect currently prominent codes of conduct) is protected by the 1st amendment.
In this context, "Public University" means an institution substantially run by or funded by the U.S. government. Only some universities are public and many others are private. And different rules apply because the government is held to constitutional standards.
Conversely, "Public Domain" relates to the copyright status of a creative work and is entirely unrelated to how something is funded.
Legally, a "Code of Conduct" is basically just a contract. In the U.S. the "Freedom of Contract" and "Freedom of Association" between consenting adults are, thankfully, pretty damn expansive. If you want to create a non-government owned, run or funded project, club, cabal or coven which involves a contractual obligation requiring Taylor Swift tattoos and apple cider enemas, I'm pretty sure consenting adults can voluntarily agree to that if they chose to (although it should be noted, enforcement of such a contract will likely be limited to rejecting or expelling non-complying members).
If I sign a contract saying I'll take an apple cider enema and I don't, that doesn't automatically mean I've given permission to have one administered! That might mean I get kicked out of the contract but it doesn't mean that I can be forced to abide by the contract.
Separately, although I am not a lawyer, I have decades of business experience which often involved working closely with lawyers and my circle of friends happens to include several attorneys, prosecutors and judges, so I'd say I have an unusually broad understanding of legal matters for a non-lawyer (especially contract, IP and business law). I also just find legal stuff interesting to learn about and I'm one of those oddballs who looks forward to June because I find well-written SCOTUS rulings (and dissents!) fun to read.
Yet, I'm still surprised at the lack of even high-school civics-level knowledge of basic legal principles I come across in otherwise intelligent, well-educated professionals including doctors, MBAs, engineers, etc. It's kind of sad because the latent engineer in me finds the system architecture of the U.S. legal framework to be fascinating. Yes, it's imperfect in many ways, yet it's still a brilliant, iterative, collection of attempts to solve a 'wicked' bundle of thorny problems through successive approximation. Despite its flaws it still ends up eventually getting things pretty close to as "right" as they probably can be with remarkable frequency.
No, a public university is run by one of the 50 states.
Pedantically, I believe there are federal universities such as the army, navy and air force academies. There are also city colleges and all of these "government institutions" are funded or controlled by federal, state and/or city taxes which causes them to fall under additional constitutional restrictions.
Although it appears the matter has now been settled as of this ruling.
It seems like with a warrant they can be allowed to crack into your safe, and you may prefer to let them use the key so that you still have a working safe at the end of it.
The UK has a rather scary law where even if you do genuinely lose it they just assume you are lying.
The extension of that is you can just always say "I don't know". So the right to remain silent is basically a shortcut to avoid this issue.
> ruling issued today by Utah's state Supreme Court
It would take a US Supreme Court ruling. Apparently a few states have ruled in different directions in different circumstances.
It's settled in Utah at least.
This one seems pretty cut and dry, frankly, since they’ve asked him to provide the code, and he refused. It sounds like the prosecution erred significantly in making closing arguments about pleading the fifth being indicative of guilty. The more interesting question, which is not involved in this case, is whether a defendant can be compelled to provide unlocked devices to law enforcement.
Then is it the other legal team’s responsibility to point out that it’s bogus and refute the claim that it meant “I stole Jack’s peanuts”. Maybe by giving examples of other assumed ciphers that prove it actually decoded to “I can drink 5 beer cans in 2.5 minutes” or that it also means “Rabbits are actually slow” according to yet another assumed cipher?
How does that work? I mean I know if it’s a jury and then it can just come down to their individual and collective whims and fancy and but how does it work in general?
It would have been helpful if the Ars journalist had scored an interview with his expert source — Berkeley academic Orin Kerr — rather than simply re-reporting Kerr’s own analysis:
https://reason.com/volokh/2023/12/14/is-compelled-decryption...
The reason it's not a been a big deal is courts is because, if police have a warrant, they're going to hire their go-to safe driller to drill the safe open.
A 22-year-old man has been jailed for six months after refusing to provide passwords to his encrypted hard-drives, the Daily Mail reported. He was imprisoned under a section of RIPA, a UK law that was originally pushed as a counter-terrorism measure, but which has now ballooned to cover many different aspects of crime—something that has got civil liberties groups worried.
Christopher Wilson is suspected of attempting to break into a law enforcement website and “trolling” the Newcastle Police by fooling them with a prank phone call. However, these are not what he is going to prison for: he's spending time behind bars for not giving up his passwords.
In the original case the prosecution argued that the defendant’s lack of cooperation in unlocking their phone was evidence of guilt. Wouldn’t a Supreme Court ruling therefore be about whether or not a prosecutor may assert such a thing as evidence? That feels quite different from the original act of (and rights around) refusal to unlock the phone.
It’s as if the prosecution said “he had a gun, so he must be guilty!”, and hoping that the case will go to the Supreme Court to decide on the legality of the second amendment.
* https://reason.com/volokh/2023/12/14/is-compelled-decryption...
A primituve one would be requiring a main password to authenticate every 12 hours. If the main password is not used until that period passes. A second password that you don't memorize can be used to unlock but it is stored in a place that only you can access and only if you are totally free.
Anyway, a tyrant is simply going to hold and gun to your head and tell you to go get that second password.
I'm not that familiar with the US law system, but wouldn't a written down password be worse? With a memorized password it's at least possible to claim you have forgotten.
Some encryption schemes allow two keys for unlocking, but they would show different content depending on the key. I think I remember trying that on TrueCrypt many years ago.
It's not practical at all, but there should be possible to build systems that authenticate you only if you are free and doing that on your free will without any compulsion.
In many countries, they have laws saying suspects can't refuse to give passcodes (or if they do, they'll be jailed)
I think such laws are dangerous, as they could be used for a particularly evil type of attack: throw an encrypted cellphone in someone bag, then have them arrested for whatever wrong reason.
When they can't provide the passcode, they are automatically guilty!
These can be illegal depending on the country in question.
Cellphones are very frequent, and not illegal (except maybe in North Korea?)
I know it exists for certain cryptocurrencies hardware wallets: they can be setup (but are not required to) so that one PIN unlocks the real wallet and another PIN unlocks a decoy wallet, which only has some coins.
P.S: people are probably going to point out the $5 wrench attack though
$5 wrench attack works on known unknowns, but not well on unknown unknowns.
People were sent to Guantanamo bay for much less.
In general, if you’re thinking about interactions with the police and you have an idea that feels “clever”, it is a bad idea.
Even if you know to the letter what your state law requires, the police often don’t. If you take the arrest and sit in jail for 2-12 hours, you can fight it later in court. Somehow, this is a luxury for most people in the US.
If it comes up at trial, you simply explain that the officer was rude to you, so you didn't want to talk to them, which caused them to be even more rude to you, which confirmed your decision to not talk to them.
It is very difficult to prosecute someone for a crime if they stay silent during the legal process, it's why the police are hyper-aggressive, they are trying to catch any idiot who will say anything that will get them arrested and charged, so they can report to the municipality, county (or state or whatever) that they have achieved x, y, z rates of charges, solved crimes etc., in order to secure better funding (meaning better salaries, benefits, pensions, and toys to terrorize you with).
You unlock a phone or a computer and sign into one profile and not another. Are you lying?
It may not be difficult for the prosecutor to point out that you "unlocked" your phone into a mode you never use and in fact specifically use to deceive law enforcement.
Much simpler and safer to do absolutely nothing. Plus, you don't know for sure if that secondary mode being unlocked can enable third-party tools to break into the primary profile.
You might be thinking of 18 USC 1001 which makes it a felony to lie to a federal agent, and is extremely broad (both in terms of of what constitutes a lie and who counts as a federal agent).
Seems to me like there ought to be some kind of 14th Amendment “equal protection” cases presented to the court about the failure of police forces to dismiss false police reports.
If I filed a police report saying “X threatened me on my property” and it wasn’t true, I’d be prosecuted for a false report. Yet there are hundreds of instances of state and federal employees filing the same kind of false reports, yet nothing is done about it.
She then proceeded on another device to show me that in no place on the official Samsung website is the device referred to as "a phone". The device is always referred to as "a smartphone" and in one place the telephone communication application is referred to as "the phone". I conceded that she made a good case and that the punishment therefore applied to the telephone communication application only.
Does the alternative password enable your phone book and phone history? If so, then yes you have unlocked the phone. If not, then you have unlocked "a phone" but not "the phone".
> I think unfortunately in almost all cases the spirit of the law is more important than the word of the law, and most courts frown upon this kind of chicanery.
> I think this encourages her to "well, actually" people more, which nobody likes being on the receiving end of :-)
I seem to recall that being one of the few times in a criminal trial where a jury can be instructed that they may make an adverse inference. (IANAL)
Right now: do not use biometrics (can be legally forced); do not use numeric passcodes. Use alphanumeric password.
I think modern devices have addressed this in various ways, but it’s not a good idea to rely on timed lockouts when it’s possible that techniques exist (or could eventually be found) to bypass the lockout.
In short, assume those lockouts are targeted at normal users. A sufficiently motivated actor with technical resources is another story.
An ex-bf/gf that hates your guts will remember that your pin is 1-2-3-4-5-6, because that one time your hands were wet and she needed to see that photo from that party and you told her the PIN..
While if you have a word, new bf/gf will mean new word, and good luck knowing that.
Then they can unlock the actual device.
This is why phone cracking devices like Cellebrite rely on exploits in phones rather than just cloning the disk and trying the small number of possible passcodes.
I guess if they really wanted to they could attempt to decap the chip and do something with a hardware attack, but thats difficult and dangerous.
If your device's encryption key is produced by a PBKDF then yes it's doable, but no actually secure system works like that. The way a secure system works is
1. You have an HSM ("Secure Enclave" in Apple speak, Trusted Computing Module in MS speak, and I can't recall the google/android name)
2. The HSM generates a random encryption key (or family of keys)
3. The HSM encrypts and decrypts the data with those keys (the keys themselves never leaving the HSM)
4. The HSM gates access to those keys based on an attempt limited use of your passcode/password
There were common flaws a few years ago that meant that you could glitch the HSMs into (essentially) not incrementing the attempt counters or similar but I haven't heard of such in a few years now (almost a decade now? essentially these kinds of flaws were discovered en mass once HSMs reached consumer hardware so more security researchers were able to investigate)
The important thing though is the encryption key is now fully random, rather than derived from your password, which is the difference between a 128+ bit key and a ~40-60 bit key.
At the very least, such an effort may well be able to reduce the problem space considerably, leaving it down to a few guesses on the device.
Obviously doesn't help if they pull an elaborate Russ Albrecht-style move but useful for situations where you can see them coming (which is likely most of them).
Caution, this may call 911 depending on your settings.
Settings > Emergency SOS > Call with Hold and Release.
You can also disable Face ID by pressing the power button 5 times - which can also be a 911 shortcut, check the settings in the same place.
If the police already have you, calling 911 on accident probably isn’t a concern.
Let me see if I can get the recording via FOIA...
You can also press and release the power button five times consecutively for the same power down/SOS screen, and then the biometric lock gets disabled (requiring the device passcode).
* This may vary by phone, but I'm not sure.
Unless your concern is your device is out of your control when it is seized, in which case you could mitigate your concern by locking it when it will be out of your control, or if you really want to just never enable biometric authentication. Of course that puts you back in the bucket of every time you unlock your device it can be observed.
The author thinks this could be the case that goes to SCOTUS.
"Australia has no constitutional protection for the right to silence,[4] but it is broadly recognized by State and Federal Crimes Acts and Codes and is regarded by the courts as an important common law right and a part of the privilege against self-incrimination"
Here's a computer to explain it to you: https://chat.openai.com/share/532f399a-80d4-4973-9508-67f0f0...
And the references used. I even checked them myself:
https://law.justia.com/cases/federal/appellate-courts/ca4/21...
https://law.justia.com/cases/federal/appellate-courts/ca4/22...
This one in particular is great because apparently the 5th amendment doesn't apply if you're not an English speaker and don't understand the extreme subtleties of the law, such that you can be compelled to incriminate
“To qualify for the Fifth Amendment privilege, a communication must be testimonial, incriminating, and compelled.” The Fifth Amendment privilege against self-incrimination thus only protects a defendant from being compelled to provide “testimonial” evidence, meaning that the communication “must itself, explicitly or implicitly, relate a factual assertion or disclose information.” Indeed, the Supreme Court has explicitly distinguished between “the use of compulsion to extort communications from a defendant” and merely “compelling a person to engage in conduct that may be incriminating,” such as providing samples of one’s voice, handwriting, or physical appearance, all of which are constitutionally permissible."
Note, these are only the ones that were appealed.
Land of the free baby
It does not matter what the constitution says police are going to do whatever they want no matter what, and case law proves that that’s exactly what they will, and will continue to do
You seem to be continuing to operate under the assumption that America works underneath the rule of law universally applied. It doesn’t, it never has.
As you so clearly reinforced my original point, the only way that you can actually have those rights apply to you is by either being smart or rich, and most people are neither
Beyond that, cops are trained to manipulate people into believing that either a) they are required to talk (despite being read their Miranda rights), or b) that talking actually will work out better for them in the long run than staying silent.
That said, even though America doesn’t have a perfect record on this, our Fifth Amendment rights are generally effective at protecting us from forced self-incrimination. We at least have the luxury of the Supreme Court that may hear and adjudicate our cases if our Fifth Amendment rights are violated.
> Americans are forced by their government to self-incriminate all the time and are sitting in jail for it.
“all the time” ← Can you please quantify that? I genuinely don’t believe it happens enough to justify your assertion. (I’d love to be corrected with some data if I’m wrong.)
All in all, I think it’s a mistake to expect a perfect system. Compared to the rest of the world, our Constitution is a massive luxury; Americans are beyond lucky. I can either focus on the fact that the overall system isn’t perfect or I can appreciate—i.e., not take for granted—the fact that we even have the codified set of rights that we do.
P.S. I personally know folks from Third World countries whose family members were executed for having the “wrong” opinion. We really do take a lot for granted here in America.
There is no “evidence” because it’s not on the record. It’s a lived experience by poor people. I don’t know if you’ve noticed but police kill a lot of innocent people that looks precisely like executing somebody for making the wrong decision, so I’m not sure how you’re not seeing it but it seems like you’re intentionally not seeing it.
It’s examples like my friend who did 10 months in county jail because he pissed hot during a two month probation on a drug charge related to a friend that he was driving the car with. This is an every day experience for me as a teenager. I was pulled over regularly and padded down and it was only because I had a white mom who would come bitch at the police that I didn’t have a record.
There is an entire country within America that has no access to constitutional rights. I suggest you just look up a little bit of black history and you’ll be informed on some of this.
> […]
> There is an entire country within America that has no access to constitutional rights. I suggest you just look up a little bit of black history and you’ll be informed on some of this.
I really hate having to bring up my background and race, but I really have to here: I’m literally a black man who grew up in inner city America who also used to be a leftist activist years ago (one of my primary focuses used to be “police brutality”). This is absolutely not a foreign topic to me. I’ve personally had a number of bad encounters with the police going back all the way to my pre-teen years. I find it interesting that you simply assumed, based on my perspective, that I’m somehow just oblivious. Regardless, none of that changes anything I’ve said.
Also, your claim that a certain segment of Americans, such as poor black folks, have “no access to constitutional rights” is simply false. A more reasonable argument would be that a certain segment of Americans lack the resources to properly defend their Constitutional rights, but those rights haven’t gone anywhere.
I got put on the hood for nothing for years before going into the military and whitening up.
This law firm’s site has a good summary: https://www.reeds.co.uk/insight/section-49-ripa-2000-trendin...
The reason I say it’s important to note this is that the UK police absolutely will over represent these powers to bully you into voluntarily handing over unlock codes and passwords. Unless there’s a S49 notice, they’re just asking and you have every right to say ‘no thanks’, and even if they do issue one you can require your day in court to force the issue.
> A court of appeals reversed the conviction, agreeing "with Valdez that he had a right under the Fifth Amendment to the United States Constitution to refuse to provide his passcode, and that the State violated that right when it used his refusal against him at trial." The Utah Supreme Court affirmed the court of appeals ruling.
This seems like a much more subtle question.
Prosecution: "Mr. Defendant, when the police asked you to unlock your phone, what did you tell them?"
Defense: "Objection, prejudicial and irrelevant. Fifth-Amendment."
Judge: "Objection sustained--move on to the next question."
My “of course” comment above was about refusing police questioning (Miranda rights). not refusing a search warrant. That does seem like a much trickier issue.
Edit: added the clarification about Miranda rights
> At some point thereafter, the officers obtained a search warrant for the contents of Valdez’s phone. But they were unable to access the phone’s contents because they could not crack his passcode. So a detective approached Valdez, informed him that he had a warrant for the contents of the cell phone, and asked Valdez to provide his passcode. Valdez refused. Without the passcode, the police were never able to unlock the phone to search its contents
People have been sent to jail on contempt charges for refusing to provide their password, before even getting to the point of going on trial for whatever they're accused of.
If you are not a US citizen, however, and you are trying to enter the country, they can use your refusal as a basis for denying you entry. Which is garbage, but... yeah.
Why is refusing to comply resulting in denying entry garbage?
[1] https://www.magnetforensics.com/products/magnet-graykey/
>When time is critical or access is restricted, selectively extract specific data you need to kick-start your investigation
part. With full-device encryption, was expecting it would've been all or nothing.
And against a modern Pixel/iPhone I would also expect the answer to how does it work to be "not so well". Consider the percentage of the population that uses a potato phone from 2018, consider the likelihood of them being the criminal in question, and the product starts working a lot better. Remember how FBI failed to decrypt the iPhone of some domestic terrorists: https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...
Also remember that lower-end Android hardware uses a different, cheaper, algorithm: https://en.wikipedia.org/wiki/Adiantum_(cipher)
Every barrier to surveillance makes it less likely. Increase the cost to decrease the behavior.
Many conspiracy theory surfaced from back door to rooted iCloud servers in China.
Till a supposedly policemen chimed in and said they'd just browse through the millions upon millions of security footage to see the perp unlocking their phone with passcode.
If users need to verify the entered characters, use the “show password” eye icon.
Avoid the attack surface of flashing inverted characters visible to nearby surveillance and phone cameras.
> they'd just browse through the millions upon millions of security footage to see the perp unlocking their phone with passcode
s/browse/facial recognition search/
In short, they are still single-factor authentication.
https://www.pearsonitcertification.com/articles/article.aspx...
The prosecutor was appointed to the position of Minister of Justice and is also a candidate for the next presidential election.
The accused can't be compelled to produce a password, and the prosecution can't use the defendant's silence as an argument against them. BUT the police can explain in court that they were unable to search and/or seize what's listed on the warrant due to an unknown password and unbreakable encryption.
In other words, they can't say "Joe wouldn't give us his phone password and that means he's guilty". But they can say "we were unable to search his phone or collect these documents listed on the warrant due to unbreakable phone security".
There's not a huge difference between those two statements when it comes to the jury. They'll understand that evidence is missing, and that the defendant can probably produce it but won't. Maybe civil libertarians won't like that, but I think that's misplaced: there is a warrant, remember, it's not just a random search. And the defendant can always produce it if it's exculpatory.
Its never been the defendants job to prove their innocence. Remember that's where we start. A defendant is innocent. An innocent person does not need to unlock anything, they're innocent.
Not sharing the password should be obviously protected, but saying the phone isn't yours when in your person is harder to try and get away with.
This helped convict them of aggravated burglary.
(Incidentally, one of the others failed to provide his passcode but we found it implausible that he could have forgotten it, unlike the USA in England this is absolutely something you can be done for here and he was. I don’t want to get in to the pros/ cons of this law but the basic idea is that its seen as a key, albeit intangible, to a locked container which investigators can require you to open)
1. "I promise to tell you if you bring me snacks"
2. "Thanks. My password is a-n-i-d-i-o-t-t-y-p-e-d-t-h-i-s-6-9"
3. "Ok, ok, it's f-o-o-l-m-e-t-w-i-c-e-4-2-0"
4. "no."
5. "I refuse to answer any questions without a lawyer present"
6. "I don't remember the password"
7. "I tried to learned Android development and I think I accidentally wiped the device"
I think in that case it'd probably be treated more or less the same. Jailed for months/years for contempt of court, either locked up in a cell or a hospital with court ordered mental health treatment depending on if the judge believes the person actually has the disorder or not.
And then I proceeded to not reboot my phone for months, and forget what the encryption password was. I was very surprised upon next reboot to find I couldn't get into my phone. Fortunately I remembered it, but it took me a good day or so to figure it out.
So yes, it's perfectly possible to forget a passcode. But the authorities, of course, may not believe you've forgotten it. Which is why it's so important that it should be entirely legal to just refuse to provide it in the first place.
Why would a computer device be any different?
Same goes for a computer device. Go ahead, crack it.
I eventually gave this psychopath my password because I had nothing incriminating and I hadn't eaten all day.
Nice to know USA is literally Nazi Germany but better at hiding their dirty secrets.
How old were you?
(The last line usually wouldn't be ok on HN, but I can imagine your anger.)
Not sure why this hasn't been slapped down a long, long time ago.
A phone is unique thing not because it contains so many secrets, but because you have to give testimony (as opposed to property, like a key) in order to open it, and it's impossible to open by bashing the door down or cutting it open. It's a technological coincidence, not a legal/philosophical doctrine, that makes phones secure against compulsion by law enforcement.
Is it different from compelling someone to enter a text password to unlock a vault? What if it's self-destructive otherwise?
What happens if the password itself - or act of unlocking - is something self-incriminating (in form, in contents, or otherwise)?
Reminds me of Ian Watkins: https://www.huffingtonpost.co.uk/2013/11/26/lostprophets-sin....
A court on the other hand, can compel you to open something.
An order to unlock something coming from the cops is entirely different, even if they have a warrant. Warrants would allow them to seize a phone, but you don’t have to provide the password.
No, they can't
Actually, the government cannot compel you to give the combination to a safe [1]. If it's locked with a key, not a keypad or combination lock, they can force you to give the key. The distinction is that the former is a product of the mind, while the latter is a physical object. Furthermore, what if you forgot the combination? There's no real way to tell if someone has forgotten the combination or is deliberately withholding it.
The UK's laws to compel people to give up passwords seems to make it a de facto crime to forget one's password. Worse yet, it seems like it's illegal to possess random bytes on your devices. I wonder if the UK would change course if people started emailing random bytes to politicians and other supporters of this law, while giving tips to law enforcement that these individuals are coordinating criminal acts over encrypted communications.
But ... If you're going to compell someone to give up the contents of their mind under threat of being found guilty if their mind isn't working properly, you may as well just do away with trial.
IOW, if you're going to compell speech, just compell the suspect to confess; it's the same thing.
Sounds a bit silly. The location of the key is "a product of the mind." What if you forgot the location of the key?
No, they can't. They can force you to let them try to open it, but they can't force you to open it for them.
If you have some mechanism like "if you try to open this incorrectly it destroys the contents", and you intentionally don't disclose that with the expectation that they're going to try and fail and destroy the contents, you might get charged with destruction of evidence.
(EDIT: Replies suggest that disclosure may not suffice.)
https://www.hecklawoffices.com/blog/2020/11/its-illegal-for-...
Does it only become destruction after you have been informed the police are interested in you? What if you do it before a warrant is issued? What if your device will self destruct if a password is not entered every N days and you withhold that information?
News articles suggests this happens a lot at the borders or during customs.
https://www.yesmagazine.org/social-justice/2018/03/23/two-th...
The state can install a keylogger if they have a warrant, and the results of the keylogger can be admitted as evidence.
It’s “you can’t be forced to open it because it requires you saying the password,” not “you can’t be forced to open it because it contains important secrets.”
Right, if they can figure out a way to reveal your secrets without forcing you to say something, they’re allowed to do that (with warrant of course).
So there's a common argument that the 5th amendment only protects you against being forced to give evidentiary testimony against yourself. Giving up a passcode is arguably different, since the passcode is not (necessarily) evidence in itself, in the sense that it might not be introduced as evidence at trial to establish guilt or innocence. Rather, it is information that will allow law enforcement to access other non-testimonial evidence.
I'm not arguing for this position, just providing a perspective on why this isn't as open-and-shut as people often think it should be.
I don’t use a password or pin, I use a passphrase, and my passphrase is an instance of me confessing to some extremely mild crime.
But I can say that the 1988 America's cup does not support either of those points.
----
Background:
First of all, the opinion of the appellate court is better written and clearer than the Wikipedia article: https://nycourts.gov/reporter/archives/mercury_sandiego.htm I'm going to be quoting it a lot because it says things more plainly and authoritatively than I could.
"The America's Cup, a silver cup trophy, is the corpus of a charitable trust created in the 19th century under the laws of New York." Such a charitable trust is governed by a "Deed of Gift" written by those who gave the cup to the trust. "[George] Schuyler executed [wrote/signed] the present Deed of Gift in 1887, donating the Cup to the New York Yacht Club".
The gist of the deed is that one yacht club can challenge the current holder of the cup to a race to win the cup (the race is 10 months after the challenge is issued); the two clubs are free to agree to whatever rules they want, but if they fail to agree then the deed gives some fallback rules. One of the rules that the 1887 deed gave is that for single-mast vessels the load water-line length must be between 65 and 90 feet. However, "In 1956 the New York Yacht Club obtained a court order amending the Deed of Gift to reduce the minimum load water-line length to its present 44 feet". For context, the America, the ship for which the cup was named, was 89ft 10in.
From 1956 until 1987 all challengers agreed to a lower maximum length than that 90ft limit, because even though longer boats were faster, they were more expensive.
----
Why I don't believe that this supports your points:
- Because the issue was about the Deed of Gift, not The Racing Rules of Sailing, this was decided by the NY courts, not by the International Yacht Racing Union (IYRU).
- Because reasons ("see, e.g., Crouch v National Assn. For Stock Car Auto Racing, 845 F2d 397, 403; Finley & Co. v Kuhn, 569 F2d 527, 539") the court specifically did not interpret The Racing Rules of Sailing, and just interpreted the deed. If Mercury Bay wanted The Racing Rules of Sailing to come into it, they should have brought it to the IYRU--which they totally could have done--and not to the NY Supreme Court.
- The discussion in the decision of the court by word-count I would say is 90% about about the spirit and intent of the deed and what the author intended, and 10% about rigid textual interpretation.
Also destruction of evidence is a crime, so you could pick up additional charges as well.
Don't play games with the law: talk to a lawyer. The law is not code, you generally aren't going to win with clever interpretation (see myriad cases where the "intent" of the people making the law is considered by the court) or "hack". If you're ever dealing with legal issues, civil or criminal, talk to a lawyer.
> "since the passcode is not (necessarily) evidence in itself"
a little similar to the courts treating the law as computers?
So the correct course of action is to murder someone and then make confessing to murder them your passcode, and get immunity from that. #lifehack #modernsolutions :D :D
For example, you could make your password the latitude/longitude of a top secret nuclear missile silo you’ve stumbled across, or something like that?
I suppose for the most part one critical function of judges is to override legislation when it appears that injustice would take place. We can't have murderers who say "sorry found some sweet loophole lol". And similarly we can't have abusive cops/prosecutors who want to harass citizens "tell us all your secrets and I'm sure you're guilty of something lol". Judges should be able to make sane tradeoff in the name of justice.
USSS, please refer to: https://www.youtube.com/watch?v=eg3_kUaYFJA
Or, what if the passphrase includes top secret information?
Or, what if you passphrase is a declaration that you are under one of those secret court warrant thinamajiggies.
The Brandenburg v. Ohio (1969) Supreme Court case allows for criminalizing speech only if the speech is "directed to inciting or producing imminent lawless action and is likely to incite or produce such action" [1]. "imminent" means that there has to be a near-future, clear time window. "I will kill X president within 3 days" could be illegal. "I will kill X president within a year" is too vague. Regardless, either one could be interpreted as evidence of criminal intent to harm the president. (If you were only joking about killing the president and the jury believes you, then you're fine.)
https://www.aclu.org/issues/national-security/detention/inde...
We have humans to apply the law and use their judgment for exactly this reason.
The "I do not recall" answer in high profile trials is so common that it's essentially become a meme. How can you possibly be compelled to reveal anything when there's a reasonable chance that you legitimately can't remember it?
In particular, I don’t remember the pin or password to some devices and accounts. They are shapes, on the pin-pad or keyboard. There are enough alternative ways of logging in (the apple face thingy, yubikey, you could hypothetically have devices setting up arbitrarily complex interlocking login processes) that I suspect the court would just define what they want, rather than how they want you to do it.
I could be wrong though, no actual experience here with the legal system at all.
Unless the passcode is a decryption key, in which case the evidence simply does not exist without the passcode. It is indistinguishable from random noise. It’s less like “unlocking a safe,” and more like “instructing nanobots to reassemble a pile of dirt into evidence.”
on edit: huh, what do you know, everybody had the same idea!
You might argue, well the police will have ways to prove it's your phone. Okay, so let them prove it, don't assist them. Well, then they can force you to produce your password, whether you admit it's your phone or not. But by divulging a password, you're admitting you own a phone somewhere, and part of your defense might be (however implausible) that you don't own/use a phone.
I'm not sure if that bit relies on the 5th amendment, or something else. But how is a passcode for a phone any different than a combination for a safe?
Police can easily get warrants for your phone; you just can't be compelled to give the code to unlock. I suspect in the future we'll see a different level of cooperation from phone makers.
They screw up very frequently. Sometimes maliciously, sometimes through incompetence, sometimes both. I can't convey the depth of this in a small comment box, but there's abundant evidence around on this topic if you care to look.
Overall, even when you're talking about legitimately designated authority given to a person ... it's VERRRY easy for a human being to screw up and get it wrong, and it has huge impact over the lives of their targets. Needs to be approached by the authorities with extreme caution. In practice, probably many of them aren't aware of the weight of their actions, or don't care.
Do you have a source for that? Frequently is a relative term. 1,000 fuck-ups can be a lot or a little depending on the total number of interactions we are talking about.
These don't include number of cases where legal action wasn't taken or which got thrown out due to qualified immunity (these are somewhat related, if case is unlikely to get past qualified immunity it's quite unlikely legal action will be taken). And probably cases which actually went to trial as it seems to focus on settlements.
Additionally there is for example https://www.nyclu.org/en/publications/cop-out-analyzing-20-y... which covers 2000-2020 misconduct complaints. According to it disciplinary actions were taken 4283 times, meaning that even if conduct was enough to reach settlement it doesn't necessarily mean it results in any actions taken against the officer.
Meaning: its point isn't to prevent access to real evidence. It's not an attempt to grant you privacy. It's an attempt to ensure justice is served correctly.
This is also why you lose that right when you're granted immunity. The state can force you to provide testimony in that case.
Corollary here is that it's actually quite surprising courts are willing to side with the accused here. It's probably only a matter of time before rulings come to the contrary. If you care about privacy as a human right, you really need another amendment to make it solid.
You would need some kind of catch-all amendments stating that the enumeration of certain rights shall not be construed to deny others, and that the powers not delegated to the feds are reserved to the States or to the people. You could put them right at the end of the original amendments for emphasis as a closing statement of the Constitution.
But if we enacted those who would ever enforce them? The feds would probably treat them as if they didn't exist.
If you make them vague then it'll be easy to interpret them narrowly.
If you make them crystal clear, courts would presumably enforce them, like they have in the past.
The short response here is: How often do you see that happening in the US?
But in any case, note that I'm explaining what it was intended to do and what its meanings and implications are. Whether it is successful in achieving its goal is beside the point for this conversation.
Actually, the case is even stronger than you make it out to be. IIRC, one of the key constitutional issues is that providing a password is equivalent to saying "yes, this is mine". So even if we disregard the contents of the device, the issue is that you are establishing a legally relevant relationship with a piece of evidence.
I'm recalling this from a looong time ago, when I took a constitutional law class, so I hope those with fresher knowledge not hesitate to jump in.
Then you can argue that the passphrase (unlike a PIN, face ID) may incriminate me of a crime and that Fourth Amendment prevents me from doing so.
Same thing with voice-based passphrase.
Of course, I am not a lawyer.
IANAL.
Back in the day your personal belongings couldn't be used to incriminate you [1] since the bill of rights prohibits self-incrimination.
These aren't protected.
Also
> The Court recognized that while the rejection of the mere evidence rule may "enlarge the area of permissible searches," the protections of the 4th Amendment, like the reasonableness and warrant requirements, would sufficiently safeguard the right to privacy.
So SCOTUS think that government would be satisfied with Bill of Rights. What if government thinks it is just too frustrating to follow laws?
That would make too much sense though.
Hence, I understand, if they find anything illegal, then your password retention was hindrance to justice.
Like all the rest of the computer stuff, it stops being yours and becomes theirs and you are only allowed to use it.
https://en.m.wikipedia.org/wiki/Key_disclosure_law#United_Ki...
This ruling isn't even for all of the US, currently only at the Utah state Supreme Court level, it hasn't gone to the Tenth Circuit Court of Appeals or Supreme Court. This is not necessarily the last word on the topic, not even just for the US.
Another of many factors is whether the person was being detained or merely questioned, whether they had been formally notified of their right to remain silent, etc.
A compact Linux device without any biometrics, telemetry, public clouds and corporate spying software is probably what you could be looking for.
“Nothing to fear if you’re not doing anything wrong” is a fallacy that serves only the cops
This is why I hate when I get a 1Password prompt to reenter my nonbio password at inopportune times in a public place. My keystrokes can be secretly filmed from a distance. When I gain access to passwords that I copy and paste by fingerprint, the forcible theft of my machine puts me at near 0 risk. (My preferred way to login while in public.)
They'll take your phone, so can't trigger the killswitch.
Of course, from experience, this does not matter if they do compel you to give up the password by other means (e.g. threatening to harm your family).
Your face and fingers are always with you and it's easy to force you to open your phone.
You can "forget" a password but not your face.
https://android.stackexchange.com/questions/27746/where-to-f...
How else do you protect against the exploit of security cameras, anywhere you unlock your phone, recording your passcode?
It could be the end of non-random passwords.