Another 5th Amendment Encryption ruling

[crimresearch]

Landmark decision allows child-porn suspect to plead Fifth in password case


http://www.zdnet.com/blog/identity/l...sword-case/291

Quote:

In what will likely become a landmark case for the digital age, a federal appeals court has ruled that a suspect in a child pornography case is protected under the Fifth Amendment from disclosing a password that would decrypt his computer files.

This case:

http://www.ca11.uscourts.gov/opinions/ops/201112268.pdf

[PhantomWolf]

Well that is the price to pay for having a 5th Amendment. If you want to have the right not to self-incriminate, then it means that some people who are suspected of hineous crimes can get away without telling the police information that would lead to them being arrested. The only way to change that is to scrap the 5th Amendment and allow the police to demand people tell them what they want to know, regardless of if it would be determental or not. Basically removing the right to silence.

As is often said, tough cases make bad law. Knee jerk reactions are not a good way to determine what the law should be, it generally ends up eroding the rights of the innocent as well as the guilty.

[Almo]

Originally Posted by PhantomWolf

Well that is the price to pay for having a 5th Amendment. If you want to have the right not to self-incriminate, then it means that some people who are suspected of hineous crimes can get away without telling the police information that would lead to them being arrested. The only way to change that is to scrap the 5th Amendment and allow the police to demand people tell them what they want to know, regardless of if it would be determental or not. Basically removing the right to silence.

As is often said, tough cases make bad law. Knee jerk reactions are not a good way to determine what the law should be, it generally ends up eroding the rights of the innocent as well as the guilty.

Yup.

[rjh01]

I have a file that has a password on it. If I tell the police what that password is then they could do huge damage to me. That is assuming they are corrupt. However in that file is nothing illegal.

[WildCat]

Originally Posted by PhantomWolf

Well that is the price to pay for having a 5th Amendment. If you want to have the right not to self-incriminate, then it means that some people who are suspected of hineous crimes can get away without telling the police information that would lead to them being arrested. The only way to change that is to scrap the 5th Amendment and allow the police to demand people tell them what they want to know, regardless of if it would be determental or not. Basically removing the right to silence.

As is often said, tough cases make bad law. Knee jerk reactions are not a good way to determine what the law should be, it generally ends up eroding the rights of the innocent as well as the guilty.

I predict Congress will pass a law outlawing all encryption unless a "skeleton key" (not sure what else to call it) password is made available to the FBI. And having an encryption program on your computer that doesn't have this gets you 5-10 at Club Fed.

It's for the children.

[The Dark Lord]

Originally Posted by PhantomWolf

Well that is the price to pay for having a 5th Amendment. If you want to have the right not to self-incriminate, then it means that some people who are suspected of hineous crimes can get away without telling the police information that would lead to them being arrested. The only way to change that is to scrap the 5th Amendment and allow the police to demand people tell them what they want to know, regardless of if it would be determental or not. Basically removing the right to silence.

As is often said, tough cases make bad law. Knee jerk reactions are not a good way to determine what the law should be, it generally ends up eroding the rights of the innocent as well as the guilty.

+1

[The Dark Lord]

Originally Posted by WildCat

I predict Congress will pass a law outlawing all encryption unless a "skeleton key" (not sure what else to call it) password is made available to the FBI. And having an encryption program on your computer that doesn't have this gets you 5-10 at Club Fed.

It's for the children.

I doubt it.

[Dancing David]

Originally Posted by WildCat

I predict Congress will pass a law outlawing all encryption unless a "skeleton key" (not sure what else to call it) password is made available to the FBI. And having an encryption program on your computer that doesn't have this gets you 5-10 at Club Fed.

It's for the children.

Oy that does sound like the Congers of the US.

Then everyone can use it to decrypt each others files.

[Arisia]

Is any part of the story about whether any attempt by law enforcement to try to decrypt the files themselves might be considered a violation of the 4th Amendment?

[The Dark Lord]

Originally Posted by Arisia

Is any part of the story about whether any attempt by law enforcement to try to decrypt the files themselves might be considered a violation of the 4th Amendment?

It's not assuming they have a search warrant which I am sure they did. I doubt they would even bother trying though because it would be pretty much impossible unless the password is weak.

[crimresearch]

Originally Posted by PhantomWolf

Well that is the price to pay for having a 5th Amendment. If you want to have the right not to self-incriminate, then it means that some people who are suspected of hineous crimes can get away without telling the police information that would lead to them being arrested. The only way to change that is to scrap the 5th Amendment and allow the police to demand people tell them what they want to know, regardless of if it would be determental or not. Basically removing the right to silence.

As is often said, tough cases make bad law. Knee jerk reactions are not a good way to determine what the law should be, it generally ends up eroding the rights of the innocent as well as the guilty.

It is easy to have a Constitution that only protects the innocent. The one America has takes a lot more effort.

But I suspect that the knee jerking has already begun, from those who can't see why that is a good thing...

[Beerina]

Originally Posted by WildCat

I predict Congress will pass a law outlawing all encryption unless a "skeleton key" (not sure what else to call it) password is made available to the FBI. And having an encryption program on your computer that doesn't have this gets you 5-10 at Club Fed.

...thus ensuring two things:

1. The development of even more secure software
2. Much like outlawing guns, the criminals won't care because they're already at risk of jail for their activities.



Here's the sad part: The government officials who stomp about and wanna do things like this cannot, unless some soulless bastard techie helps them understand it.


To all my high-tech brothers, stop feeding the asses in government! Expose them for what they are, angry but technologically incompetent men with a will to power.

[crimresearch]

Quote:

angry but technologically incompetent men with a will to power

And the ability to pay a lot better than Starbucks...

[Beanbag]

Originally Posted by WildCat

I predict Congress will pass a law outlawing all encryption unless a "skeleton key" (not sure what else to call it) password is made available to the FBI. And having an encryption program on your computer that doesn't have this gets you 5-10 at Club Fed.

It's for the children.

They tried it once:
http://en.wikipedia.org/wiki/Clipper_chip

Failed miserably. Became an industry joke.

Beanbag

[Dan O.]

US export restrictions were responsible for the easily cracked 40 bit WEP of the early wi-fi.

[luchog]

Originally Posted by The Dark Lord

I doubt it.

Why? They've been trying to do so since effective encryption utilities were made available in the 1990s. More info:

http://www.wired.com/threatlevel/2010/09/fbi-backdoors/

[The Dark Lord]

Originally Posted by luchog

Why? They've been trying to do so since effective encryption utilities were made available in the 1990s. More info:

http://www.wired.com/threatlevel/2010/09/fbi-backdoors/

The FBI does not have the authority.

If there was some kind of backdoor inserted into encryption standards, it wouldn't be only the FBI who can read encrypted files/messages. The backdoor would be found and exploited. The US would be open season to hackers from teenagers to gangsters to the Chinese government.

Given the huge backlash, I doubt that very many congressman would risk their seats by voting for such a law.

[Darth Rotor]

Dark Lord, some of them are stupid enough to have voted for it.

[CORed]

Originally Posted by WildCat

I predict Congress will pass a law outlawing all encryption unless a "skeleton key" (not sure what else to call it) password is made available to the FBI. And having an encryption program on your computer that doesn't have this gets you 5-10 at Club Fed.

It's for the children.

The Clinton administration tried hard to implement this (Clipper Chip) and failed. Of course, that doesn't mean somebody won't try again, but I seriously doubt they'll get away with it. Encryption is too critical to operation of the internet and encryption software is too widely available for such an effort to gain much traction.

[WildCat]

Originally Posted by Dan O.

US export restrictions were responsible for the easily cracked 40 bit WEP of the early wi-fi.

But now they can do it for the children!

The chiiiiillllldddddrrrrreeeeeennnnnnn!!!!!!

[WildCat]

Originally Posted by CORed

The Clinton administration tried hard to implement this (Clipper Chip) and failed. Of course, that doesn't mean somebody won't try again, but I seriously doubt they'll get away with it. Encryption is too critical to operation of the internet and encryption software is too widely available for such an effort to gain much traction.

They'll rename it the "stop child sex abuse chip".

[Christian Klippel]

Originally Posted by CORed

The Clinton administration tried hard to implement this (Clipper Chip) and failed. Of course, that doesn't mean somebody won't try again, but I seriously doubt they'll get away with it. Encryption is too critical to operation of the internet and encryption software is too widely available for such an effort to gain much traction.

Which also highlights the importance of OpenSource Software, especially when it comes to cryptography. It is way too easy to put backdoors into software that you get only as binary. Far more so if those closed systems also get updates from closed channels, by rather unknown and uncontrollable methods. It is much, much harder to do the same with OSS.

While only some of us are actually able to read and understand source code, those "some" are already enough to have a good safeguard in place, especially about cryptography related things, since the importance of that goes far beyond "i don't want the government to see my nasty porn image collection".

Stuff like the Clipper-Chip can only be implemented if stuff is closed.

Oh, and it is also time to have BIOS code OpenSource as well. But that one is still in it's infancy, sadly.

Greetings,

Chris

[luchog]

Originally Posted by The Dark Lord

Given the huge backlash, I doubt that very many congressman would risk their seats by voting for such a law.

You clearly didn't bother to read the other links in the article.

[The Dark Lord]

Originally Posted by luchog

You clearly didn't bother to read the other links in the article.

Which ones talk about how the majority of Congress is willing to vote for a bill that would give hackers access to (previously) secure communications in the US?

[luchog]

Originally Posted by The Dark Lord

Which ones talk about how the majority of Congress is willing to vote for a bill that would give hackers access to (previously) secure communications in the US?

Are those goalposts heavy?

[The Dark Lord]

Originally Posted by luchog

Are those goalposts heavy?

In the context of Congress passing a law, it is blatantly obvious that "many" = enough to pass. No goal posts moved. But really, there isn't even enough so that the bill would actually be voted on.

[Beerina]

Originally Posted by The Dark Lord

It's not assuming they have a search warrant which I am sure they did. I doubt they would even bother trying though because it would be pretty much impossible unless the password is weak.

Well, the FBI might be able to -- for example, they probably have been running massive computers generating billions of giant encryption keys for known algorithms, for decades, in the hopes that they will generate the same ones that people at home do.

The rest is just checking every single key against an encrypted message. However, they wouldn't reveal the contents for a simple court case because that would reveal this strategy.


Someone should write a paper on what percent of the "encryption key space" they could cover in this manner -- do common "generate your own key" algorithms yield an enormously random number of keys such that even a concentrated effort to crank out trillions of them would only cover a vanishingly small chance of a "hit" against a random yokel running such a generator program 1 time?

You can list me as co-author. You're welcome.

[Dan O.]

The cat got out of the bag when strong encryption algorithms became public knowledge

!/usr/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj
$/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1
lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

There are now so many encryption systems out there that the government would have no chance to engineer a back door or weakness into more than a small fraction of the programs. They would have an impossible task of convincing criminals and foreign agents that their special program is somehow better than all the rest. It would have to be something really good like giving their program constitutional protection so that even the courts couldn't compell you to open it or punish you for refusing. They can't go rewriting the constitution so such a plan will never work.

[luchog]

Originally Posted by Dan O.

There are now so many encryption systems out there that the government would have no chance to engineer a back door or weakness into more than a small fraction of the programs. They would have an impossible task of convincing criminals and foreign agents that their special program is somehow better than all the rest. It would have to be something really good like giving their program constitutional protection so that even the courts couldn't compell you to open it or punish you for refusing. They can't go rewriting the constitution so such a plan will never work.

You don't have to go through all that effort to force criminals to use your broken encryption utility; you just classify the unbroken ones as "munitions" (more accurately, Auxiliary Military Technology); and then make it illegal and prosecute people who provide or use it. Once you do that, keys are no longer protected under the Fifth Amendment, but become contraband, subject to seizure; and suspects refusing to provide keys can be prosecuted for possession of restricted technology.

[Dan O.]

Originally Posted by luchog

Once you do that, keys are no longer protected under the Fifth Amendment, but become contraband, subject to seizure; and suspects refusing to provide keys can be prosecuted for possession of restricted technology.

Those g-men will try to take the shirt off your back if they are given the opportunity.

[The Dark Lord]

Originally Posted by Beerina

Well, the FBI might be able to -- for example, they probably have been running massive computers generating billions of giant encryption keys for known algorithms, for decades, in the hopes that they will generate the same ones that people at home do.

The rest is just checking every single key against an encrypted message. However, they wouldn't reveal the contents for a simple court case because that would reveal this strategy.


Someone should write a paper on what percent of the "encryption key space" they could cover in this manner -- do common "generate your own key" algorithms yield an enormously random number of keys such that even a concentrated effort to crank out trillions of them would only cover a vanishingly small chance of a "hit" against a random yokel running such a generator program 1 time?

You can list me as co-author. You're welcome.

With 128 bit AES there are 2^128, or 3.4x10^38 possible keys. With 256 bit AES, 2^256, or 1.2x10^77 possible keys. You do the math. The key is usually generated from a passphrase and a randomly generated salt. Attacking the passphrase will usually be a better strategy than attacking the key. But if a good passphrase is used, it's still not going to happen. If my passphrase is just 15 characters longs and only uses uppercase, lowercase, and numbers that is 62^15 or 7.7x10^26 possible passphrases. Actually, that's if they knew it is 15 characters long and that it doesn't use special characters, which they wouldn't. So the number is much higher.