Subpoena for Encrpytion Keys

[AltF4]

Background

In US Law, prosecutors and law enforcement agencies are able to "subpoena" a person for information or objects for evidence in a trial. This not an uncommon thing to have happen in a case where a person possesses evidence for a trial that cannot be otherwise obtained. It is essentially the government saying "Hey, you. Give me that. I need it for evidence in a trial."

For example... If my neighbor shot fireworks illegally every night in his backyard, and I videotaped it, my video tape could be subpoenaed and used as evidence. Or if I were embezzling money from the business I worked at, the accounting records of the company could be subpoenaed.


Question

Should the government be able to order subpoenas for encryption keys for computer hard drives?


More technical background

A computer can hide data by "encrypting" it, which is essentially scrambling the data such that nobody but the holder of the encryption key can read the data. This "key" can take the form of a password or some other number.

So if you want to have data on your computer, but don't want anyone but you to read it, you can encrypt it. What's cool about digital locks and keys is that unlike physical ones, they can't be picked or broken into. There's no way around it. You need the key to open the lock.



Pro:

Some feel that the government should be allowed to subpoena these encryption keys. They tend to draw the analogy between digital safes and physical safes. In current US law, the government IS allowed to subpoena physical keys to safes. They argue, then, that this should be extended to "digital safes".


Con:

This is the side I'm taking.

I believe this to be an instance where the 5th amendment should take precedence. The letter of the 5th amendment reads...

...nor shall be compelled in any criminal case to be a witness against himself...

That one little line is what has lead to the practice of "pleading the fifth". It is also important to note that the courts have ruled (and it is currently enforced as such) that you cannot be compelled to answer questions on the basis that they might produce evidence against yourself. Even if the answer to the question itself is not incriminating.

I think this CLEARLY falls under the realm of the fifth amendment. You are being compelled to answer a question which will be used against you as evidence. You are being compelled to testify against yourself. This is unconstitutional.



Current Court Case

There is a current court case on just this issue that will likely make its way to the supreme court.

The court originally ruled that the subpoena for the defendant's encryption key is invalid, on the basis of the 5th amendment. But it was then successfully appealed. This appeal appears that it will in turn be appealed, snaking its way up the courts.

Opinions? Thanks for reading!

 

[blazedaces]

Very interesting case mate. I'm not 100% sure on my side of the issue yet, but I will play a little devil's advocate in this case.

Can you answer me this: why do you think refusing to hand over a physical key to a physical safe not valid as a fifth amendment plea?

For this same reason shouldn't the physical "handing over" of encryption keys be unrefusable as well?

I feel like you either have to argue that physical keys shouldn't be allowed to be subpoenaed (even though at the moment they are) or you have to concede on the "Con" argument since it's invalid. It's not the asking of a question per say, so I don't see how the fifth amendment strictly applies in this case...

Further more, on this specific case (from your source):

In upholding that appeal, Judge Sessions wrote that the act of producing documents in response to a subpoena can be considered incriminating [highlight]only when the existence of the subpoenaed material is previously unknown to the government or where production would implicitly authenticate the documents.

"Where the existence and location of the documents are known to the government, no constitutional rights are touched,"[/highlight] Judge Sessions wrote, citing a previous case. [highlight]The judge noted the fact that Boucher had accessed the encrypted files in the presence of the customs agent, who then also had viewed some of them and had discovered them to contain pornographic material involving children.

As a result, the government already knew of the existence and location of the files containing the incriminating evidence, he said. Similarly, the mere act of Boucher producing an unencrypted version of his drive is not necessary to authenticate it because Boucher himself has admitted to possession of the computer, the Judge wrote in his five-page ruling upholding the government's appeal.[/highlight]

We can see that the court already has knowledge of not only his possession of said files, but also the incriminating contents of said files. The judge said plainly why this is not in violation of the fifth amendment.

-blazed

 

[AltF4]

Well, I was trying to stay away from the details of that particular court case, just because it has some peculiarities that don't, in general, apply. Like the fact that they already "know" the contents of the encrypted drive, but just want access to it. Or the fact that he previously showed the contents of the drive, but won't do it again now. I just intended to debate the principle of "can a subpoena be issued for encryption keys at all".


But to answer your question more directly: I think there is an important difference between physical evidence and information as evidence.

1) Enforceability. Physical items can be taken by force, information cannot. This means that even if the courts do rule in favor of subpoenas for encryption keys, that there is no way to enforce this law. you cannot force a person to divulge information. Especially not if torture is not allowed! The best you can do is punish someone for failing to comply. Which leads to...

2) Plausible Deniability. I'll spare everyone the technical details of HOW this works and just jump to the punchline. You can encrypt your data in such a way that not only is it unreadable, but it's impossible to even tell if it's there! You can set up a dummy password that you can give out in case someone "forces" to you divulge your secrets.

But instead of getting the real secrets, they'd only get regular mundane data that a normal user would have. And there's no way to even tell that there is more "secret" data hidden at all!

In the face of something like this, how can you even try to enforce these subpoenas?


But strictly in the lines of the law, the 5th amendment is meant to protect information, not physical objects. Your possessions most CERTAINLY can be forced to be used against you in court. However, the information inside your head cannot. There is a distinction drawn, that information in your head is held on a higher ground than others. There is a certain kind of sanctity there.

If the court were able to "crack" the encryption on your disk, sure they could then use the data there. (But this is not always possible) I have no problems with this. Or if they found the key written down on a piece of paper on the guy's desk, sure they can use it. The issue I have is forcing someone to divulge information in their own heads to be used against themselves.

 

[blazedaces]

Well, I was trying to stay away from the details of that particular court case, just because it has some peculiarities that don't, in general, apply. Like the fact that they already "know" the contents of the encrypted drive, but just want access to it. Or the fact that he previously showed the contents of the drive, but won't do it again now. I just intended to debate the principle of "can a subpoena be issued for encryption keys at all".


But to answer your question more directly: I think there is an important difference between physical evidence and information as evidence.

1) Enforceability. Physical items can be taken by force, information cannot. This means that even if the courts do rule in favor of subpoenas for encryption keys, that there is no way to enforce this law. you cannot force a person to divulge information. Especially not if torture is not allowed! The best you can do is punish someone for failing to comply. Which leads to...

2) Plausible Deniability. I'll spare everyone the technical details of HOW this works and just jump to the punchline. You can encrypt your data in such a way that not only is it unreadable, but it's impossible to even tell if it's there! You can set up a dummy password that you can give out in case someone "forces" to you divulge your secrets.

But instead of getting the real secrets, they'd only get regular mundane data that a normal user would have. And there's no way to even tell that there is more "secret" data hidden at all!

In the face of something like this, how can you even try to enforce these subpoenas?


But strictly in the lines of the law, the 5th amendment is meant to protect information, not physical objects. Your possessions most CERTAINLY can be forced to be used against you in court. However, the information inside your head cannot. There is a distinction drawn, that information in your head is held on a higher ground than others. There is a certain kind of sanctity there.

If the court were able to "crack" the encryption on your disk, sure they could then use the data there. (But this is not always possible) I have no problems with this. Or if they found the key written down on a piece of paper on the guy's desk, sure they can use it. The issue I have is forcing someone to divulge information in their own heads to be used against themselves.

I'm fine with ignoring the case. The broader question it brings up is much more interesting.

I'll concede that if it's a password someone memorized in their head, it's divulging information, but would you agree if it's an encryption key stored on a floppy/usb/any other external storage device than handing that over does not fit into the same category?

And the good encryption keys need to be, as they're too complicated to memorize. Then again, unless evidence is presented that proves the person stored it on a physical device, there's no way to know that's true... and to ask them if it's true would indeed violate the fifth amendment (forcing them to answer anyway).

So I would conclude that as long as it's not in your mind, as you point out, then it's fair game. Would you agree?

-blazed

 

[Eor]

Unfortunately I think Alt is right in that it violates the fifth amendment if the encryption is only in their head, and not written down or anything. I don't see any way to bypass that, since any law requiring that, say, "encryption keys have to be stored here or else it's a crime" would be ridiculous and a breach of governments rights. I only think it's unfortunate since, from what I understand, almost all of the cases involving this are child pornographers and terrorist/white collar crime stuff, instead of, say, a teenager who has some downloaded music on his hard drive.

 

[AltF4]

Subpoenas for physical objects are always fair game, so long as they play by the usual rules for subpoenas. It's standard operating procedure for investigators to confiscate computers or other electronic devices for use in a trial. And when the objects are (for whatever reason) too difficult, impossible, or illegal for investigators to obtain themselves, they order a subpoena.

Maybe I should add this to the OP...

There are two kinds of subpoenas:

I only think it's unfortunate since, from what I understand, almost all of the cases involving this are child pornographers and terrorist/white collar crime stuff, instead of, say, a teenager who has some downloaded music on his hard drive.

Regrettable, yes. But you do have to keep in mind that there are lots of laws in place that let murderers and rapists go. They place restrictions on what the government can do to prosecute someone. In fact, when you look at it, there are LOTS of hoops for prosecutors to jump through. And for good reason. We want to make sure the government doesn't step outside of its boundaries. And letting a few bad guys go is the unfortunate price for this.

 

[BFDD]

You keep mentioning the 5th as a defense, but what if the encrypted data is for someone else's trial rather than the person with the key. For instance if a company had encrypted data that could be used against one of their employees, could the court force them to give up the key?

Not necessarily a likely scenario but I'm just curious to see where you would stand.

 

[RDK]

I tend to fall on the side of not allowing the government to break into my head (or torture me) in order to find out what my encryption password is, but what about in the case of child pornography, which was mentioned before? Technically, doesn't that count as physical evidence? Morally, it's the same exact thing if they decided to seize regular old pictures of CP on his desk at home.

Does that really count as just "information"? I mean honestly, the "information" (which is a loosely defined term here anyway, Alt) displayed on a computer screen is nothing more than an electronic representation of physical things--the parts of the computer (hard drive, motherboard, etc.). Yes, the actual content of the computer can be considered information, but to say that it's not physical is bordering on the ludicrous.

If it's not physical, what is it? Meta-physical?

 

[AltF4]

That's an excellent point, BFDD. If the 5th amendment doesn't apply, what then?

Speaking positively in terms of what the law right now would decide... I think it would rule in favor of enforcing the subpoena.

But normatively, in terms of what I think should be the case, I'm going to tentatively say that the subpoena should not be allowed.


So let's set the stage with a hypothetical situation in order to better frame and conceptualize this problem...

Person A is being investigated for a crime. For whatever reason, evidence of his crime is believed to be on Person B's laptop. Person B is in no way under trial. The prosecutors capture the laptop, and then attempt to view the contents. But the laptop is encrypted, and they need Person B's key to read it.

1) Person B could still claim the 5th. He could just as easily claim that he does not wish to provide the key on the basis that it may incriminate him, and he cannot be forced to testify against himself. But this is just a technicality...

2) The value of secrets. Secrets are valuable. We live in the information age, knowledge is power. But more importantly, knowledge is money. It seems morally wrong for someone to be forced to divulge their secrets in this manner. The value of the contents of a laptop which is encrypted is likely very high. And since Person B is not on trial, why should they be punished?


But I'll tell you what SHOULD happen. The encryption keys themselves should not be subpoenaed, but rather a particular piece of information inside the laptop. Person B would be compelled only to provide the information that is seen as "evidence". Not the keys to the whole computer.



EDIT:

RDK, now, now. Let's not mince words. You know I'm not intending to go into some philosophical discussion on whether or not something can be "non-physical". You know perfectly well what I mean.

But I don't really understand what you're trying to get at.

 

[SkylerOcon]

But I'll tell you what SHOULD happen. The encryption keys themselves should not be subpoenaed, but rather a particular piece of information inside the laptop. Person B would be compelled only to provide the information that is seen as "evidence". Not the keys to the whole computer.

I agree with your side and all, but I have to question this. How exactly can we define what evidence is? While in some cases, this may be obvious... in others it could be very vague! What would we do if there's a case where there is evidence on the laptop, but what is being considered as evidence is something that's very kind-of-sort-of-maybe-not-really-possibly evidence? Does the person just not show the evidence?

 

[AltF4]

It would be handled just like a search warrant. You have explicitly list exactly what you're looking for before going in. And it can't be vague, like "something to help my case".

So if my computer were encrypted, and there was a file on it that a prosecutor wanted, they would be able to subpoena me for that one file. But not the key to my whole drive.

 

[RDK]

RDK, now, now. Let's not mince words. You know I'm not intending to go into some philosophical discussion on whether or not something can be "non-physical". You know perfectly well what I mean.

But I don't really understand what you're trying to get at.

I'm just confused as to whether or not the information on a suspect's laptop could be considered evidence in this case. How do they handle that type of situation (I.E., the child pornography example)? If the only thing stopping them from convicting someone is getting past an encryption, wouldn't it be morally justified if they demanded the password, or just broke into the computer?

So if my computer were encrypted, and there was a file on it that a prosecutor wanted, they would be able to subpoena me for that one file. But not the key to my whole drive.

I guess my next question would be, why just one file? Two is not much more than one, and three is not a big step up from two...what's to stop them from jumping from some arbitrary number to the entire content of the hard drive? Or some silly thing like one file less than the whole HD, so they're technically not using the whole drive.

 

[AltF4]

1) Unlike physical safes, proper data encryption cannot be broken into. At least not by any process known to man so far. (but this is a totally different talk)

2) Would it be "morally justifiable" to put a child pornographer behind bars? Yes. But you see, in America we're innocent until proven guilty. You cannot make procedural decisions on the basis that your suspects must be guilty. You have to respect their rights. One of those rights is the 5th amendment.


3) (to your second paragraph) Because YOU would be the one providing the file. A subpoena is not like a search warrant. A subpoena is the court requesting objects or testimony from you. You yourself have to provide the goods. If issued a subpoena for a file on your laptop, you would then come back the next day with a disk with just that one file on it.

 

[Mediocre]

3) (to your second paragraph) Because YOU would be the one providing the file. A subpoena is not like a search warrant. A subpoena is the court requesting objects or testimony from you. You yourself have to provide the goods. If issued a subpoena for a file on your laptop, you would then come back the next day with a disk with just that one file on it.

Except, if the information on your computer is encrypted, there's nothing to stop you from saying, "I never had that file on my computer." or "I had that file but I deleted it."

I'm not arguing that this would happen all the time. I'm sure plenty of witnesses would be quite willing to cooperate with the subpoena. However, if they were going to be uncooperative, I fully believe that the government should be able to subpoena their hard drive and take it without giving them the opportunity to alter or purge the contents.

I'm not sure if this was exactly the line of thinking you were following when you typed the point I quoted. I might be taking what you said the wrong way. If I understand you correctly though, I have to disagree with you.

However, I'm not disagreeing with the general argument you've presented in this thread. I just think that this particular point is illogical.

 

[AltF4]

That's the way subpoenas work normally, though Mediocre.

Subpoenas are letters saying that the court is requiring you to hand over an object. It is different from a search warrant in the fact that YOU have to give up the item. Your compliance is entirely up to you. Of course, violating a subpoena is just like lying under oath. Nobody can prevent you from doing it, but they can punish you if discovered.

 

[Mediocre]

That's the way subpoenas work normally, though Mediocre.

Subpoenas are letters saying that the court is requiring you to hand over an object. It is different from a search warrant in the fact that YOU have to give up the item. Your compliance is entirely up to you. Of course, violating a subpoena is just like lying under oath. Nobody can prevent you from doing it, but they can punish you if discovered.

You're right.

I knew that at one point, but apparently forgot it.

Sorry I brought it up.

 

[adumbrodeus]

Actually, this is a very interesting question.



The thing is, it's not information which directly implicates you in a crime, but it is information which contextualizes other information in a way that implements you.

Though I'm positive it's come up before (pre-computer codes have the exact same legal issue, and I can think of a few other specialized legal cases that have this issue), I'm not really aware of the case law on the topic.

For that reason, I'll suggest that presumably it falls under the 5th because information that you know will result in the contextualization of other information in a way that will damage your case should be held legally equivalent to giving the information itself.

It's unlikely that the supreme court will rule this however, regardless of previous case law. This is because the current supreme court is not in favor of the rights of the criminally accused.


However, the plausible deniability stands.

1) Person B could still claim the 5th. He could just as easily claim that he does not wish to provide the key on the basis that it may incriminate him, and he cannot be forced to testify against himself. But this is just a technicality...

Actually, no, it's not a technicality.

Due to the sheer number of crimes under federal, state, and local laws, a person is in danger of self-incrimination with every piece of information revealed to police. For that reason, it is within the person's best interests to plead the 5th in this case.

No, you do not have to be guilty of a crime, nor do you have to be prosecuted for you to plead the 5th, you merely have to believe that your testimony will hurt your defense if your case is brought to court.

Yes, there are tons of false convictions, hence it's a real concern.


Edit: Here's further information: http://video.google.com/videoplay?docid=-4097602514885833865

But I'll tell you what SHOULD happen. The encryption keys themselves should not be subpoenaed, but rather a particular piece of information inside the laptop. Person B would be compelled only to provide the information that is seen as "evidence". Not the keys to the whole computer.

Which is probably the best situation, I would personally plead the 5th for anything larger then this as a matter of course.

 

[AltF4]

Hey, I thought I'd make a follow up with this topic:

A judge in the case I cited in the beginning of the thread has ruled that the Laptop owner must hand over the encryption key via a subpoena.

This comes as a reversal of the previous ruling. The case is likely to be appealed again, however.

 

[RDK]

Hey, I thought I'd make a follow up with this topic:

A judge in the case I cited in the beginning of the thread has ruled that the Laptop owner must hand over the encryption key via a subpoena.

This comes as a reversal of the previous ruling. The case is likely to be appealed again, however.

This is probably a silly question, but I'm not a lawyer, so here goes.

What would happen if the person being subpoena'd said that they simply forgot the encryption key? Or that they no longer had access to it? Would that fly in court, or would it be interpreted as willfully withholding evidence?

 

[AltF4]

It would constitute a violation of the subpoena. Which, depending on the case circumstances, can involve criminal and/or civil penalties. And it can also constitute ad admission of guilt. It's like destroying evidence: by doing so, you admit that you had something incriminating. And that fact can help to convict whatever it was that you were accused of.

 

[Zero Beat]

Question

Should the government be able to order subpoenas for encryption keys for computer hard drives?

No because the government shouldn't even exist, much less order people around!

But CAN it do that? Sure it can, and it LOVES to. I've had to wipe clean hard drives in the past in order to destroy evidence.

This is probably a silly question, but I'm not a lawyer, so here goes.

What would happen if the person being subpoena'd said that they simply forgot the encryption key? Or that they no longer had access to it? Would that fly in court, or would it be interpreted as willfully withholding evidence?

He might get ruled in contempt of court, but at least he won't be busted on kiddie porn charges. The article says he is stuck. Either either sex charges or contempt charges, I'd take the lesser of the lashings.

I'm not surprised they ruled against him over the 5th amendment, ****ing courts are all corrupted.

 

[RDK]

It would constitute a violation of the subpoena. Which, depending on the case circumstances, can involve criminal and/or civil penalties. And it can also constitute ad admission of guilt. It's like destroying evidence: by doing so, you admit that you had something incriminating. And that fact can help to convict whatever it was that you were accused of.

He might get ruled in contempt of court, but at least he won't be busted on kiddie porn charges. The article says he is stuck. Either either sex charges or contempt charges, I'd take the lesser of the lashings.

I'm not surprised they ruled against him over the 5th amendment, ****ing courts are all corrupted.

So basically d@mned if you do, d@mned if you don't?

Also, what if you go home and delete all the information that might be considered incriminating before appearing in trial again? Will they just check to see if you made any alterations to your computer between then and when you bring in the computer?

Or are we talking about a situation where they already have the computer, and they just need you to give them your encryption key?

 

[blazedaces]

So basically d@mned if you do, d@mned if you don't?

Also, what if you go home and delete all the information that might be considered incriminating before appearing in trial again? Will they just check to see if you made any alterations to your computer between then and when you bring in the computer?

Or are we talking about a situation where they already have the computer, and they just need you to give them your encryption key?

The latter. And zero beat, don't you think that view is just a tad bit extreme?

-blazed