The immediate thought that comes to my head when they say this is: Then whats the problem? You can prove it, so why do you need more proof? Unless your possibly maybe your case isn't rock solid or you want to find more crimes.
Your reasoning invalidates all searches, all warrants, and it's everywhere in this thread, it's insane.
I'm all for security, privacy, encryption, Tor, but if the police have a strong enough reason to think I'm committing a horrible crime, and have convinced a judge to sign off on it, then yeah absolutely they should be allowed to search my computer. I don't get to say "Joke's on you g-man, we both know I'm a criminal and the evidence is right here and I can get into it, but I won't let you in until you've cracked my secret code!" The alternative is for them to just always assume encryption/Tor == criminal. The point is they can search /when they have a very good, explicit reason given to a judge/, not go on fishing expeditions or passively collect everything. You probably will lose your privacy for a little while if you're a reasonable target in a serious police investigation, that's always been the case, and it always will be.
It'd be akin to the police coming across a written document in rot13 and jailing you indefinitely until you show them how to decrypt it.
What if it turns out to be a grocery list and you used rot13 just as a matter of course? You went to jail over a grocery list?
I don't think you can compare searching a house to forcing the decrypting of the hard drive.
I run my own XMPP server to keep in contact with a few people (1 friend in china, and my gf during the day). I absolutely encrypt all of it, you're telling me it's ok for them to jail me indefinitely because they believe I've said something in the logs that I shouldn't have.
And that's bullshit, there are legitimate reasons why people encrypt things.
And no, none of your examples are appropriate. If the police could prove you had a grocery list had all of the items used in a crime and could tie you to it, went to a judge, got a warrant, and ordered you to turn over that list, you'd have to do it. If it's encrypted in some scheme you have to show them the real data. It's not the cops' job to work their way around every weird little obstacle you put in their way when they have a lawful order requiring you to hand over information.
In your scenario, if they had a warrant for your grocery list or XMPP server data, you wouldn't be "jailed indefinitely", you'd be jailed until you complied with a lawful order to turn over the data you possess. I don't know where you got the idea you'd be jailed indefinitely because of the content of the chats, that one came out of nowhere. If they discuss crimes you've committed you'd be jailed for those crimes, not indefinitely. After you turn over the logs. If you refuse you're breaking the law. If you don't have access, you can go ahead and try to prove that to the judge, or convince the judge you forgot your password. But the police can provide evidence to suggest you DO have access, you are just willfully refusing to give it up. Like, e.g. logs of you accessing it successfully, recently.
Yes there are legitimate reasons people encrypt things. I encrypt everything, all the time, just for the sake of doing it. I use Tor for my fairly mundane browsing all the time because I value my privacy.
But encryption does not mean "I never have to give anything to the authorities, under any circumstances, no matter what, and there can't ever be any consequences for me if I refuse when they go through proper channels and ask". Encryption does not mean you don't have to comply with the law.
When you start using such bullshit, outlandish arguments, you've lost the point.
> In your scenario, if they had a warrant for your grocery list or XMPP server data, you wouldn't be "jailed indefinitely", you'd be jailed until you complied with a lawful order to turn over the data you possess.
They have the data. What they don't have is an ability to interpret the data, but they most definitely have been given the data.
If that's really your measuring stick, then they need to let this guy go because they have the data in their possession.
What next, we're going to jail someone indefinitely (oh I'm sorry, not indefinitely, just "until they comply"...) because they refuse to read off their grocery list, which they wrote down in french because the police can't find someone else to read it for them?
no, fuck that, it's all splitting hairs.
"We don't want him to give us the password, just force him to unlock it for us, so it's totally not the same thing!".
Right...
Oh also.... you're wrong about the warrant point.
http://criminal-law.freeadvice.com/criminal-law/arrests_and_...
> Actually, the police might not be able to search anywhere just because they have a search warrant, there is a requirement that a warrant describe specifically the place to be searched and the items to be seized. Although it is possible that a warrant will give police a general license to search anywhere in a home, it is also possible that the search might be limited to specific areas in the home.
Maybe you live in a different country, but in the US it's typically understood that a warrant is meant to be specific to avoid the issue with police getting a warrant to look for a stolen bike and going through your toilet looking for hidden drugs.
> The man will end up in prison anyway
But may actually end up longer in prison for contempt of court.
To me there is a big difference between a guy who found some on the internet and someone who produces or pays for it.
I would be wary of putting in minimum sentencing for such crimes unless it was only targeted towards those producing/paying as you can reach murky area's. Two i can think of off the top of my head would be finding images inside someone's browser cache who browses a site like 4chan where people will post it randomly.
That and art, if someone draws child pornography is that a crime? If blizzard says one of their overwatch characters is 17, are the people who make those animated porno videos making child porn? And are the people watching it consuming child porn?
If you have child pornography the law considers it the same as taking the photo and you can be sued civilly by the victims.
People love it when lawmakers make more laws.
The answers to these questions are obvious: no and no.
If the answers are any different or short of being absolute, then that's a clear hole in the first amendment.
Tell that to Chris Handley [1]. He imported a pornographic comic book from Japan, a postal inspector got his panties in a bunch over it, and a prosecutor pushed for 15 years in prison and life as a sex offender unless he plead guilty.
Knowing he'd probably lose in front of a jury of his peers [2], and being blackmailed with the threat of 15 years, he took a plea for six months in prison. Wasn't even afforded the right to a fair trial.
Oh, and it's not just pictures, either. Textual, fictional stories can be "obscene" as well. It is possible to write a fake story in a Hacker News comment that can get you 15 years in federal prison in the US.
[1] http://cbldf.org/about-us/case-files/cbldf-case-files/handle...
[2] it's deemed "obscene", which is a magic "get out of Free Speech free" card, so it falls under the Miller Test. You could get a jury in a very deep red county to find two fully-clothed males kissing as "obscene" if you wanted. "Obscenity" is the thing that needs free speech protections the most.
Agreed.
I'm even of the mind that mere possession of any piece of media cannot be properly regarded as criminal, precisely because it interferes with the far more important right to free speech.
It seems to me that prohibiting the creation or sale of child porn is more appropriate.
But then you have cases like Handley where cartoons are criminalized (which I consider to be a thought crime), and cases like this story where it's used to basically eviscerate the fifth amendment ... and it really makes it clear: you cannot have exceptions to free speech, or it will continue to grow and gut everything else. It's not a "slippery slope" argument ... the slope has already happened -- we're seeing it right now. An appeals court just said you can rot in jail for the rest of your life if you forget your password. And they're going to get away with it because of the horrific spectre of CP ( parodied well here: https://www.youtube.com/watch?v=sdu4wSBZqMM )
As much as I abhor the content, I really believe prosecutors should be going after the producers, the sellers, the people collecting ad revenue off of hosting this stuff, and of course, the actual abusers themselves.
I'd like to see the people with paraphilias they didn't ask for have access to proper counseling, access to anti-androgens, etc.
But we don't live in a country that wants to help people. We live in one that wants to punish people -- even if that results in more victims.
I partially disagree with this. I think it should only be a problem if it's actually real, and can be proven to be, and thus can be proven to have an actual victim. And that victim needs to actually be a child.
In today's age of Photoshop and life-like realistic rendering programs, it's entirely possible to create stuff that looks real, and really isn't. It's also possible for models/actors to look less than 18, while not really being that young. How do you tell for sure that a person in an image is 17 years and 364 days, and not 18 years? Pretty soon, the rendering technology will be so realistic you'll be able to create movies with fake humans that look entirely real. So if someone buys this software and makes some naughty stuff with it, why should they get in horrible trouble and spend decades in prison, when someone else can buy the same software, buy the same digital assets of child models (which aren't really real children, just fake but realistic looking children), and then make movies of these "kids" being slaughtered by dinosaurs or mowed down with machine guns or something, and that's perfectly OK?
The bottom line is: victimizing innocent people should absolutely be illegal and punished. Anything which doesn't victimize an actual person should not.
His argument was that if someone downloaded illegal materials like cp and his network was password protected, they would argue that it had to be him (when we know this isn't even remotely true as software people).
The thing is, I kind of dismissed it and then several years after reading that I came across an article that just floored me. A cop was accused of accessing cp evidence repeatedly (presumably for himself). The article quoted the chief of police as having said "we know it was him because he used his password to log in and it's IMPOSSIBLE for anyone else to have gotten into it".
I've emphasized the word impossible.
I went home that night and opened up my home wifi and I've ran it that way ever since. The idea that a police chief would believe it's impossible for anyone else to get into an account because it's password protected is about some of the scariest shit I can imagine.
And what's scarier in my mind, is how easily people are swayed. Look at how many people are arguing that it's ok to jail this guy indefinitely for refusing to give the police a password. And they BUY the argument that because the police are only asking him to perform an action (enter the password) and not actually give them the password it somehow changes anything instead of it being bullshit hairsplitting by officials.
I'm not really a tin-foil hat sort of person, but the people who can buy that without blinking are a part of the reason why we can't have things like free speech, only acceptable speech.
You may enjoy Chris Morris in this Brass Eye special "Paedogheddon":
https://www.youtube.com/watch?v=RcU7FaEEzNU
(if you enjoy absurdism and black comedy -- I find absurdism to be an especially good fit for satirizing the Kafkaesque)
While I agree in principle with the sentiment, by calling it "piece of media", you presume it to be something inert.
Stepping outside the context of obscenity for a bit, code is data and data is code. It used to be (50-100y ago) a reasonable valid argument that any media is "just words" or images, unable to hurt anyone/thing unless interpreted and acted upon by human volition. However in today's information technology-enabled society, we have automated systems and machines that will consume the data on a piece of media, and automatically perform real-world actions that have large consequences and may hurt people.
Weaponized exploit code (etc) can exist on a piece of media, and you can imagine how a rule that "mere possession of any piece of media cannot be properly regarded as criminal" can somehow always be wrangled into a loophole that abuses this rule. Information is a very weird and fluid beast, just look at the oddities around "illegal primes" or "coloured bits", to see where computational science and law collide.
I believe that our old intuitions about the fundamental nature of "information" are being challenged in a way. I don't have solutions or answers, either. I want the freedom too, but saying it's "just information" on a piece of media is a bit too quick.
Any person who, in a circumstance described in subsection (d), knowingly produces, distributes, receives, or possesses with intent to distribute, a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting, that (1) (A) depicts a minor engaging in sexually explicit conduct; and (B) is obscene (...) or attempts or conspires to do so, shall be subject to the penalties provided in section 2252A(b)(2), including the penalties provided for cases involving a prior conviction. It is not a required element of any offense under this section that the minor depicted actually exist."
Those two words are hiding a lot. For example, it's probably not obscene in Oregon, since part of the Miller test defers to state law and we have a stronger state equivalent of the 1st amendment in our state constitution that would allow it.
And if you wrapped it in a story(like a manga or comic), it would be easier to argue that it has literary or artistic merit. Though, a "states' rights" argument would probably be more likely to succeed.
I was more speaking to the question, "is it a crime?" IE, is it a crime in any sort of common-law sense and the proper purview of a government in a functionally free society.
In that sense, I do not believe that the wholesale fabrication of any form of media is a crime.
Had she not responded when the guys lawyers contacted her, the accused would've gone to jail for child porn.
That's how insane and scary these laws are. I'm all for coming down hard on someone for having cp, but it wasn't cp, just a young looking actress.
Also think of the children.
[1]http://www.salon.com/2016/08/24/private-prisons-are-not-the-...
This makes it sound more like it's a fishing expedition for evidence to use in other investigations, or to find evidence for a more severe punishment, both of which one can morally agree or disagree with, but is it how justice should work? I honestly don't know, but I think probably not.
It's a detestable crime, which is exactly why we must not allow the law to be bent out of shape because of that, as the results will be used in other cases where our moral compass maybe wouldn't sway our judgement as much.
The only justice we can enact, flawed at rational reasoning as we are, is a dispassionate justice. One where we as much as possible defer to the few rational facilities we have. Weak, but nonetheless, logical and rational thinking, is what we must base our arguments upon, as we are so easily swayed by our instinct to protect our children at any cost, often with little regard to what consequence it might have in a distant future.
The less emotive case would be the hard drive contained bank statements for tax avoidance - and I would still think that a court should be able to compel someone to produce that.
If that's the case the files aren't needed, they want to see the drive contents on the off chance of finding some other evidence.
It's a foregone conclusion technically that the illegal content is on the hard drive. His guilt is not a foregone conclusion (not in the US anyway).
If you visit https://www.justice.org/sections/newsletters/articles/fifth-... and search for "foregone conclusion" you will get some good info.
The file hashes basically takeaway any good self-incrimination argument he could make and there might also be evidence of further criminality on the hard drive.
Sorry, but legally, the latter should be the only standard of truth. If he exposes himself to a higher standard of guilt, then he is incriminating himself.
To my mind private spaces (be that my house or my hard drive) should have some protection, but it seems reasonable that that is less than my personal freedom.
I have no issue with a warrant being issued on a balance of probabilities basis in order to find evidence to convict a person based on beyond a reasonable doubt.
And all this ignores the possibility of discovering further crimes and accomplices by investigating the contents of this drive - if there is a balance of probabilities likelihood of find those on the drive I don't see any problems with compelling this to be revealed.
The problem with this is it isn't consistent with how the law works in other cases. For example, A judgment of 'guilty' is considered absolute, not probabilistic.
then prosecute him and be done with it. Anything else is either a fishing expedition or we don't all agree that the files are definitely on the system... in which case it's still a fishing expedition.
hashes can be inaccurate, it isn't a foregone conclusion in reality, just in their opinion.
Not really, no. The chance of multiple hash collisions on a set of arbitrary images is a near impossibility.
I told this story before, but I once read an article about a police officer who said it was impossible for another person to have logged into an account because it was password protected, when we know that's not even close to being true.
impossible and improbable are not the same thing, and I sure as shit don't feel comfortable making the case that it's 100% locked in because of a hash.
The requirement should be for them to look at the actual content, not the hash.
That's not even the same realm as this case:
> The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash” values to be child pornography[0]
Thousands of hash collisions would require prior knowledge of the values and a concerted effort to deceive. It would be more realistic to say that human perception is broken when looking at the media than it is to argue with the mathematical reality at play here.
> The requirement should be for them to look at the actual content, not the hash.
Refusing the evidence known to exist and definitely covered by probable cause is why the defendant is still in custody.
[0] https://arstechnica.com/wp-content/uploads/2017/03/rawlsopin...
So using the law to defend yourself doesn't really apply here.
> Thousands of hash collisions would require prior knowledge of the values and a concerted effort to deceive. It would be more realistic to say that human perception is broken when looking at the media than it is to argue with the mathematical reality at play here.
This confidence is why my anecdote applies. That confidence is flat out scary when you hear people in law use terms like "impossible" or "virtually impossible" when speaking about things that are not.
To me the danger is, what if this person committed other crimes and by unlocking the drive he give the prosecution info about those crimes. In a world where the investigators and/or prosecution have gotten away with parallel construction I wouldn't expect them to play fair. I mean, realistically it sounds like they guy is guilty as sin. That being said, I'd rather he get away with those hypothetical crimes than we start allowing situations like this to happen.
So, to recap, make him unlock to read the known files (by exact path) and nothing else on the drive.
So I am of the opposite opinion. If the hash information isn't enough to try him with, then I'd rather he go free, than set a precedent that it's acceptable for a court to compel someone to decrypt information because someone in law enforcement just "knows" the evidence is there. Because once this order is allowed to stand, the level of certainty required to compel decryption is going to continually be lowered.
I'm sympathetic to why you'd be cautious, but that's not fitting in this case -- this is a highly specific case with a number of circumstances that meaningfully differentiate it from the generic case of providing decrypted media. He's guilty and the checksums are enough to convict him (we're talking many checksums, metadata, partial confessions) and this is about him frustrating the discovery process.
> Because once this order is allowed to stand, the level of certainty required to compel decryption is going to continually be lowered.
This is a slippery slope fallacy. I had some leaning towards this perspective, but then I read the source document, which goes into far more detail. There's a definite nuance to this case.
The FBI gets a warrant, executes a raid, picks up every piece of electronic equipment in the place, but can't find the files the ISP says should be there. Can the defendant, in this case, be compelled to decrypt an encrypted hard drive file or partition at this point, because law enforcement "knows" that those files are somewhere in his (digital) possession? What if it were a guest in his house? What if it were the neighbor, stealing wifi?
Based on this precedent, I think another judge could find reasonable cause to compel in that scenario. Is this a violation of the 5th Amendment? The defense FOR the judge's actions in this case -- based on other reasoning in this thread -- is that only files with those hashes could be used against him, at this point. In this hypothetical case, though, what if LE found OTHER files of child pornography? Would they be admissable? Alternatively, if they found other material (e.g, bomb-making), could it be used against him in a separate case? I'm not sure I trust the government in either one of these situations.
It seems highly likely that we'll get a government employee's opinion on precisely this scenario someday, and I don't think that this employee is going to find in a manner against his employer. As with so many other of the Constitutional protections of the Bill of Rights, they've slowly been chipped away in precisely these kinds of legal "corner cases." Sue me for being paranoid.
Have we not spent the past couple of years confirming that the "slippery slope" of catching "bad guys" has, in fact, completely eliminated the protection of the 4th Amendment for communications? You could argue that it hasn't, because the government hasn't prosecuted a citizen based on the warrantless, wholesale monitoring of any and all electronic communications -- THAT WE KNOW OF -- but it's extraordinarily clear that shouldn't be happening in the first place, according The Constitution.
If you haven't done so, check out the source document for the article as Arstechnica didn't include some important details (and the headline "Man jailed indefinitely for refusing to decrypt hard drives loses appeal" talks past what is actually happening): https://arstechnica.com/wp-content/uploads/2017/03/rawlsopin...
> ...but what if an ISP reports that files with those hashes have been downloaded by a particular IP address? ... but can't find the files the ISP says should be there.
I think this case is particular due to the lack of breaks in the chain. In your hypothetical, law enforcement and the prosecution have _vastly less information_ than in this actual case.
Law enforcement knew the path from a remote source, to (presumably dhcp lease based) ISP records, to the laptop that accessed the content (known to be the defendant's), to checksums in logs matching a physical drive (also known to be the defendant's). Coupled with other evidence, the defendant frustrating the process by pretending to no longer know the decryption phrase, and partial admissions of guilt by the defendant, this is a vast distance than a hypothetical case of "someone from this IP address downloaded Game of Thrones Season 1 from bittorrent, so hand over anything that can store bytes" (to use a far less disgusting crime to help keep emotion away from the discussion).
> Based on this precedent, I think another judge could find reasonable cause to compel in that scenario.
Luckily, the US justice system is built on nuance; this case wouldn't hold up as a generalizable excuse to compel decryption -- which is why they're invoking the foregone conclusion rule to secure the production of evidence based on the enormity of the other factors.
> In this hypothetical case, though, what if LE found OTHER files of child pornography? Would they be admissable?
I honestly don't know. In this case, the defendant is refusing to provide (multiple pieces of) evidence that is known to exist by checksum and direct file path.
> Alternatively, if they found other material (e.g, bomb-making), could it be used against him in a separate case?
Having information on how to construct a bomb is not illegal, any more than getting a degree in chemistry is illegal, but plotting to kill people with a bomb is legally actionable.
> I'm not sure I trust the government in either one of these situations.
I agree with you, but on a different shade of the argument. I'm suspicious that the ecosystem of justice is built on securing convictions as opposed to seeking objective truths. In this case, I support the government/court based on the information I have.
> As with so many other of the Constitutional protections of the Bill of Rights, they've slowly been chipped away in precisely these kinds of legal "corner cases."
I don't know which other cases to which you're referring, but the argument to be made here is that this isn't a corner case. This is having mathematical certainty that the defendant has evidence and is refusing to hand it over.
> Sue me for being paranoid.
No law against being paranoid :)
> but it's extraordinarily clear that shouldn't be happening in the first place, according The Constitution.
Actual question: where in the constitution is this clearly stated?
You're obviously way more legally savvy than I am. Just goes to prove that a _little_ knowledge is a dangerous thing. Totally agree on the "securing convictions" motivation.
I'm referring to the 4th, about needing a warrant to intercept communications. Is that not clearly stated? Maybe my ignorance is showing again. Doesn't the 4th -- on the face of it -- preclude any system of wholesale collection of electronic communications?
Oh no, don't feel that way. The law is a man-made thing at the intersection of logic and opinion, which is why there's so many laws and tests -- if you haven't read the source document that's linked in the Arstechnica article, I would, as it has a lot of important detail.
> I'm referring to the 4th, about needing a warrant to intercept communications...Doesn't the 4th -- on the face of it -- preclude any system of wholesale collection of electronic communications?
Law enforcement were specifically targeting traffic expected to have child pornography and the people trying to exchange it on freenet who join very-special-purposed groups. Peer-to-peer platforms depend on people being free to join, and having special-purpose groups really helps with the "probable cause" condition of the 4th.
On the back of that, the defendant gave them confirmation of his illegal acts, so this case is about recovering evidence known to exist.
If you don't like the process, that's a different conversation.
That said, personally I don't buy it. What if there's evidence of other illegal acts on the drive too, ones the police don't know about? Then decrypting the drive would definitely be incriminating because it would tell police about the other illegal stuff, stuff which fails the "foregone conclusion" test.