News for hackers. Stuff that matters.
Re:Suspect can’t be compelled to reveal “64-character” passw... by Reelin on Sunday November 24, 2019 @04:09AM (#21619261)
I probably have some holes in my understanding, but most of the responses here seem to miss a few key distinctions.

This very much depends on the jurisdiction. Outside the US, some require you to provide electronic keys unconditionally in which case "I forgot" isn't a valid defense. Some let you off the hook if you forgot, but only if you can convince them that it's really true.

Then there's the US. Here, AFAIU the court can require you to hand over physical objects which it is certain actually exist. Failure to comply is contempt, and most states don't have a maximum for that (https://psmag.com/news/a-most-uncivil-contempt-3464).

For a password that's not written down, "I forgot" is indeed a valid defense here last I checked. Note that it doesn't apply if the court has a convincing reason to believe you were lying, which they would have in this case obviously.

However! It's more complicated that that here. Whether the court can demand things you know (ex passwords) as opposed to physical objects has historically been contentious. The trouble is that the fifth amendment protects you from being required to testify against yourself, and verbally providing a password seems an awful lot like testimony as it will presumably be used to incriminate you. It's gone both ways, and at some point the Supreme Court stated that a password was roughly equivalent to a physical key and so didn't qualify for protection. This ruling goes against (?) that, stating that it's equivalent to incriminating testimony and so can't be compelled.

Re:Suspect can’t be compelled to reveal “64-character” passw... by sjy on Sunday November 24, 2019 @06:21AM (#21619713)
In what jurisdiction is “I forgot” not a valid defence? If you’ve forgotten the password, you can’t comply with a disclosure order any more than if you were unconscious. The law doesn’t normally need to expressly state that it’s not a crime to fail to do something impossible. Of course, if there was evidence that satisfied the judge or jury beyond reasonable doubt that you were lying about forgotting, the defence would fail.
Re:Suspect can’t be compelled to reveal “64-character” passw... by Reelin on Sunday November 24, 2019 @08:16AM (#21620225)
Well now I'm not sure. I'm certain I saw a few reported years ago as assuming you had the key if they could show that you had encrypted something. I looked just now and couldn't find record of such key disclosure laws though.
Re:Suspect can’t be compelled to reveal “64-character” passw... by jki275 on Monday November 25, 2019 @05:51AM (#21626967)
Can you cite the SCOTUS decision that said encryption keys were equivalent to physical keys?
Re:Suspect can’t be compelled to reveal “64-character” passw... by Reelin on Tuesday November 26, 2019 @01:30AM (#21636048)
As disclaimed, it turns out there were holes in my understanding. :)

The Ars article being discussed is actually where I read that. However, upon attempting to find the original case it looks like SCOTUS hasn't yet heard such. From this Lawfare post, (https://www.lawfareblog.com/fifth-amendment-decryption-and-b...), SCOTUS Fisher v. United States is relevant but doesn't actually involve passwords. Also from that page, the Eleventh Circuit seems to think that government knowledge of incriminating device contents permits forced decryption while the Third Circuit argues that merely knowing you possess the password is sufficient.

In both cases the precedent is that you can be forced to turn over a password; it's only the details of the prerequisite government knowledge that are under debate. As far as I can tell, the current PA case goes against that.

Referenced PA Supreme Court case: https://law.justia.com/cases/pennsylvania/supreme-court/2019...

Related PA Superior Court case that was appealed: https://law.justia.com/cases/pennsylvania/superior-court/201...

Re:Suspect can’t be compelled to reveal “64-character” passw... by jki275 on Tuesday November 26, 2019 @08:02AM (#21637870)
Yes - there has been no SCOTUS decision on this. The current circuit split between 3d and 11th circuit will probably put a case in front of SCOTUS eventually.
Re:Suspect can’t be compelled to reveal “64-character” passw... by Reelin on Tuesday November 26, 2019 @08:41PM (#21644576)
The EFF seems hopeful (https://www.eff.org/deeplinks/2019/11/victory-pennsylvania-s...) that an even larger split might arise due to this PA case in addition to a couple pending elsewhere. IMO ideally passwords should receive complete and unconditional fifth amendment protection.
Re:Suspect can’t be compelled to reveal “64-character” passw... by jki275 on Wednesday November 27, 2019 @07:59AM (#21647439)
I agree that passwords are testimonial in nature and should be fully protected, but I have no idea which way SCOTUS will go. There are a lot of things where one can with some reliability predict the general outcome of a case at that level due to previous rulings and precedent -- this one I just don't know that anyone has a good idea which way they'll go.