Feds tell web firms to turn over user passwords

Re:Feds tell web firms to turn over user passwords by rdl on Friday July 26, 2013 @07:02AM (#6107552)

Actually the legal standard (in the US) to compel someone to turn over a physical key (and I think combination to a physical safe) is fairly low, relative to information. One of the big debates is whether compelled disclosure of a password is information (high protection) vs. access (low protection). Marcia Hofmann from EFF talked to a few people at Hope for about an hour on the finer points in specific situations.

[ Parent | on HN ]

Re:Feds tell web firms to turn over user passwords by bobwaycott on Friday July 26, 2013 @07:28AM (#6107613)

Well, combinations to a safe are viewed quite differently from a physical key to a lock. Compelling the latter has been viewed as permissible, while the former has not.

Where compelled disclosure of a password falls on that spectrum is, indeed, a matter of debate.

However, this is not the same. This is compelling a company to turn over either a user's password (which the user [debatably] could not be forced to turn over without potential infringement of 5A) or specific technical details necessary to business, security, and privacy operations to help them decrypt an encrypted password.

My examples were specifically not about compelling a person criminally charged or investigated to divulge combinations or produce keys. It was about compelling the safe-makers and key-makers to do the job as an end run around users being unwilling or unable to provide the demanded result.

Tangentially, this revelation makes me think a bit more about the CISPA requirements that were discussed regarding protecting employees from being forced to surrender passwords to their employers. Can't help but wonder if backdoor conversations on that proposal were engineered by executive wishes to be able to compel employers to turn over employee passwords because they haven't been successful with service providers directly.

[edit: mixed up my former/latter statement. added last comment. fixed spelling/grammar mistakes.]

[ Parent | on HN ]

Re:Feds tell web firms to turn over user passwords by derekp7 on Friday July 26, 2013 @07:55AM (#6107693)

I've seen this analogy a few times, that an encryption password is the same as a safe combination. The counter argument is: if a safe contains papers with information that the police can't interpret (either it is in code words, or written in a language for which they don't have an interpreter), can a suspect be compelled to interpret the documents for them?

If not, then to me it would seem that the only password that could be compelled is something like a hard drive firmware boot password, where the contents may not be encrypted but can't be accessed (through normal means) without the password.

[ Parent | on HN ]

Re:Feds tell web firms to turn over user passwords by rdl on Friday July 26, 2013 @02:24PM (#6109665)

The argument is actually whether it's "testimony".

Saying "turn over the physical object used to commit crime" makes turning it over testimonial! But saying "turn over the rifle with the serial number 98980843" is not testimony.

[ Parent | on HN ]