Thankfully, the USA still has a fair amount of really strong legal protection from the bill of rights (1st-10th amendments). The 5th amendment protects US citizens from being forced to reveal their encryption keys.

Forced key disclosure with sentencing for failure to disclose (like in the UK) is particularly odious. If I have a hard drive full of random data, the UK government can imprison me for up to five years just by accusing me of terrorism or child pornography possession and demanding that I turn over the key to the hard drive. They don't have to prove that I did what they're accusing me of, or that I even have a key.

In the UK, if you can meet the evidential burden to raise the issue that your hard disk is in fact full of random data, then it must be proved beyond reasonable doubt that that is not the case. In other words, unless you aren't even permitted to use that as a defence, the prosecution does actually have to prove that you have a key. Now that we have some experience of successful RIPA prosecutions, the smart advice appears to be 1) don't claim to have created a key that you refuse on principle to turn over, or 2) to have created a key that you've since forgotten: you will be asked how long it is – if short, it won't be reasonable to have forgotten it, if long, unreasonable not to have recorded it elsewhere. Basically don't admit to use of encryption unless you're capable of producing a key.

> you will be asked how long it is – if short, it won't be reasonable to have forgotten it, if long, unreasonable not to have recorded it elsewhere.

Bullocks. Just yesterday they replaced the keypad on a door I've used a hundred times before and I completely blanked on the combination. It was the same 4-digit number it was before but the keypad was different and that was all it took. On the other hand, the passwords for the computers are 14 random characters, and nobody ever wrote them down because a) they were explicitly forbidden to and b) everyone used them so often they didn't need to. Except that half the time anyone would go on vacation for more than a week they would forget and have to beg the backup admins to restore their home directory because the local data was encrypted but the backups weren't.

The idea that it isn't "reasonable" for people to do these things is belied by the fact that they regularly do. And having the police break into your house and turn your life upside down by carting off with half your stuff is exactly the sort of shock that will interfere with your ability to remember.

They aren't calling it unreasonable because it's unreasonable, they're calling it unreasonable because they'd rather put innocent people in prison than let guilty people go. The prosecutor is willing to lie about what is reasonable and the judge is willing to believe the lie. But at that point it doesn't matter what you actually do because facts and logic are no longer in play. They're just making things up. If they don't get you for not providing your encryption key then they'll just make up something else for you to be guilty of.

> The 5th amendment protects US citizens from being forced to reveal their encryption keys.

IANAL, but it does not. It protects against self incrimination. They can make you incriminate someone else just fine, and if you try to object on 5th amendment grounds they can grant you immunity to whatever they might find there.

> The 5th amendment protects US citizens from being forced to reveal their encryption keys.

This is far far from decided or well settled. I can think of countless instances where it is likely false.

I wonder, though, if your key were a confession to a crime you did actually commit (perhaps you stole a pack of gum) and you cannot be compelled to testify against yourself, how would that turn out?

This has gone both ways so far in cases in the United States[1]. One of the fundamental questions is whether or not you giving up the key is testimonial or not. There is a litany of things which have been held to not be testimonial, and thus not implicated by the 5th amendment, including giving up your saliva, blood, fingerprints, standing in a line up, etc.

The really interesting legal question to me is as neuroscience advances, it is likely in the near future that scientists may be able recover one's key (or other relevant information regarding crime) through studying one's brain by imaging or the use of other sensors. Under current case law there is a really really good argument this would not be testimonial (i.e. it is similar to taking your fingerprints or blood), yet provides the same information they could obtain by compelling your testimony.

Does the 5th Amendment prohibit the government from scanning your brain to obtain information about a crime? I think there is a significant number of judges who would find under current law it does not.

[1] http://en.wikipedia.org/wiki/Key_disclosure_law#United_State...

They will grant you immunity from the shoplifting charge, or make that confession inadmissible

"The 5th amendment protects US citizens from being forced to reveal their encryption keys."

Tell that to Ladar Levison. ;)

"I forget"

Is forgetting (or losing) the key a crime?

"I never expected this to happen. I can retrieve the keys but the procedure to do so requires my presence at my solicitors in Zurich."

That might fall into the too clever by half bucket; but if you set it up now; you can claim it was intended for protection from criminals.

In the UK, yes. In the US, yes, if they can show evidence that you should know the key.

I knew the key, but now I forgot. What now? Put me in jail for a faulty memory?

I knew the key and would readily input the key frequently in the past so that I could access my information, but now that you want that information I have conveniently forgotten the key.

Yes, they would put you in jail, but more for being a bad liar than for having a faulty memory.

What if you used it before, but not like yesterday? What if you last used it a month ago? A week ago? What is "frequently", once a day? Once every two days? Once a week?

Yes. Contempt of court.

It works for so many Presidents and Congressmen though!

Honestly, if I have a 32 character master-password on a strip of paper in my wallet and I just happen to lose my wallet before I get raided, then I'm pretty sure that I could show that I simply don't know the key.

The hard part would be to prove that you "just happened" to lose your wallet before you got raided, rather than disposed of it in expectation of the raid. Or that the whole story of that being where the key was is true, in the first place.

Isn't the burden of proof on the police to prove that you are lying? So if neither side has proof it must be assumed that you did indeed just happen to lose it.

It's also on you to tell that story convincingly.

Because realistically would you write down the pass key in only one place? That's all of your data after all. Your livelihood if you're a developer etc. You may get asked what sort of things losing that password has cost you, if you're the sort of person who has that level of security that probably means you're locked out of all sorts of other systems (thanks to now not having access to private keys) so they can be subpoenaed to see if you've managed to log into your hosting account recently despite not having the private key to do so. And if you magically have preserved your private keys elsewhere why should you be believed that your passkey solely exists on a piece of paper in your wallet...

What about your friends, co-workers etc who might be compelled to testify as to having seen you work on your computer and have never seen you get your wallet out at any point.

And as soon as that isn't believed all other testimony you may give is tainted because you've just lied to the court. Good luck with any mitigation in the event of a guilty plea as well because you've demonstrated you haven't acted in good faith.

Yes, but "proof" in the legal sense isn't mathematical/logical proof; even the criminal "beyond a reasonable doubt" standard does not involve elimination of all doubt: a fairly typical jury instruction [0] on the standard says of reasonable doubt that "[i]t is such a doubt as, in serious affairs that concern you, you would heed; that is, such a doubt as would cause reasonable men and women to hesitate to act upon it in matters of importance."

[0] https://www.jud.ct.gov/JI/Criminal/part2/2.2-3.htm

I think part of the problem with these discussions is that there are countless cases where the police won't stop just because there's a law that says so and so.

They often work hard to find workarounds or ways to charge you with other things to punish you anyway. The most obvious example is being innocent until proven guilty, and yet there are a lot of cases where the police shot someone to death because they raided the wrong home for example (which is why the tool is called SWATd I believe)

No. But if you say "I forget" and "they" don't believe you and a judge/jury doesn't believe you then you can likely be convicted and imprisoned for perjury and/or criminal contempt.