U.S. Seeks to Force Suspect to Reveal Password to Computer Files

In Child Porn Case, a Digital Dilemma
U.S. Seeks to Force Suspect to Reveal Password to Computer Files
By Ellen Nakashima
Washington Post Staff Writer
Wednesday, January 16, 2008; A01

The federal government is asking a U.S. District Court in Vermont to order a man to type a password that would unlock files on his computer, despite his claim that doing so would constitute self-incrimination. The case, believed to be the first of its kind to reach this level, raises a uniquely digital-age question about how to balance privacy and civil liberties against the government's responsibility to protect the public.

The case, which involves suspected possession of child pornography, comes as more Americans turn to encryption to protect the privacy and security of files on their laptops and thumb drives. FBI and Justice Department officials, meanwhile, have said that encryption is allowing terrorists and criminals to communicate their plots covertly. Criminals and terrorists are using "relatively inexpensive, off-the-shelf encryption products," said John Miller, the FBI's assistant director of public affairs. "When the intent . . . is purely to hide evidence of a crime . . . there needs to be a logical and constitutionally sound way for the courts" to allow law enforcement access to the evidence, he said.

On Nov. 29, Magistrate Judge Jerome J. Niedermeier ruled that compelling Sebastien Boucher, a 30-year-old drywall installer who lives in Vermont, to enter his password into his laptop would violate his Fifth Amendment right against self-incrimination. "If Boucher does know the password, he would be faced with the forbidden trilemma: incriminate himself, lie under oath, or find himself in contempt of court," the judge said.

The government has appealed, and the case is being investigated by a grand jury, said Boucher's attorney, James Boudreau of Boston. He said it would be "inappropriate" to comment while the case is pending. Justice Department officials also declined to comment.

But the ruling has caused controversy. "The consequence of this decision being upheld is that the government would have to find other methods to get this information," said Marc Rotenberg, executive director of the Electronic Privacy Information Center. "But that's as it should be. That's what the Fifth Amendment is intended to protect."...

http://www.washingtonpost.com/wp-dyn/content/article/2008/01/15/AR2008011503663.html?hpid=topnews

I've never heard of the "forbidden trilemma" - the spell checker sure doesn't seem to like it :D

Interesting case - I think the judge made the correct decision.

the next thing will be "dead-man" passwords.

That is to say a program which, if you do not enter the correct password by running the software every X days, either does a security scrub of the encrypted data or re-encrypts it and re-writes it IN PLACE (and probably multiple times) choosing a password that the owner does NOT know. And does so silently so that forensics only see the encrypted files... and you can't help them (not that you won't go to jail for contempt - you will because they won't believe that you don't know the password - but you won't be convicted of a crime).

Also, if you have something, anything, on your computer that you do not wish the state to have, only ever write it on a memory stick... preferably encrypted... then, when you are not using the data, hide it somewhere safe or destroy if the police come knocking... tape a glass vial of acid to the memstick and if there is a raid, pop the memstick out and step on it. Use a strong acid.

I dare the data recovery people to find your data.

Note, I do not support child pornographers... but I do support the right to privacy.