5th Amendment case in Vermont. Computer passwords and child porn

[fultonCoShooter]

The federal government is asking a U.S. District Court in Vermont to order a man to type a password that would unlock files on his computer, despite his claim that doing so would constitute self-incrimination.

The case, believed to be the first of its kind to reach this level, raises a uniquely digital-age question about how to balance privacy and civil liberties against the government's responsibility to protect the public.

The case, which involves suspected possession of child pornography, comes as more Americans turn to encryption to protect the privacy and security of files on their laptops and thumb drives. FBI and Justice Department officials, meanwhile, have said that encryption is allowing terrorists and criminals to communicate their plots covertly.

Criminals and terrorists are using "relatively inexpensive, off-the-shelf encryption products," said John Miller, the FBI's assistant director of public affairs. "When the intent . . . is purely to hide evidence of a crime . . . there needs to be a logical and constitutionally sound way for the courts" to allow law enforcement access to the evidence, he said.

'The forbidden trilemma'
On Nov. 29, Magistrate Judge Jerome J. Niedermeier ruled that compelling Sebastien Boucher, a 30-year-old drywall installer who lives in Vermont, to enter his password into his laptop would violate his Fifth Amendment right against self-incrimination. "If Boucher does know the password, he would be faced with the forbidden trilemma: incriminate himself, lie under oath, or find himself in contempt of court," the judge said.

The government has appealed, and the case is being investigated by a grand jury, said Boucher's attorney, James Boudreau of Boston. He said it would be "inappropriate" to comment while the case is pending. Justice Department officials also declined to comment.

But the ruling has caused controversy.

"The consequence of this decision being upheld is that the government would have to find other methods to get this information," said Marc Rotenberg, executive director of the Electronic Privacy Information Center. "But that's as it should be. That's what the Fifth Amendment is intended to protect."

Mark D. Rasch, a privacy and technology expert with FTI Consulting and a former federal prosecutor, said the ruling was "dangerous" for law enforcement. "If it stands, it means that if you encrypt your documents, the government cannot force you to decrypt them," he said. "So you're going to see drug dealers and pedophiles encrypting their documents, secure in the knowledge that the police can't get at them."

The case began Dec. 17, 2006, when Boucher, a Canadian citizen with legal residency in the United States, was driving from Canada into Vermont when he was stopped at the border by a U.S. Customs and Border Protection inspector. The inspector searched Boucher's car and found a laptop in the back seat, according to an affidavit filed with the court by Mark Curtis, a special agent with Immigration and Customs Enforcement who was called in by the inspector.

Boucher said the laptop was his, according to the affidavit. When the inspector saw files with titles such as "Two-year-old being raped during diaper change," he asked Boucher if the laptop contained child pornography. Boucher said he did not know because he was not able to check his temporary Internet files, according to the affidavit.

Curtis asked Boucher "to use the computer" to show him the files he downloads. Curtis reviewed the video files, observing one that appeared to be a preteen undressing and performing a sexual act, among other graphic images, the affidavit says.

Boucher was arrested and charged with transportation of child pornography in interstate or foreign commerce, which can carry a sentence of up to 20 years in prison for a first offense.

'Nearly impossible' to access files
The agents seized the laptop, and a Vermont Department of Corrections investigator copied its contents. But the investigator could not get access to the drive Z content because it was protected by Pretty Good Privacy, a form of encryption software used by intelligence agencies in the United States and around the world that is widely available online. PGP, like all encryption algorithms, requires a password for decryption.

For more than a year, the government has been unable to view drive Z.

A government computer forensics expert testified that it is "nearly impossible" to access the files without the password, the judge wrote. "There are no 'back doors' or secret entrances to access the files," he wrote. "The only way to get access without the password is to use an automated system which repeatedly guesses passwords. According to the government, the process to unlock drive Z could take years . . . "

In his ruling, Niedermeier said forcing Boucher to enter his password would be like asking him to reveal the combination to a safe. The government can force a person to give up the key to a safe because a key is physical, not in a person's mind. But a person cannot be compelled to give up a safe combination because that would "convey the contents of one's mind,'' which is a "testimonial" act protected by the Fifth Amendment, Niedermeier said .

In a phone interview, Boucher said that he likes to download Japanese cartoons and occasionally adult pornography, but that he does not seek to view child porn. He sometimes inadvertently receives images of child pornography when he downloads the other material, but reviews what he downloads to "clean out" the child porn, he said. It is not illegal to possess animated child porn.

He said that he agreed to show the agents where he downloaded his files "because I was sure that there was nothing bad in those files." He also said that he felt coerced: "I felt like they really want to force me to do it, like I have no choice."

Asked whether he typed in a password to unlock the drive so the agents could view it, he replied: "I prefer not to answer that one."

Boucher added the encryption software to protect the rest of his computer from viruses that might accompany the downloaded files, he said.

Orin S. Kerr, an expert in computer crime law at George Washington University, said that Boucher lost his Fifth Amendment privilege when he admitted that it was his computer and that he stored images in the encrypted part of the hard drive. "If you admit something to the government, you give up the right against self-incrimination later on," said Kerr, a former federal prosecutor.

Lee Tien, senior staff attorney at the Electronic Frontier Foundation, a civil liberties group, said encryption is one of the few ways people can protect what they write, read and watch online. "The last line of defense really is you holding your own password," he said. "That's what's at stake here."

[D-FENS]

Original link?

[sjl127]

I also have a story on my thumb drive, will post it later, about a man coming through customs, and the agents started looking through his files, arguing that doing that is fair game during a search.

Stand by, when I get to work, I'll post it.

[sjl127]

Here it is: My problem is not with the child porn, but the fact that it sets a precedent.

[Joe Smith]

Well, I do have a lot of porn to hide.....




Seriously, this is a very interesting case on 5th ammendment grounds. I had to give my wife a crash course on the 1st, 4th, and 5th the other day wen she was worried about a traffic stop and it was one of the best discussions we have had in a long time.

[D-FENS]

Originally Posted by Joe Smith

Well, I do have a lot of porn to hide.....

Fortunately it's pretty easy to encrypt files/directories/disks in OSX. I wouldn't use File Vault either because it uses the account password. While File Vault may keep the wifey at bay, it's not going to stop The G Men or an inquisitive employer (if relevant).

You can encrypt a directory with Disk Utility or with GNU Privacy Guard. GPG will probably be the better method if you're in a multi-platform environment and encrypting shared directories.

Finally, don't encrypt the entire system disk. You're going to diminish system performance and probably going to screw it all up (no offense, it's really a bad idea though).

Personally, on my work MacBook, I used Disk Utility to encrypt a folder and then created symbolic links to everything I wanted encrypted. It's a lot easier to do this than encrypting the system disk or multiple directories (passphrase to decrypt every instance).

/HAX!

[Joe Smith]

Originally Posted by D-FENS

Fortunately it's pretty easy to encrypt files/directories/disks in OSX. I wouldn't use File Vault either because it uses the account password. While File Vault may keep the wifey at bay, it's not going to stop The G Men or an inquisitive employer (if relevant).

You can encrypt a directory with Disk Utility or with GNU Privacy Guard. GPG will probably be the better method if you're in a multi-platform environment and encrypting shared directories.

Finally, don't encrypt the entire system disk. You're going to diminish system performance and probably going to screw it all up (no offense, it's really a bad idea though).

Personally, on my work MacBook, I used Disk Utility to encrypt a folder and then created symbolic links to everything I wanted encrypted. It's a lot easier to do this than encrypting the system disk or multiple directories (passphrase to decrypt every instance).

/HAX!

The wife won't care, she's in most of the videos.











(good thing she's not browsing right now )



Good ideas. Right now I just use a freeware program to "hide" any folders that I don't want people snooping through. It's good enough security for right now at least, I don't have anything too important on the laptop.

[knight0334]

Never ever keep anything valuable or questionable on your computer. There are storage drives and media that can hold whatever you need to keep, but can be hidden physically.

Regularly re-install your operating system(plus updates) too after a good partition break/recreation and low level format. ...helps keep stuff from building up in hidden places in the PC.

If this guy has junk on his PC, then he deserves the hassle.

As for the 5A, they cant make him do it.. what can they do to him? throw him in jail? If there is something there, he'll be going there anyways. I'd rather have a contempt conviction than a child porn conviction.

[netw0rkpenguin]

Originally Posted by D-FENS

Finally, don't encrypt the entire system disk. You're going to diminish system performance and probably going to screw it all up (no offense, it's really a bad idea though).

I'm sorry that's complete bullshit. Doing so on a linux machine is not for the faint of heart but mine is setup to require a password and a USB key, work windows laptop is setup with PGP and whole disk encryption, any moron can pay for PGP and enable it. Good luck subverting it (yes I know FBI has installed hardware loggers before int he Scaro case).

[CCinPA]

It was my understanding that PGP protection was not as strong as it use to be since 911. The government talked the writer into allowing a back door on all versions cince 911 and the more secure earlier versions are not available, the links for earlier very secure USA versions have been taken down.

Is there anyone who can shed some light on this. My notebook travels with me and I don't bother encrypting it in any was since I always thought all protection had built in back doors for the government.