UK Law Enforcement Trying To Force Man They've Never Charged With A Crime To Decrypt His Computers

from the see-smoke,-presume-arson dept

British hacker Lauri Love stands accused of causing "millions of dollars" in damages to US government computers -- charges he's been facing for more than two years. These charges originate in the US, but it's the UK that's been trying to get Love to give up his encryption keys for the past couple of years.

Under RIPA (Regulation of Investigatory Powers Act of 2000), the UK government can charge Love with "failure to cooperate" by refusing to comply with the order to decrypt files. To date it has not done so, despite Love blowing off its demands since the middle of February 2014.

The only charges Love is facing have been levied by the US Department of Justice. He has fought extradition for the past couple of years and the UK government has yet to make any progress on that front. However, UK law enforcement has stepped up its efforts to force Love to turn over passwords and keys. J.M. Porup at Ars Technica has seen a copy of the request and has more details.

In the NCA's submission to the court, which Ars has seen a copy of, the government demanded that Love turn over the passwords and encryption keys to his confiscated devices. The devices in question include a Samsung laptop, a Fujitsu Siemens laptop, a Compaq computer tower, an SD card, and a Western Digital hard drive. The NCA in particular wants Love to decrypt TrueCrypt files on the SD card and external drive.

This seems like a very severe demand from the National Crime Authority, considering it still hasn't -- despite two years and two arrests -- seen fit to bring criminal charges against Love. This is also its second attempt -- one using a separate legal authority (not RIPA Section 49, as was used earlier) -- to compel Love to comply with its demands.

Meanwhile, Love is (logically) suing the UK government for the return of his devices.

Love's argument in his civil case is that if the police aren't going to charge him with a crime, they should return his property. "The problem is that the NCA are effectively arguing that any information that cannot be read and comprehended by the police has a presumption of guilt," Love told Ars in an e-mailed statement.

As Love points out, equating encryption with guilt has severe ramifications for anyone who uses it.

"This has clear and troubling implications for groups that handle sensitive communications or other data—journalists, advocates, activists and whistleblowers, and members of the legal profession.

"An executive body of the state is saying that any information to which they are not privy... cannot be owned and kept securely but instead confiscated and access denied," Love added. "This is a fundamental reversal of rights and the potential for abuse is alarming."

The NCA claims it wants Love to decrypt his devices so he can prove his ownership of any information or data found on them -- which allegedly includes pirated film and documents obtained (without permission) for US government websites. Love sees this as nothing more than the NCA trying to help out its American counterparts by using the UK's more permissive laws to obtain information about Love's hacking activities. And, it must be pointed out again -- the NCA wants to force the uncharged Love to crack open his devices so it can find something to charge him with.

Maybe there's something incriminating stored on Love's computers. Maybe not. But either way, UK law enforcement is working backwards from a presumption of guilt. And it's basing this all on things it can't see. This belief system is similar to that held by many law enforcement agencies, which have spent much of the last few months claiming an encrypted phone is a "guilty" phone in front of judges, Congress and to members of the media.

Filed Under: decrypt, doj, encryption, lauri love, nca, passcode, ripa, uk, us

Massachusetts Ignores 5th Amendment; Says Defendant Can Be Forced To Decrypt His Computer

from the that's-unfortunate dept

For many years, courts have struggled with the legal question of whether or not law enforcement can force a defendant in a lawsuit to decrypt encrypted files. All the way back in 2007, we wrote about a judge in Vermont finding that such forced decryption represented a Fifth Amendment violation, as it could be considered a form of self-incrimination. However, that was just one court. Other courts have ruled the other way. Not surprisingly, the Justice Department doesn't believe the Fifth Amendment should apply in these situations, but courts still seem to be divided as judges go back and forth on the issue.

Unfortunately, it appears that Massachusetts' highest court has now gone over to the wrong side of the debate, finding that there is no Fifth Amendment violation in forcing people to decrypt their computers. In this ruling, the court said that there was "an exception" to the Fifth Amendment, if the results are a "foregone conclusion." As Cyrus Farivar at Ars Technica summarizes:

That exception, the MSJC said, can be invoked when “an act of production does not involve testimonial communication where the facts conveyed already are known to the government, such that the individual ‘adds little or nothing to the sum total of the Government's information.’”

Of course, that seems like a fairly dangerous "exception." Prosecutors can just claim that such facts are "already known." Furthermore, if the information adds little or nothing, then... why is it even needed? It's difficult to see why anyone should be forced to decrypt information on the basis that... it's not really needed. Here's the key paragraph from the ruling:

When considering the entirety of the defendant's interview with Trooper Johnson, it is apparent that the defendant was engaged in real estate transactions involving Baylor Holdings, that he used his computers to allegedly communicate with its purported owners, that the information on all of his computers pertaining to these transactions was encrypted, and that he had the ability to decrypt the files and documents. The facts that would be conveyed by the defendant through his act of decryption—his ownership and control of the computers and their contents, knowledge of the fact of encryption, and knowledge of the encryption key—already are known to the government and, thus, are a "foregone conclusion." The Commonwealth's motion to compel decryption does not violate the defendant's rights under the Fifth Amendment because the defendant is only telling the government what it already knows.

Given the back and forth nature of so many of these rulings, you have to imagine that it'll eventually end up before the Supreme Court. Hopefully that Court's renewed belief in the Fourth Amendment will extend to the Fifth as well.

Filed Under: 5th amendment, decrypt, encryption, massachusetts, self incrimination