Man To Spend 180 Days In Jail For Turning Over Non-Working Password

from the inadvertently-building-up-time-served-credit dept

The protections of the Fifth Amendment are running up against technology and often coming out on the losing end. Court rulings have been anything but consistent to this point. So far it appears password protection beats fingerprints, but not by much.

It all comes down to the individual court. Some view passwords as possibly testimonial in and of themselves, and side with defendants. Others view passwords as something standing in the way of compelled evidence production and punish holdouts with contempt of court charges.

That's what's happening to a Florida man suspected of child abuse. He claims he's given law enforcement his phone's password already, but prosecutors claim the password failed to unlock his phone. They believe his phone holds evidence of the physical abuse alleged -- a claim that seems a bit less believable than those made about child porn viewers and drug dealers.

The court, however, has sided with prosecutors.

A Hollywood man must serve 180 days in jail for refusing to give up his iPhone password to police, a Broward judge ruled Tuesday — the latest salvo in intensifying legal battles over law-enforcement access to smart phones.

Christopher Wheeler, 41, was taken into custody in a Broward Circuit Court, insisting he had already provided the pass code to police investigating him for child abuse, although the number did not work.

All that can be said for certain is prosecutors still don't have an unlocked phone. As prosecutors and this judge see it, the only explanation is that Wheeler lied. That earns him six months of jail time. Maybe Wheeler should have said he couldn't remember.

As Wheeler was jailed Tuesday, the same issue was unfolding in Miami-Dade for a man accused of extorting a social-media celebrity over stolen sex videos.

That man, Wesley Victor, and his girlfriend had been ordered by a judge to produce a pass code to phones suspected of containing text messages showing their collusion in the extortion plot.

Victor claimed he didn't remember the number. He prevailed.

This would be the same judge who determined turning over a password had no Fifth Amendment implications. However, the court found it plausible the defendant might not be able to remember the password to a phone he'd last used over ten months ago. But the ruling doesn't necessarily say the defendant is telling the truth. It only goes so far as saying it's almost impossible to prove he's lying. Given the gap between the phone's seizure and the demand for a password, it's a plausible claim.

His co-defendant made no such claim. Like Wheeler above, Victor's girlfriend handed over a password but it didn't work. The court has asked her to explain why. Given the judge's earlier Fifth Amendment determination, it's safe to assume Hencha Voigt will be facing jail time if the explanation isn't to the judge's liking.

Filed Under: 4th amendment, 5th amendment, christopher wheeler, encryption, forced revelation, locked phones, password, wesley victor

Miami Judge Says Compelling Password Production Isn't A Fifth Amendment Issue

from the password:-selfincriminate dept

Another small dart has been lodged in the thigh of the Fifth Amendment by the courts. A Miami, FL federal judge has ruled that defendants in a sex video extortion case must turn over their phones' passwords.

In a case being closely watched in legal and tech circles, Miami-Dade Circuit Judge Charles Johnson ruled that Hencha Voigt, and another man charged with being her accomplice, must unlock phones police believe were used in a plot to extort a social-media celebrity.

He ruled that unlocking their phones would not violate their constitutional right against self-incrimination.

“For me, this is like turning over a key to a safe deposit box,” Johnson said.

The jurisprudence related to passwords and the Fifth Amendment is all over the place, but it seems to be leaning towards treating device passwords and pins as "non-testimonial." Other decisions have resulted in the indefinite jailing of defendants on contempt of court charges for refusing to turn over passwords. Arguing against self-incrimination hasn't found many judicial supporters, but the issue is far from settled.

Indefinite jailing may be on tap for these defendants as well. They've been given two weeks to comply with the order, with the "or else" being a stay of indeterminate length at the local lockup. The Miami judge appears to be following state precedent, citing an earlier case where the state appeals court ruled in favor of the government, ordering an upskirt photographer to turn over his password to prosecutors.

This decision will be appealed. But the decision cited by this judge appears to indicate this will only delay the inevitable. Sooner or later, this issue will have to be addressed by the Supreme Court, but I wouldn't hold my breath waiting for it to happen. The Supreme Court frequently takes a pass on timely issues, leaving circuit appeals courts to do most of the heavy lifting. There really hasn't been enough Fifth Amendment cases of this type in federal appeals courts to press the issue. So far, the only thing that's been made clear in multiple cases is fingerprints are worse than passwords when it comes to locking law enforcement out of phone contents.

Filed Under: 5th amendment, hencha voigt, miami, password

So Much For The Fifth Amendment: Man Jailed For Seven Months For Not Turning Over Password

from the enjoying-your-rights,-citizen? dept

The FBI recently spent more than $1 million for assistance in decrypting a device's contents. It may have overpaid. Alternatives exist, whether it's a $5 wrench or indefinite imprisonment for not helping the government with its prosecution efforts.

A Philadelphia man suspected of possessing child pornography has been in jail for seven months and counting after being found in contempt of a court order demanding that he decrypt two password-protected hard drives.

The suspect, a former Philadelphia Police Department sergeant, has not been charged with any child porn crimes. Instead, he remains indefinitely imprisoned in Philadelphia's Federal Detention Center for refusing to unlock two drives encrypted with Apple's FileVault software in a case that once again highlights the extent to which the authorities are going to crack encrypted devices. The man is to remain jailed "until such time that he fully complies" with the decryption order.

The Fifth Amendment should prevent the government from punishing a person for not testifying against themselves, which is what's being argued by the defendant's representation in its appeal to the Third Circuit. (Although it's actually indirect representation. The government's case is actually against Doe's devices ["United States of America v. Apple MacPro Computer, et al"] and his lawyer is hoping for a stay of the contempt order during the appeal process.)

Mr. Doe… has a strong likelihood of success on the second issue: whether compelling the target of a criminal investigation to recall and divulge an encryption passcode transgresses the Fifth Amendment privilege against self-incrimination. Supreme Court precedent already instructs that a suspect may not be compelled to disclose the sequence of numbers that will open a combination lock — clearly auguring the same rule for any compelled disclosure of the sequence of characters constituting an encryption passcode.

Doe's rep also argues that the All Writs order obtained by the government has no jurisdiction over Doe or his devices.

Mr. Doe’s first claim is that the district court lacked subject matter jurisdiction. The claim stems from the government’s apparently unprecedented use of an unusual procedural vehicle to attempt to compel a suspect to give evidence in advance of potential criminal charges. Specifically, the government took resort not to a grand jury, but to a magistrate judge pursuant to the All Writs Act, 28 U.S.C. § 1651. (Ex. F at 1).

It is black letter law that the All Writs Act never supplies “any federal subject-matter jurisdiction in its own right[.]” Sygenta Crop Protection, Inc. v. Henson, 537 U.S. 28, 31 (2002) (citation omitted). It is equally well-settled that the Act has no application where other provisions of law specifically address the subject matter concerned. Pennsylvania Bureau of Correction v. United States Marshals Service, 474 U.S. 34, 40-42 (1985). The compelled production of evidence in advance of criminal charges is specifically addressed by Rules 6 and 17 of the Federal Rules of Criminal Procedure, which authorize the issuance and enforcement of grand jury subpoenas; and by 28 U.S.C. § 1826(a), which specifies the authorized penalties for a witness who refuses without good cause to give the evidence demanded by the grand jury.

As it stands now, Doe is still being held in contempt of court for refusing to decrypt his devices for investigators. The district court that held him in contempt has refused direct appeal of that order, resulting in the labyrinthine legal strategy of using the government's case against Doe's devices as a vehicle for challenging the lower court's contempt order.

Doe has not been charged, yet he's in prison. Backing up the government's assertions for holding him in contempt are two dubious pieces of hearsay. One is from his estranged sister, who claims to have seen child porn on Doe's computer, but can't actually say whether it was located on the devices the government is seeking to have decrypted. The other is from some sort of law enforcement encryption whisperer, who can apparently see things in the scrambled bits.

The government’s second witness was Detective Christopher Tankelewicz, a forensic examiner with the Delaware County District Attorney’s Office. He testified only that it was his “best guess” child pornography would be found on the hard drives. (Ex. J at 346). According to Tankelewicz’s understanding of the Freenet online network (in which he admits having no training), there were signs on an Apple Mac Pro computer seized with the hard drives of a user accessing or trying to access message boards with names suggestive of child pornography. (Ex. J at 306, 311-312, 339-340). In rather ambiguous testimony, Tankelewicz did not appear to say this meant any image traded over these boards was on the hard drives. (See Ex. J at 303-317, 336-340, 345-350). Instead, he identified a single image he believed there to be a “possibility” was on the drives. (Ex. J at 308-309). As he described it, the image was of “a four or five-year-old girl with her dress lifted up, but the image itself was small so you really couldn’t see what was going on with the image.” (Ex. J at 308).

No one wants to see a sex offender walk away from charges, but at this point, Doe hasn't even been officially charged with anything more than contempt. The problem with that charge is it has no end date. He can either stay in jail or comply with the order, even when the order conjures jurisdiction out of nowhere and violates his Fifth Amendment rights. If the government doesn't have enough evidence to pursue a case against Doe, it should cut him loose until it does.

Filed Under: all writs act, child porn, contempt, encryption, fifth amendment, in rem, jail, password, philadelphia

Footnote Reveals That The San Bernardino Health Dept. Reset Syed Farook's Password, Which Is Why We're Now In This Mess

from the well,-that's-interesting dept

We already discussed the many issues with the DOJ's motion to compel Apple to create a backdoor to let them brute force the passcode on Syed Farook's iPhone. However, eagle-eyed Chris Soghoian caught something especially interesting in a footnote. Footnote 7, on page 18 details four possible ways that Apple and the FBI had previously discussed accessing the content on the device without having to undermine the basic security system of the iPhone, and one of them only failed because Farook's employers reset the password after the attacks, in an attempt to get into the device. The key line:

... to attempt an auto-backup of the SUBJECT DEVICE with the related iCloud account (which would not work in this cases because neither the owner nor the government knew the password to the iCloud account and the owner, in an attempt to gain access to some information in the hours after the attack, was able to reset the password remotely, but that had the effect of eliminating the possibility of an auto-backup).

The "owner" of course, being the San Bernardino Health Department, who employed Farook and gave him the phone. Basically, what this is saying is that if the password hadn't been reset, it would have been possible to try to connect the phone to a "trusted" network, and force an automatic backup to iCloud -- which (as has been previously noted) was available to the FBI. But by "changing" the password, apparently that option went away.

In other words, the San Bernardino Health Dept may have been the ones who really mucked things up for the FBI. But, of course, to be honest, the FBI is probably kind of happy about that. At this point, very few people honestly believe that there's anything of much value on that phone. But this situation allows the FBI to present the most sympathetic case it probably can to try to force backdoors onto tech companies.

Filed Under: doj, encryption, fbi, password, reset, san bernardino, san bernardino health department, syed farook
Companies: apple

Shocking: Sony Learned No Password Lessons After The 2011 PSN Hack

from the sony-is-as-sony-does dept

The great Sony hack of 2014: what's it all about? Is it a subversive plot by North Koreans operating out of China in revenge for a film starring two guys from Freaks and Geeks? Or maybe it's simply fodder for stupid politicians to remind us that all the world's ills could be cured if only internet service providers took on the challenge of fixing all the things in all the places? No, my dear friends, no. The Sony hack of 2014 is a beautiful Christmas gift (your religious holiday may vary) of a wake-up call to anyone silly enough to think that Sony would bother to learn the lessons very recent history has tried to teach it.

To prove this, one need only review the latest file dump in the leak, which features the wonderful naivete of whatever bright minds are in charge of Sony's internal password conventions and storage policies.

In a small file titled "Bonus.rar," hackers included a folder named "Password." It's exactly what it sounds like: 140 files containing thousands upon thousands of private passwords, virtually all of them stored in plaintext documents without protection of any kind. Some seem personal in nature ("karrie's Passwords.xls") while others are wider in scope ("YouTube login passwords.xls"). Many are tied to financial accounts like American Express, while others provide access to corporate voicemail accounts or internal servers, and come conveniently paired with full names, addresses, phone numbers, and emails.

In case you're unfamiliar with the hack against Sony's Playstation Network a mere three years ago, the problem was -- you guessed it -- the exact same thing. In that case, the hack produced customer names, addresses, emails and login/password information because that information was stored in plain text, contrary to the advice of every competent network security person on the planet. Take, for instance, one security researcher quoted in the link above:

Passwords in plaintext? These guys are pretty bad - I don't think I've ever encountered this before. What's the point of using common password storage/hashing techniques if your staff is keeping all your passwords in plain text on open fileshares? Shit, why bother having locks on the doors at all?

The worst of all the problem's this hack revealed is that this question should have been answered in the wake of the events of three years ago. It's one thing to screw up. It's quite another to screw up in a manner that went public in a spectacular way and simply refuse to take measures to ensure it doesn't happen again. But that's Sony for you: long live plain text.

Filed Under: hack, password, sony hack
Companies: sony, sony pictures

Bank Changes Man's Password After They Realize It Insults Them

from the encrypted-passwords? dept

Usually, when you're dealing with a bank, they encrypt your passwords so that no one else can read them. However, apparently that isn't always the case -- and this allowed an employee at Lloyds TSB to change the password of one member from "Lloyds is pants" to "no it's not". The customer actually found the story to be amusing -- but it does seem slightly troubling that the bank, for whatever reason, was reviewing and changing a customer's password. They also forbade him from switching the password to "Barclays is better" and "censorship." Lloyds has apologized, and said the employee in question no longer works for the firm. It also explains why the guy was able to see the password in the first place by noting that on certain business accounts with multiple users, account reps can read the password. This seems pretty weak, though. If it's a business account with multiple users, why not let each user set up their own username and encrypted password? Also, it's still not explained why the guy was looking at users' passwords in the first place.

Filed Under: changing, cleartext, insults, password
Companies: lloyds tsb