Monthly Archives: November 2014

IT Security TV Show 4 November 2014 - iPhone Users Forfeit Fifth Amendment
http://www.secpoint.com/news IT Security News show 4th November 2014 Many Security Topics covered Pirate Bay founder Gottfrid Svartholm Found Guilty in Hacki...

By: SecPoint

The rest is here:
IT Security TV Show 4 November 2014 - iPhone Users Forfeit Fifth Amendment - Video

Is taking the fifth amendment a bad idea?

By: Jeffrey Weiner

Read the rest here:
Is taking the fifth amendment a bad idea? - Video

Last week, there was a lot of press coverage about a Virginia court ruling on how the Fifth Amendment applies to bypassing a smart phone passcode. The ruling hasnt been available before today, but here it is: Commonwealth v. Baust, via Marcia Hofmann. Its a short opinion, just five pages, so its a quick read. Unfortunately, though, the opinion doesnt address the really important issue raised by compelled decryption: Whether the government can force the defendant to enter in the passcode. Its not the courts fault that the opinion didnt reach that, to be clear. The government never asked for an order compelling the defendant to do that, so the court didnt decide it. Heres a quick rundown of the facts, the law, and my reaction.

The defendant has been charged with assaulting a woman. There is reason to believe that the defendant videotaped the assault and that there is a copy of the video on the defendants passcode-protected smart phone. The state wants the defendant to be ordered either to disclose his passcode so the police can enter in the passcode to unlock the phone themselves, or else to give up his fingerprint to unlock the phone directly using the phones fingerprint sensor.

The court reaches a split ruling. First, there is no Fifth Amendment problem with forcing the defendant to provide his fingerprint. Second, the defendant cannot be forced to tell the government his passcode because that would be forcing the defendant to disclose the contents of his own mind. Most importantly, the court rules that the foregone conclusion doctrine doesnt apply because the police dont know the passcode:

Contrary to the Commonwealths assertion, the password is not a foregone conclusion because it is not known outside of Defendants mind. Unlike a document or tangible thing, such as an unencrypted copy of the footage itself, if the password was a foregone conclusion, the Commonwealth would not need to compel Defendant to produce it because they would already know it.

In dicta, the Court adds that the defendant could not be compelled to hand over a decrypted version of the video believed to be on his phone. Thats true because it is not a foregone conclusion that the video exists or is on the phone. The defendant cant be forced to effectively testify as to that by producing a decrypted version of the video.

This is just a state court trial ruling, not an appellate decision. So its interesting more for its reasoning than its precedential value. With that said, here are some thoughts on the reasoning of the case.

First, the courts ruling on divulging a fingerprint is easy. Theres obviously no Fifth Amendment problem with that. On the governments request for the passcode, the opinion is frustrating because the governments request was poorly framed. In this case, the government doesnt need to know the defendants passcode. It only needs to bypass the passcode gate, either through the fingerprint or by having the passcode entered in by the defendant. If the government couldnt get into the phone with the fingerprint, then, the sensible request would be for an order to have the defendant enter in the code rather than an order disclosing it to the government. But the government didnt ask for that: Instead it asked for an order that the defendant tell them his passcode.

Whats the difference? Having the defendant enter in his passcode would minimize the Fifth Amendment implications of the compelled compliance, as it would not involve disclosing the potentially incriminating evidence of the passcode itself. The passcode itself could be independently incriminating, at least in some cases. Imagine a conspiracy case in which members of the conspiracy use a common passcode. Proof that a suspect used that exact passcode on his own phone would be incriminating evidence, as it could help to show membership in the conspiracy.

Because the passcode itself could be incriminating, the smart way to limit the Fifth Amendment problem is for the government to ask for an order compelling the target to enter in the passcode rather than to divulge it to the police. That way, the government gets the unlocked phone but never gets the passcode. If the defendant has to enter in the passcode rather than tell it to the police, the testimonial aspect of complying would only be admitting knowledge of the passcode, which would very likely be a foregone conclusion in a case where the phone is used heavily by that person. But the government didnt ask for that here, so the court didnt consider how the Fifth Amendment would apply in such circumstances.

Notably, the court does address in dicta whether it would be incriminating for the defendant to hand over the unencrypted video believed to be on the phone. But forcing the defendant to hand over the unencrypted video is quite different from having him enter in the passcode to unlock the phone. Being forced to enter in the passcode to unlock the phone amounts to being forced to say, I know the passcode for this phone. On the other hand, as the court recognized, being forced to produce the unencrypted video amounts to being forced to say much more, such as I admit that the video exists; I admit that this is the video; I know where that video is; and I admit that I know what video youre talking about. Being forced to produce the video raises a host of Fifth Amendment issues that merely entering in the passcode does not.

More:
Virginia state trial court ruling on the Fifth Amendment ...