SoylentNews is people
SoylentNews
from the something-you-have,-something-you-are,-something-you-know dept.
FBI is quietly waging a different encryption battle in a Los Angeles courtroom. The authorities obtained a search warrant compelling the girlfriend of an alleged Armenian gang member to press her finger against an iPhone that had been seized from a Glendale home. The phone uses Apple's fingerprint identification system for unlocking. It's a rare case were prosecutors have demanded a person provide a fingerprint to unlock a computer, but experts expect such cases to become more common.
In a Circuit Court decision in Virginia 2014, the judge ruled that a criminal defendant cannot use Fifth Amendment protections to safeguard a phone that is locked using his or her fingerprint. According to Judge Steven C. Fucci, a criminal defendant can't be compelled to hand over a passcode to police officers for the purpose of unlocking a cellular device, law enforcement officials can compel a defendant to give up a fingerprint. The Fifth Amendment states that "no person shall be compelled in any criminal case to be a witness against himself," which protects memorized information like passwords and passcodes, but it doesn't protect fingerprints in the eyes of the law. Frucci said that "giving police a fingerprint is akin to providing a DNA or handwriting sample or an actual key, which the law permits. A passcode, though, requires the defendant to divulge knowledge, which the law protects against.
In other words fingerprints are bad security. On the other hand... maybe some fingers like 9 out of 10, instead can trigger a silent self-destruct?
(Score: 2) by jasassin on Tuesday May 03 2016, @06:43AM
Sounds like you are onto something there. Also, a password that will wipe all your shit would be cool too.
jasassin@gmail.com GPG Key ID: 0xE6462C68A9A3DB5A
(Score: 2, Insightful) by Anonymous Coward on Tuesday May 03 2016, @10:35AM
Destruction of evidence is never good. Stubbing a cigarette out onto your unlock finger seems to be a valid way of sticking up your middle finger to the man, though.
I'm no expert, but I believe the spirit of the 5th supports the right to not unlock your phone under duress, and any judge who says otherwise is a fascist cnut.
(Score: 2) by linuxrocks123 on Tuesday May 03 2016, @09:15PM
Let's please keep the discussion level higher than this: http://linuxrocks123.livejournal.com/96682.html [livejournal.com]
Your statement is incorrect. The 5th Amendment protects testimony. Your fingerprint, DNA, blood, handwriting samples, and similar such things have been consistently ruled not to be testimony. They can be compelled with a warrant.
Now: producing documents that the government doesn't know for a fact exist, or doesn't know are authentic, is testimony. So, compelling entering or revealing passwords does implicate the 5th Amendment, according to most courts that have looked at the issue. Some, like the Supreme Court of Massachusetts, have tried to compel suspects anyway with a gross misapplication of the "foregone conclusion" exception to the 5th Amendment, probably because the suspects were suspected to have child porn, and children make people stupidly emotional. But the 11th Circuit ruled correctly, and I think the Supreme Court of the US would do so as well.
(Score: 2) by sjames on Tuesday May 03 2016, @09:57PM
"Certainly, your honor, this appears to be in order. Which finger would you like for me to apply to the scanner?
Now it's back to something you know (which fingerprint out of 10 won't destroy the data) rather than something you have.
(Score: 2) by Nollij on Wednesday May 04 2016, @03:17AM
If such a move is even possible, your lawyers should have the easiest victory of their careers. It would mean the prosecution has nothing in place to preserve evidence, and thus has no evidence to use in court.
Look into how forensic data is gathered from traditional desktop hard drives - the are cloned on equipment that is (effectively) physically incapable of writing to the original, and all data is then gathered from these copies, typically in a fashion that's also read-only.
(Score: 3, Informative) by davester666 on Tuesday May 03 2016, @06:51AM
We're already WAY past this, with this story (sorry, it's from slashdot) https://yro.slashdot.org/story/16/04/27/2357253/child-porn-suspect-jailed-indefinitely-for-refusing-to-decrypt-hard-drives [slashdot.org]
A man not charged with anything is in jail for 7 months and counting for contempt of court for not failing to fulfill an all-writs warrant to unlock his phone and computer. Because he MIGHT have child porn on those devices.
(Score: 2) by davester666 on Tuesday May 03 2016, @06:54AM
er s/for not failing/for failing/
doh.
(Score: 2) by q.kontinuum on Tuesday May 03 2016, @07:02AM
Because he MIGHT have child porn on those devices.
No, not for the potential child-porn, but for the alleged contempt of court. But after one month, isn't it conceivable he already forgot his complex password, and therefore cant be forced to reveal it anymore?
Registered IRC nick on chat.soylentnews.org: qkontinuum
(Score: 4, Insightful) by davester666 on Tuesday May 03 2016, @07:10AM
He's not in jail for the child porn, or even charged with having any. Someone thinks they saw some on his screen, and now the gov't has decided that it is appropriate to use an 'all-writs' warrant to compell him to help them with their search of his equipment to see if he has any. And some wacked-out judge agrees with this.
The next logical step is to hand a suspect an 'all-writs' warrant to help the police by compelling the person to write out a confession to a crime.
(Score: 1, Insightful) by Anonymous Coward on Tuesday May 03 2016, @07:38AM
For the legally challenged this is of course just the Sixth Amendment of the US Constitution. In what way is imprisoning someone who refuses to testify against themselves (Fifth Amendment) by giving up their password allowing the accused to enjoy the right to a speedy and public trial? Either they should charge him with some kind of crime and start his trial or let him go. Or he needs to find a lawyer to bring this to court.
(Score: 4, Insightful) by davester666 on Tuesday May 03 2016, @08:34AM
That's just it. He hasn't been charged with anything, so there is no right to a speed and public trial.
He's in jail for not doing what a judge wants him to do, which is is merely difficult to get the same judge to reconsider, and nearly impossible to get another judge to overturn.
(Score: 0) by Anonymous Coward on Tuesday May 03 2016, @02:29PM
So basically he got kidnapped? And the ransom demanded is some information.
(Score: 4, Insightful) by DannyB on Tuesday May 03 2016, @05:17PM
It works like this. It's a time honored method of law enforcement. So don't complain.
You are accused of being a witch and charged with witchcraft and consorting with the devil.
The court has ordered you to be tried by dunking in order to determine if there is any validity to the charges.
The trial by dunking will show one of two results:
1. You survive the dunking, thus proving beyond all doubt you are a witch and should be burned.
2. You drown and thus the charges are dismissed.
At this point, even if he does unlock the phone, this allows the evidence to be planted.
To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.
(Score: 4, Informative) by compro01 on Tuesday May 03 2016, @10:29AM
You think that line actually still matters? That bit has been basically irrelevant since the 70s, when they found that 5 years was perfectly fine and that basically any length of time would be fine so long as the accused was not prejudiced by the delay.
(Score: 0) by Anonymous Coward on Tuesday May 03 2016, @07:20AM
It's for the child porn, second only to terrorist for shitty hypothetical to justify curbing civil protections ("what if the phone contains the location of a 7 year old girl who is gang raped by albino Chihuahuas, huh? You're a monster if you don't try to save her) AND daring to contradict a judge (really kids, don't do this unless you have a taste for masochism).
They let Judith Miller out after 85 days, and that was a matter of NATIONAL SECURITY, so it's possible pedophiles have eclipsed terrorist as public enemy #1.
(Score: 0) by Anonymous Coward on Tuesday May 03 2016, @07:23AM
We need better checks and balances on judges to prevent them from arbitrarily abusing their powers, clearly.
(Score: 2) by q.kontinuum on Tuesday May 03 2016, @07:54AM
I'm not justifying to keep that guy in prison, just clarifying that the problem here is not to detain a suspect, but the despotic nature of the laws concerning contempt in court [abolish-alimony.org]. (That was just the first link I found, not sure how well reasoned the write-up is. I found some good arguments about it in the past, but didn't bother to do more than coarse reading this time.)
Registered IRC nick on chat.soylentnews.org: qkontinuum
(Score: 2) by tangomargarine on Tuesday May 03 2016, @02:48PM
Not legally because of it, but pretty clearly logically because of it.
"Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
(Score: 4, Informative) by FakeBeldin on Tuesday May 03 2016, @07:36AM
No need to apologise, just link to the SN story: https://soylentnews.org/article.pl?sid=16/04/28/1516203 [soylentnews.org].
(Score: 2) by davester666 on Wednesday May 04 2016, @04:12AM
Sorry, I did poke around for the soylent article, but did not find it.
(Score: 2) by q.kontinuum on Tuesday May 03 2016, @07:00AM
There are plenty [biometricupdate.com] of [bbc.com] reasons [instructables.com] not to trust biometrics for identification. Now we have one more.
While the idea of silent self-destruct has some merit, I'd rather have it implemented using a password instead of biometrics. And even there, the solutions already available should suffice. My phone has a setting to wipe it when the password is entered wrongly 10 times in a row. So, after giving them the wrong code 10 times there is no base left to keep me in jail for contempt. And under the stress of the interrogation, it would probably be so easy to get it accidentally wrong...
Registered IRC nick on chat.soylentnews.org: qkontinuum
(Score: 0) by Anonymous Coward on Tuesday May 03 2016, @07:49AM
So, Mr Kontinuum is it? What is the combination to your luggage?
(Score: 3, Funny) by q.kontinuum on Tuesday May 03 2016, @09:27AM
What is the combination to your luggage?
"12345", of course.
Registered IRC nick on chat.soylentnews.org: qkontinuum
(Score: 0) by Anonymous Coward on Tuesday May 03 2016, @01:09PM
I thought it was 00000000 (http://www.huffingtonpost.com/2013/12/05/nuclear-missile-code-00000000-cold-war_n_4386784.html [huffingtonpost.com]
(Score: 2) by q.kontinuum on Tuesday May 03 2016, @02:36PM
What?!? Only an idiot would take such a combination for his hand-luggage! [youtube.com]
I read about that before, but didn't have the link at hand. Thanks, this time I bookmarked it properly :-)
Registered IRC nick on chat.soylentnews.org: qkontinuum
(Score: 3, Insightful) by tangomargarine on Tuesday May 03 2016, @02:51PM
So, after giving them the wrong code 10 times there is no base left to keep me in jail for contempt.
Yeah, I'm sure they would say "oh well" and just let you go at that point. /sarcasm
"Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
(Score: 2) by q.kontinuum on Tuesday May 03 2016, @03:23PM
Well, I'm not that familiar with the US judicial system (nor am I a lawyer in Germany), but I assumed the contempt of court is similar to "Beugehaft" [leo.org] in Germany. That was not completely correct, Beugehaft probably matches better the more specific term of coercive detention, which - as I understand - can be one aspect of imprisonment for contempt. This aspect would definitely not match anymore, and since there is no ongoing offence anymore I'd expect the court has no option but to give a final order and be done with it. As long as the suspect can still be expected to contribute, it is a never ending story.
Registered IRC nick on chat.soylentnews.org: qkontinuum
(Score: 3, Insightful) by RedBear on Tuesday May 03 2016, @08:22AM
I've seen a lot of people suggesting giving a different passcode or fingerprint for the express purpose of triggering a self destruct of the data. Problem with that is, if we're dealing with a legal investigation and it could be proven that you deliberately gave them a self destruct code, it could result in a conviction of destruction of evidence, which is a felony in and of itself. I'm no lawyer but I'm pretty sure it doesn't matter whether it would have been incriminating evidence or not. It should be left up to the investigators to attempt to crack the device and trigger the automatic erasure after 10 tries, if you have that feature enabled. If they perform the necessary actions themselves that results in the destruction of data, it's much harder to legally make you responsible.
There is a much simpler solution to this problem, which is to make sure that biometric data is always paired with some sort of non-physical passcode that cannot be compelled by a warrant. Even something as ridiculously simple as a 1-digit pin number would make it highly improbable that the device could successfully be accessed before triggering a demand for the longer passcode, even if the attacker knew the correct fingerprint to try. The iPhone allows only 5 attempts to use Touch ID. If that fails or if you reboot the device you must then use the full passcode before Touch ID will be re-enabled. Anyone with a brain has moved on from 4-digit numeric pins to a longer alphanumeric passcode, so at that point it should be nearly impossible to access the device. A 2-digit pin paired with a fingerprint would make it basically impossible to guess the pin within 5 tries, but it would still be quick to use and easy for the user to remember.
There was a hardware-based device for brute-forcing an iPhone passcode. It worked by immediately cutting power to the device if the passcode attempt is unsuccessful, before the phone could record that the attempt failed, so you could keep trying thousands of times without triggering the 10-failure self destruct. But as I said when you reboot the iPhone it no longer accepts fingerprints until you enter your passcode. So as far as I know there would be no way of bypassing this simple fingerprint-plus-pin security option. I have been quite miffed for some time now that Apple still hasn't offered us this security option. Hopefully they will after this practice of compelling fingerprints with a warrant starts to spread. A fingerprint is very convenient but by itself is an almost worthless security option. You might as well tattoo your passcode on your forehead and try to keep it secure by wearing a hat.
¯\_ʕ◔.◔ʔ_/¯ LOL. I dunno. I'm just a bear.
... Peace out. Got bear stuff to do. 彡ʕ⌐■.■ʔ
(Score: 3, Insightful) by davester666 on Tuesday May 03 2016, @09:00AM
now they can compel you to enter your passcode via an 'all writs' warrant, without formally charging you with anything. You just have to help the police to search your phone or computer, if you don't help them, go directly to jail for contempt of court.
this has already happened.
(Score: 3, Insightful) by RedBear on Tuesday May 03 2016, @09:51AM
They think they can, and a judge has been allowed to keep someone imprisoned for 7 months now for refusing to decrypt a storage device, but as others have said this seems to be a clear violation of 5th Amendment protections against being compelled to self-incriminate. I don't believe such things will survive a good Supreme Court case. I'm fairly certain there have already been multiple Supreme Court decisions making it clear that it's unconstitutional.
The All Writs act is tyranny, plain and simple, as far as I'm concerned.
¯\_ʕ◔.◔ʔ_/¯ LOL. I dunno. I'm just a bear.
... Peace out. Got bear stuff to do. 彡ʕ⌐■.■ʔ
(Score: 2) by choose another one on Tuesday May 03 2016, @09:37AM
Problem with that is, if we're dealing with a legal investigation and it could be proven that you deliberately gave them a self destruct code, it could result in a conviction of destruction of evidence, which is a felony in and of itself.
Problem with that is that any evidence the device was set to wipe to factory settings with a particular secret code is (was) on a device that is now wiped to factory settings with a secret code...
Reality is they should never ever let a defendant touch an such item of evidence or enter a passcode of any sort into it - the phone should be cloned and the defendant allowed to touch the clone, if necessary. Of course it is more difficult to do that so they will try and take shortcuts or try and compel someone else to do it - as is the Apple case.
(Score: 3, Insightful) by RedBear on Tuesday May 03 2016, @12:21PM
Naive. There are many ways in which the device could give away the fact that you gave them a self-destruct code rather than the unlock code. Such as when they film the procedure and the very first time they try the code the screen immediately says, "Erasing all data... Please wait". Unless you know your device would wipe itself sneakily behind the scenes without ever giving the attackers evidence that it had been wiped, I would advise not risking prosecution for felony destruction of evidence. The iPhone for instance will wipe the encryption header and reboot, presenting itself as a new phone waiting for activation. They make it quite obvious what just happened, unfortunately.
You don't need to touch anything. But if you tell them to use the wrong code or fingerprint and it clearly results in purposeful destruction of evidence, in the court's eyes it will be the same as if you put it in yourself. The phone can't be cloned unless it's unlocked first. So they're kind of stuck.
Interesting thing is if the device makers do implement self destruct codes, nobodies' compelled passcodes could ever be trusted again. Because some people would go ahead and risk a destruction of evidence charge for a chance to destroy the data permanently. The courts would be left with their unconstitutional trump card, using the All Writs act to try and compel the defendant to self-incriminate by successfully unlocking the device, and then imprisoning them if they fail. For failure to comply with the unconstitutional All Writs warrant.
So I guess this leads to the ultimate defense against the All Writs bullshit: Let the real data be stored in a hidden container TrueCrypt-style, and have a second sacrificial password unlock the phone which only gives access to a fully working but clean version of the system, containing no information of any interest. In other words it appears we need to add more layers of obfuscation and deniability to our security, until it literally cannot be proven either that anything is being hidden or that we are being uncooperative in any way. "Your Honor, I gave you the password as I was compelled to do, it unlocked the phone, the phone works, what more do you want?" At that point it becomes totally unsupportable tyrannical insanity for the court to continue to demand that a person come up with some sort of evidence to incriminate themselves.
¯\_ʕ◔.◔ʔ_/¯ LOL. I dunno. I'm just a bear.
... Peace out. Got bear stuff to do. 彡ʕ⌐■.■ʔ
(Score: 2) by mhajicek on Tuesday May 03 2016, @02:22PM
You could have the unlock screen display an EULA that must be accepted to unlock, stating that the person unlocking the phone is the owner and not under duress. Include penalties for violation. You could then make it a crime for anyone else to unlock the phone, or for you yourself to do it under duress, and I don't think the court can compel you to commit a crime.
The spacelike surfaces of time foliations can have a cusp at the surface of discontinuity. - P. Hajicek
(Score: 2) by hemocyanin on Tuesday May 03 2016, @11:08PM
Geek faith in technology or hyper-convoluted agreements or destruction of evidence or jury nullification or etc. is always sadly amusing in the context of the other side being armed to teeth. This isn't about some clever hack, it is about pure power -- the power they have and we don't. It's about tyranny.
(Score: 0) by Anonymous Coward on Tuesday May 03 2016, @08:51PM
The better solution is to simply "forget, but try" enough times that it gets wiped naturally through the inbuilt anti-brute-force protections.
However, I believe that if you are under duress, and the police *force* you to do something which results in the destruction of data, then because there was no free will involved, only obeying direct orders from an authority asserting dominance over you. that authority is the one that caused the destruction, not you.
The 5th needs bolstering, certainly.
(Score: 2) by inertnet on Tuesday May 03 2016, @08:51AM
On the other hand... maybe some fingers like 9 out of 10
(Score: 0) by Anonymous Coward on Tuesday May 03 2016, @09:53AM
If you're trying to be a smartarse as you have realised that we have 2 thumbs, then you've alas proved yourself to be a dumbarse, as thumbs are also fingers.
Not just to the biologically aware, even in common speech - consider the term "middle finger".
Don't bother responding until you can tell me which integer is the middle of 1, 2, 3, and 4.
This seems like a great time to sign off HAND.
(Score: 2) by tangomargarine on Tuesday May 03 2016, @02:55PM
They're not talking about thumbs vs. fingers; they're saying you don't have 9 or 10 fingers on one hand.
"Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
(Score: 2) by arulatas on Tuesday May 03 2016, @03:28PM
I think he was taking it to mean 9 out of 10 fingers on the "Other Hand"
----- 10 turns around
(Score: 4, Interesting) by Gravis on Tuesday May 03 2016, @09:35AM
fingerprints are more like a username than a password which is to say they are easily gotten and insecure. so, you need to combine that with something you know which is a password. while a password + fingerprint may be annoying to do every time, it would be nice if the password lasted for X hours and after that it would relock. though i would go one further and say if it's not unlocked after Y days and it's not near your home location, it should wipe the encryption key. these a reasonable measures in case someone takes your phone may it be a thief or the police.
also, the whole "wrong finger causes self-destruct" idea is stupid because the of evidence is a felony.
(Score: 4, Insightful) by curunir_wolf on Tuesday May 03 2016, @01:06PM
and
So they wanted the phone unlocked and got a warrant. Shouldn't the warrant specify that? Don't warrants require probable cause any more? Why would a magistrate issue the warrant? What did it say "We just want to take a look" - that's not probable cause, and the magistrate should be censured for issuing such a warrant and all evidence obtained thrown out.
I am a crackpot