[hsmyers]

Why is that when the government says "But, but computer!" judges abandon common sense and case law. Even when the tables are turned there is still an amazing amount of techno-ignorance in the process. Consider the long ago (tech time anyway) prosecution of Microsoft. The idiots in charge completely ignored their success with IBM and attacked via the browser vector. Andrew Schulman at the time of pre-trial investigation had three books entitled Undocumented this that and the other thing. Each should have been a successful blueprint in terms of anti competitive behavior. Had this and the browser been part of their war chest I think the result would have been considerably stronger (i.e. the bust them apart goal would have been reached) with a appropriately more useful public result. <end_of_slightly_off_topic_rant/>

[rayiner]

> Why is that when the government says "But, but computer!" judges abandon common sense and case law.

It's exactly the opposite. It's technologists that say "but, but computer!" and demand special treatment for computers are involved.[1] Judges generally treat computers in terms of real-world analogies to concrete things, and these analogies often clash with idealistic notions held by technologists.

This case is actually an excellent example of that phenomenon. I've heard people say that their laptop/phone/etc is an "extension of their mind" or something to that effect. Because the 5th amendment only applies to testimonial incrimination (because of the use of the word "witness" in the text of the 5th), you need that nexus to the mind in order to justify concluding that forcing someone to give up an encryption key is equivalent to forcing them to testify against themselves.

The more obvious (to me, anyway) analogy is that a laptop/phone is like a backpack or briefcase. I keep documents, photos, notes, etc, in my laptop just as I would keep them in a briefcase. Well, under the case law it is not prohibited under the 5th amendment to force someone to unlock a briefcase! That act has no nexus with a person's internal thoughts and is thus not testimonial.

[1] Other examples include various CFAA-related things. Nobody would defend just walking into peoples' houses and saying "hey, your locks suck!" but defend analogous behavior with regard to computer security all the time. You also see it in the e-mail context. E.g. most people who complain about the government possibly subpoenaing e-mails they store on Google's servers would not see the problem with the government subpoenaing Enron's records they stored at their accounts' premises. Technologists generally want to ignore the obvious physical analogies in favor of ones based on how they perceive the electronic world (i.e. it's "my personal documents" even though it's stored on a cloud and dozens of engineers and sysadmins have access to them).

[kinghajj]

An unencrypted hard drive may be akin to a briefcase, but what about an encrypted one? Wouldn't that be more like a safe with a combination lock? IIRC, courts still cannot compel one to disclose the combination to unlock a safe, only to provide a key to a lock, exactly because safe combinations exist solely within the defendant's mind--just like most encryption keys. Disclosing the key implies that one has access to the data, which may be incriminating in and of itself with certain data. Even if the key is not provided, and the defendant is allowed to enter their password privately so that prosecutors may inspect the unencrypted data, the act of entering the password in and of itself provides evidence that one is aware of the contents, and thus may be used as evidence against oneself.

[tedunangst]

One can imagine the possibility that you are required to decrypt the documents, but that fact is itself not admissible in court. The prosecutor would have to demonstrate some other link to prove the files are yours. For instance, if they want to introduce an email found on your encrypted disk, they would claim it belongs to you because your name appears in the To/From field.

[kinghajj]

What if there is no evidence that the file belongs to the user other than the user knew the key to decrypt it? Would prosecution not be possible? I mean, what if you provide the combination to a safe that contains contraband--drugs or guns or undisclosed cash, but no ledger saying "this is the property of X"--wouldn't the combined facts of discovering of the safe in the possession of the defendant and their disclosure of the combination incriminate them?

[tedunangst]

I suppose. Even if you don't disclose the combination, I imagine the jury would be quite curious how you came to be in possession of a safe but not its combination.

[betterunix]

"Why is that when the government says "But, but computer!" judges abandon common sense and case law"

I can think of a few reasons:

(1) My understanding of the legal theory is that computers are considered to increase the capabilities of the population; hence, the government's power to enforce the law must also be increased. Consider a car analogy: you must display visible license plates to identify your vehicle whenever it is on the road, yet that was never required for horses, carriages, bicycles, or any previous mode of transportation. Likewise with computers: where previously you might have been able to whisper a secret to someone a foot away from you, now you can secretly communicate with someone across thousands of miles.

(2) It is assumed that the spirit of the law must be upheld. If the police are legally allowed to wiretap a suspect as part of an investigation, then encryption must not be allowed to get in the way of that. In other words, technology must not defeat the law, even in spirit.

(3) Conservative views of technology: quite a few judges are still of the opinion that personal computers are just fancy cable boxes, and so doing anything that violates the will of service providers or governments is "abuse." Entering a URL manually is considered to be vastly different from writing a script to generate and fetch URLs automatically, even if there is no technical difference. If you discover that your phone lets you make a free long distance call when you whistle into it, you are a criminal; if you discover that a web server will give you anyone's account number when you enter the right URL, well, you're an even worse criminal.

(4) Ignorance of what is actually possible with computers. See e.g. how Kevin Mitnick was treated when prosecutors claimed he could whistle into a phone line and thus launch a nuclear strike.

[ds9]

Re (2), the idea that LE is entitled to have comms decrypted has never been "the spirit of the law" until very recent legislation. In the days of "alligator clip on the wire", the law allowed the police only to intercept whatever the content was, in the form it was in - it did not compel the people speaking to explain their "code words", or to speak in a language the officers could understand.

It is precisely this fact which makes the current "going dark" argument an example of overreaching and mendacious, bad-faith deceptive rhetoric: encryption does not take away any powers the police formerly had; to the contrary, the demand for decryption goes far beyond traditional wiretapping principles.

[betterunix]

I am not saying that I agree with the idea, but one could make an argument that modern cryptography is different from speaking with code words, and that the spirit of wiretapping laws extends to forced decryption. Using code words only barely qualifies as "encryption" at all -- it is certainly not going to meet basic semantic security definitions. Further, codewords are not something is built into any communications equipment, not automated, and computed in one's head -- quite different from TLS or OTR.

One could argue (as the DoJ does) that the spirit of wiretapping law is that the police can, with the approval of a court, temporarily violate a specific suspect's privacy in an electronic communication system. Hence if the system automatically encrypt's the suspect's messages, the police should be able to obtain plaintexts. Phone companies are not exempted from wiretapping requirements when they multiplex phone calls, despite the fact that that is a technical measure that (as a side effect) impedes wiretapping.

Again, this is not an argument I agree with. For one, wiretapping laws do not, as you pointed out, require a suspect to participate in any way in the wiretapping. For another, there is a component of modern encryption that does (or should) occur in a suspect's mind, much like the computation of code words. It is also true that in general, wiretapping laws have expanded far more rapidly than communications technologies have hampered police investigations; the ability of the citizens to have a private conversation is still "catching up."

[ds9]

Actually you are right and I overstated. This has been the distinction in the recent laws, if the provider as opposed to the interlocutors can decrypt it is required.

It is a challenge to build a system that encrypts as part of a service (rather than users encrypting at the endpoints), yet prevents the service operater being able to provide plaintext. In this situation the 5th amendment does not avail, but I think there is a strong argument for the service provider having an option to shut down (like Leveson/Lavabit) rather than cooperate - not on the grounds Leveson argued, but rather by a right to avoid being used as an instrument of fraud. But we digress from the main topic here.

[AnthonyMouse]

>My understanding of the legal theory is that computers are considered to increase the capabilities of the population; hence, the government's power to enforce the law must also be increased.

The obvious counterargument is that it would have to be a two way street or you would have endlessly expanding government powers. Thus, if computers increase the capability of law enforcement (e.g. to wiretap at scale or search recorded communications without individual law enforcement officials having to listen to them) then the individual's rights against government surveillance must also be increased.

Moreover, if the argument is that we need to maintain the historical balance between privacy and law enforcement interests then even the existing powers of law enforcement go too far, because the technology available to law enforcement officials when the amendments in the Bill of Rights were adopted didn't allow real-time communication between individuals to be recorded whatsoever.

And I have to imagine a lawyer would ask what case establishes this legal theory of government automatically gaining new powers as a result of technological advances, because I'm not aware of any such precedent.

> Consider a car analogy: you must display visible license plates to identify your vehicle whenever it is on the road, yet that was never required for horses, carriages, bicycles, or any previous mode of transportation.

It is easy to draw a distinction between cars and computers because the reason we require identification for cars is not that they are more powerful than bicycles etc., it is that they are more dangerous. Computers, by contrast, are for the most part not dangerous at all. No innocent bystanders are killed when someone uses the internet while intoxicated. Moreover, we can see how the distinction plays out with automobiles, because anyone can use mass transit anonymously, which is clearly much more powerful than a bicycle in rapidly getting you from here to there, but also not very dangerous.

> It is assumed that the spirit of the law must be upheld. If the police are legally allowed to wiretap a suspect as part of an investigation, then encryption must not be allowed to get in the way of that. In other words, technology must not defeat the law, even in spirit.

I'm not seeing any coherent principle in this argument. If the police are legally allowed to stand in the street and look at you through the window when you are standing in your living room, then a curtain "must not be allowed to get in the way of that"?

It seems obvious that just because the use of a technology makes the jobs of law enforcement more difficult doesn't mean that people have no right to use the technology.

And it is also quite beside the point, because I don't think anyone is making the argument that no one can use the specific technology (e.g. encryption), the question is rather whether someone who has already used it can be compelled to reveal the secrets against his will.

[mpyne]

> Thus, if computers increase the capability of law enforcement (e.g. to wiretap at scale or search recorded communications without individual law enforcement officials having to listen to them) then the individual's rights against government surveillance must also be increased.

But that's just it. The people have far more ability now to keep their communications secret than they have ever had before. It makes no sense to say that the individual has either less or the same ability to keep their communications secret. PGP has been around how long?

The fact is that people don't care. Maybe they will in the future, but I doubt it given the rise of mobile and its corresponding dependence on the cloud.

[tedunangst]

One may as well ask why every time a judge issues a ruling, geeks everywhere shout "I know more about the law than you do, dumb judge!"

[saraid216]

> Even when the tables are turned there is still an amazing amount of techno-ignorance in the process.

Honestly, the EFF is the only entity that it is even bothering to do something about this.

Keep this in mind when computer interface design is built towards making sure the user doesn't need to understand what's happening. It's part of it.

[IceyEC]

Even in this specific case that is not true; the brief was filed by the EFF in addition to the ACLU.