Encrypted laptop poses legal dilemma

[Jack]

From Yahoo News:

When Sebastien Boucher stopped at the U.S.-Canadian border, agents who inspected his laptop said they found files containing child pornography. But when they tried to examine the images after his arrest, authorities were stymied by a password-protected encryption program. Now Boucher is caught in a cyber-age quandary: The government wants him to give up the password, but doing so could violate his Fifth Amendment right against self-incrimination by revealing the contents of the files. Experts say the case could have broad computer privacy implications for people who cross borders with computers, PDAs and other devices that are subject to inspection. "It's a very, very interesting and novel question, and the courts have never really dealt with it," said Lee Tien, an attorney with the Electronic Frontier Foundation, a San Francisco-based group focused on civil liberties in the digital world. For now, the law's on Boucher's side: A federal magistrate here has ruled that forcing Boucher to surrender the password would be unconstitutional. The laptop was seized, but when an investigator later tried to access a particular drive, he was thwarted by encryption software from a company called Pretty Good Privacy, or PGP. A grand jury subpoena to force Boucher to reveal the password was quashed by federal Magistrate Jerome Niedermeier on Nov. 29. "Producing the password, as if it were a key to a locked container, forces Boucher to produce the contents of his laptop," Niedermeier wrote. "The password is not a physical thing. If Boucher knows the password, it only exists in his mind." The government has appealed the ruling.

Since this case is dealing with possible porn and not terrorism, it's likely the current ruling will stand. But what if the government was contending the files were in the interest of national security or were files regarding terrorist activities? Obviously charges like that could only be substantiated after the person's rights had been compromised. So in the interest of national security should the right to encrypt files and folders and not disclose the encryption key to authorities be removed so that we can all "feel safer"?

[Compugasm]

If it was a matter of national security, I'd be willing to bet that Microsoft or PGP have the skelton key. But why would this dude let a border guard rummage around through his computer? What an idiot. What if he worked for a company that issued him a computer. He'd be in hot water with his employer too. Not just over pictures, but willingly breaking "trade secrets", or non-disclosure agreements or something like that.

[Jack]

Here's another tidbit I just ran across:

We have received several questions, comments and links to other blogs about a Washington Post article on confiscating laptops and other electronic devices at airports. As the article correctly states, this is a customs issue and not one TSA is involved in. TSA does not and will not confiscate laptops or other electronic devices at our checkpoints. Our officers¹ are solely focused on the safety of the traveling public and are looking for explosives and other prohibited items. Should one of our officers find something suspicious, we will immediately contact local law enforcement and potentially the local bomb squad. We will not ask for any password, access to any files or take the laptop from you for longer than it takes to determine if it contains a threat. Should anyone at a TSA checkpoint attempt to confiscate your laptop or gain your passwords or other information, please ask to see a supervisor or screening manager immediately. Christopher TSA Evolution Blog Team

Evolution of Security: RUMOR ALERT! LAPTOPS

As to your point:

At least two major global corporations, one American and one Dutch, have told their executives not to carry confidential business material on laptops on overseas trips, Gurley said. In Canada, one law firm has instructed its lawyers to travel to the United States with "blank laptops" whose hard drives contain no data. "We just access our information through the Internet," said Lou Brzezinski, a partner at Blaney McMurtry, a major Toronto law firm. That approach also holds risks, but "those are hacking risks as opposed to search risks," he said.

washingtonpost.com

[ZNFYRH]

I think this is very interesting.

Unfortunately, details as to whether it was a personal machine or corporate machine are not readily available, but still.

The password is, almost literally, intellectual property.

If the laptop was actually his, it's not like they are having him surrender access to something he doesn't own. It's his laptop.

[Compugasm]

There is a lot of details missing. Like, did everyone just stand in line while he opened the computer case, maybe fumbled for a mouse, booted Windows..? That's at least 3-5minutes. Then, did anyone ask the guard where the pictures were? On the desktop, MyDocuments folder, or did he Explore the file system? That's another minute or two, even if he beelined right to the My Documents folder.

[Jack]

booted Windows...That's at least 3-5minutes

There, now that reads more accurately.

I recently flew to San Jose and back. They had areas behind the screener's stations where the took the people who were being inspected more rigorously. I would suspect that's what they did here, too...pulled him aside, out of the way, for further inspection.

BTW-I was warned before leaving that they might make me turn on my laptop and Nokia mini-PC, but they didn't. I was traveling with quite a few pieces of electronics and they passed them all right through. Must be my trustworthy continence.

[tivodan1116]

Quote by: Compugasm But why would this dude let a border guard rummage around through his computer?

Because if you want to enter the country, you have no choice.

[caphis]

I find this to be a very interesting and unique situation; one of many we are sure to face as technology improves.

On one hand, I completely agree that the password itself is intellectual property and that by being forced to divulge it, the subject is losing his right against self incrimination.

On the other hand, the government has the authority to seize his property containing the evidence. In this case, they seized his laptop and, essentially, all files therein.

The case gets even muddier when you compare it to similar, existing cases. Take the following scenario, for example:

Someone claims to have seen you commit murder. You have since removed the victim's body and destroyed all evidence to a secure location only known to you. The police apprehend you based on a witness' testimony. The DA knows that the case is iffy without a corpse; but, they have a reliable eyewitness who saw you do the deed. Would a court order compelling you to name the location of the corpse be appropriate? By revealing where you stashed the body, you're incriminating yourself.

In this case, though, I'm inclined to side with the defendant. The police took the legal action available to them -- seizing the laptop and all files therein. It is now their job and their burden to prove guilt by producing the evidence. If they are unable to decrypt the files they need to make their case, then the defendant should not be required to do their job for them. It's kind of akin to seizing a 1 terabyte hard drive containing 5 million JPEGs and requiring the suspect to direct the investigators to the exact photo needed to convict him.

The only difference is, in the hypothetical, the police can find that one photo eventually. PGP is, for all intents and purposes, going to be impossible for the cops to break. Still, though, I don't think the suspect should be compelled to aid them in their prosecution case, or to make any statement (including a password) that could lead to his self-incrimination.

[Suburbanite]

I keep my porn in a folder on my desk top called porn and i bet a security guard an an airport couldnt find it in an hour