Man jailed over computer password refusal

Here's an excerpt from my analysis of the Boucher case out of Vermont. It's called Is that an encrypted hard drive in your head?

"When humans partner with computers to transmit encrypted information to others over an internet channel, this transmission most closely resembles a direct transmission of thought between two parties. In the same way that we cannot regulate pure thought, we cannot effectively regulate possession and transmission of prohibited information goods on hard drives and across cyberspace, if users enable anonymity and encryption applications.

Consider, for instance, an obscene text written on paper. Now encrypt it on paper. Throw the original text away. This cipher text is not obscene. It is unreadable gibberish. It is difficult to argue that possession of the encrypted text alone constitutes possession of obscene or prohibited material. There are serious logical flaws that underlie the argument that possession or transmission of the same encrypted information on an information system, especially without direct access to the key, and perhaps not until the material is unencrypted, constitute an abuse of the law.

Sebastien Boucher was detained at the U.S./Canada border with his laptop and a special agent, upon review of file names that suggested Boucher was in possession of child porn and, supposedly, the agent’s view of actual files, seized both Boucher and his machine. An investigator assigned to copy and access the files could not access Drive Z, which was protected by PGP. U.S. Magistrate Judge Jerome Niedermeier wrote that forcing Boucher to give up his password would be akin to forcing a “testimonial act” as the key exists only in Boucher’s mind and is not a physical object. Thus, it would be a fifth amendment violation. Niedermeier’s analysis turns on a fifth amendement analysis, but its main underpinnings are expressed in thoughts expressed like this:

Unlike the situation in Doe II, Boucher would be compelled to produce his
thoughts and the contents of his mind. (emphasis added).In Doe II, the suspect was compelled to act to obtain access without indicating that he believed himself to have access. Here, when Boucher enters a password he indicates that he believes he has access.

This is eminently correct, but it begs a far more important question: how in the world, short of charging Boucher with contempt, could the government force Boucher to surrender his password? Even if they were empowered to do so, it is clear that the quest is fruitless. The reason this is so is because Boucher’s encrypted information is not actually pornography. It is encrypted information that can be reassembled, given the proper key, into pornography. The impossibility of forcing Boucher to reveal his key underscores this reality, as hard as this may be for law enforcement to bear. The information is only as accessible as Boucher’s mind. Thus, his possession of encyrpted materials, without more, is about as prohibited as the possession of his thoughts or memories in regard to this pornography. Due to his access to encryption, Boucher and his machine are an intertwined entity.

If we are to deal with information, we need to understand exactly what it is and what it is not. A computer, as stated above, offers storage of information and intelligence, which can be encrypted, and transmission of this same information and intelligence, a process wherein goods can be delivered both encrypted and anonymously, if desired. Interestingly, it is the ability to transmit information and intelligence anonymously, a conduit which has been examined far less frequently than encryption, which will offer irrefutable proof that we and our computers are inexorably intertwined, and, in essence, are of one mind, should we choose to avail ourselves of the technology that enables that state."

If anyone wants the whole paper, pm me.

 

I mean legally speaking, in a court of law, when it is not deemed within the scope of the Patriot Act. Even if you can get the info, the evidence may not be admissible.

 

@ nix

Interesting thoughts ! Please PM me the link

@ Pfipps

The Patriot Act was/is in the main, just a rouse to enable you know who to push through draconian measures that otherwise would not have passed, so they can now Without a warrant, do whatever/whenever they want to YOU and everyone

May not ? I wouldn't count on it !

 

[warning: old thread -- came across it while searching for info about choosing passwords]

So what happens if you forget the password?

How long can the courts hold someone in jail for lack of recollection regarding a certain detail? Can you be ordered to take a lie detector test?

 

Very good questions and to my knowledge there is are no answer to them yet:
No defendant so far has tried the "can't remember" defense.
I've read theoretically you could be jailed forever: you get sentenced for 2 years, they release you and ask you to hand over the password, you refuse and that's a new offense. double jeopardy doesn't apply and you get another 2 years. Go to one and repeat till you are dead. But IANAL and it sounds a bit too crazy to be true and again, there's been no such case so far.
Lie detector test? I don't think they are admissible as evidence in the UK at all.

 

In the UK, they have RIPA which compels a suspect to turn over his keys when requested by any LEA (I am not even sure they need a court order). The penalty for refusal is a 2 year stint in prison for cases that do not involve national security. For national security cases, the penalty can be 5 years or more.

In America we have no such legislation -- yet. So, the question is still open to legal interpretation by the courts. I imagine we will see a case like Boucher's reach SCOTUS sometime in the not so distant future.

So that's where we stand: until SCOTUS makes a final ruling, it will be up to the local/district judges to decide in individual cases. If you're lucky, you will get a judge like Niedermeier (who, by the way, has caused a lot of controversy in Vermont, and nationally, due to his lenient sentencing of convicted child rapists, which makes one wonder about the reasons for his "sympathy" in the Boucher case). If you're unlucky, you will get a judge that is swayed by the DA and/or FBI and they will throw you in the slammer for contempt.

 

This thread is about a defendant who used the 'can't remember' defence He was found guilty & imprisoned because a jury did not believe him. There was enough evidence to suggest he was lying (beyond reasonable doubt)

It is a defence if you don't remember the password, but the defence has to be plausible.

 

Thanks for that info, do you have further sources?
The bbc article linked in the OP here only said "he refused to give police the password to his computer" and searching the internet didn't bring up anything useful either.

 

This is an old article, but has more info than the BBC story. It's mostly a review of police media liaisons, but mentions why he was found guilty.

http://www.newstatesman.com/blogs/the-staggers/2010/10/police-drage-password-sex

 

Thank you.

There's plenty of material for a retrial. I'd label that as "didn't try too hard". It's standing to reason that this chap is really glad he got away with 16 weeks and didn't get charged with something else...

The prosecutor's argument that one can't memorise a 50 char password and therefore must have written it down somewhere is pretty flimsy. One could also bring the argument that the trial now was about the defendant failing to produce that alleged piece of paper that got the password on it.
But how's that different from forcing a murder suspect to reveal the location of the weapon he stashed _before_ the investigation was started? It's both good old physical evidence and that doesn't leave room to much interpretation.

So before a case like this goes up to the supreme court and then to the European Court of Justice if necessary I'll stand by what I said..

 

It was a 1 month trial, so have to assume there's heaps of corroborating evidence that we're not privy to which further implicates him as a liar. Perhaps the prosecution did not believe he used a 50 character password consisting of random letters and numbers, but rather defendant thought it was more plausible for him to forget a password of that length and complexity than a 10 character password. That didnt' work out for him. Guy got hung by his own noose. Prosecution used defendants statement against him.

In all likelyhood a bad guy that got 4 month sentence for not revealing password in lieu of a permanent place on the sex offenders registry & whatever custodial sentence that would have resulted (if any)

I just don't see this guy as a victim. The schizophrenic man that got 13 month sentence in 2009 for not revealing his password most certainly was a victim. Discussed here many times, but link for anyone who didn't know about 'JFL'
http://www.darkgovernment.com/news/crime-refusal-to-de-crypt/

 

Yep I agree. It is a small price to pay compared to a sex offense conviction. I think it said that he was just 19. Sheese. Just a kid himself.