Risk
7/14/2011
04:54 PM
50%
50%

Court Case Tests Right To Withhold Passwords

The Department of Justice is attempting to compel a defendant to share her hard drive encryption key, which might violate her Fifth Amendment rights against self-incrimination.

Does the constitutional right against self-incrimination give a criminal defendant the right to withhold computer passwords that law enforcement could used to decrypt a hard drive and obtain evidence against that defendant? That question is at the root of a Colorado court case centering on multiple mortgage fraud schemes, and a defendant's encrypted laptop.

In particular, an indictment returned by a Denver grand jury on Oct. 1, 2010, charged Ramona Fricosu (aka Ramona Smith), 36, of Peyton, Colo., among other defendants, with multiple counts of bank fraud, wire fraud, money laundering, and making false statements to a financial institution.

As part of that investigation, law enforcement agents obtained a search warrant for Fricosu's house, which she shares with her mother, two children, and formerly shared with Scott Whatcott (aka Michael Scott Smith), 36, also a defendant in the case. As part of that search, investigators seized multiple computers and storage devices, including a Toshiba Satellite M305 laptop.

After obtaining another search warrant to search the laptop, investigators found that the contents had been encrypted. Accordingly, prosecutors demanded that Fricosu enter her password into the laptop, enabling them to decrypt the drive, or else provide them with a complete copy of the decrypted data.

But her attorney, Philip L. Dubois, has argued that doing so would violate her Fifth Amendment rights against self-incrimination. Dubois himself is no stranger to encryption, having previously defended Philip Zimmermann, who created Pretty Good Privacy (PGP) encryption software in 1991. Shortly after its introduction, the software became available abroad, which led to a Customs Service investigation in which Zimmermann was accused of breaking the Arms Export Control Act, for exporting strong cryptographic software, which was then classified as munitions. The investigation ended after three years; no charges were filed.

Backing Dubois's position is the Electronic Freedom Foundation (EFF), which filed an amicus brief on Friday, arguing that compelling Fricosu to divulge her password would violate her Fifth Amendment rights. "Decrypting the data on the laptop can be, in and of itself, a testimonial act--revealing control over a computer and the files on it," said Electronic Freedom Foundation (EFF) senior staff attorney Marcia Hofmann, in a statement. "Ordering the defendant to enter an encryption password puts her in the situation the Fifth Amendment was designed to prevent: having to choose between incriminating herself, lying under oath, or risking contempt of court."

According to the EFF, "the government has offered Fricosu some limited immunity in this case, but has not given adequate guarantees that it won't use the information on the computer against her." Notably, anything that prosecutors found on the computer--related to the case or not--could be used against her.

Authorities have accused Fricosu and Whatcott of defrauding multiple financial institutions and commercial lenders, including Wells Fargo Home Mortgage, USAA Federal Savings Bank, and Sun Trust Mortgage. "During the scheme to defraud, Whatcott and Fricosu located sellers in the Colorado Springs area who sought to sell their homes due to imminent foreclosure or the sellers' relocation away from Colorado," according to a statement released by the U.S. Attorney's Office for the District of Colorado. "Whatcott would tell each owner that he wished to buy the home and that he would obtain a new mortgage or assume the existing mortgage."

According to the indictment, after convincing homeowners to transfer their properties to Whatcott, he and Fricosu took over the mortgage payments, while also fraudulently obtaining the title to these homes. "Once the title was obtained, they would sell the property, receiving the sales proceeds without paying the outstanding mortgage," alleged prosecutors.

Prosecutors have argued that Fricosu should be compelled to decrypt the seized laptop hard drive, because taped conversations between her and Whatcott include references to a laptop. But according to the EFF, prosecutors haven't identified the seized laptop as the one referred to in those taped conversations, and furthermore prosecutors don't know what's on the laptop.

"The government cannot identify the evidence it hopes to find with any specificity," according to the EFF's brief. "New technologies present new challenges for law enforcement, but this reality does not justify the abandonment of well-established constitutional protections that secure individuals' rights."

The next hearing in the case is scheduled for July 22.

In the new, all-digital Dark Reading supplement: What industry can teach government about IT innovation and efficiency. Also in this issue: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.