Risk
7/14/2011
04:54 PM
Connect Directly
RSS
E-Mail
50%
50%

Court Case Tests Right To Withhold Passwords

The Department of Justice is attempting to compel a defendant to share her hard drive encryption key, which might violate her Fifth Amendment rights against self-incrimination.

Does the constitutional right against self-incrimination give a criminal defendant the right to withhold computer passwords that law enforcement could used to decrypt a hard drive and obtain evidence against that defendant? That question is at the root of a Colorado court case centering on multiple mortgage fraud schemes, and a defendant's encrypted laptop.

In particular, an indictment returned by a Denver grand jury on Oct. 1, 2010, charged Ramona Fricosu (aka Ramona Smith), 36, of Peyton, Colo., among other defendants, with multiple counts of bank fraud, wire fraud, money laundering, and making false statements to a financial institution.

As part of that investigation, law enforcement agents obtained a search warrant for Fricosu's house, which she shares with her mother, two children, and formerly shared with Scott Whatcott (aka Michael Scott Smith), 36, also a defendant in the case. As part of that search, investigators seized multiple computers and storage devices, including a Toshiba Satellite M305 laptop.

After obtaining another search warrant to search the laptop, investigators found that the contents had been encrypted. Accordingly, prosecutors demanded that Fricosu enter her password into the laptop, enabling them to decrypt the drive, or else provide them with a complete copy of the decrypted data.

But her attorney, Philip L. Dubois, has argued that doing so would violate her Fifth Amendment rights against self-incrimination. Dubois himself is no stranger to encryption, having previously defended Philip Zimmermann, who created Pretty Good Privacy (PGP) encryption software in 1991. Shortly after its introduction, the software became available abroad, which led to a Customs Service investigation in which Zimmermann was accused of breaking the Arms Export Control Act, for exporting strong cryptographic software, which was then classified as munitions. The investigation ended after three years; no charges were filed.

Backing Dubois's position is the Electronic Freedom Foundation (EFF), which filed an amicus brief on Friday, arguing that compelling Fricosu to divulge her password would violate her Fifth Amendment rights. "Decrypting the data on the laptop can be, in and of itself, a testimonial act--revealing control over a computer and the files on it," said Electronic Freedom Foundation (EFF) senior staff attorney Marcia Hofmann, in a statement. "Ordering the defendant to enter an encryption password puts her in the situation the Fifth Amendment was designed to prevent: having to choose between incriminating herself, lying under oath, or risking contempt of court."

According to the EFF, "the government has offered Fricosu some limited immunity in this case, but has not given adequate guarantees that it won't use the information on the computer against her." Notably, anything that prosecutors found on the computer--related to the case or not--could be used against her.

Authorities have accused Fricosu and Whatcott of defrauding multiple financial institutions and commercial lenders, including Wells Fargo Home Mortgage, USAA Federal Savings Bank, and Sun Trust Mortgage. "During the scheme to defraud, Whatcott and Fricosu located sellers in the Colorado Springs area who sought to sell their homes due to imminent foreclosure or the sellers' relocation away from Colorado," according to a statement released by the U.S. Attorney's Office for the District of Colorado. "Whatcott would tell each owner that he wished to buy the home and that he would obtain a new mortgage or assume the existing mortgage."

According to the indictment, after convincing homeowners to transfer their properties to Whatcott, he and Fricosu took over the mortgage payments, while also fraudulently obtaining the title to these homes. "Once the title was obtained, they would sell the property, receiving the sales proceeds without paying the outstanding mortgage," alleged prosecutors.

Prosecutors have argued that Fricosu should be compelled to decrypt the seized laptop hard drive, because taped conversations between her and Whatcott include references to a laptop. But according to the EFF, prosecutors haven't identified the seized laptop as the one referred to in those taped conversations, and furthermore prosecutors don't know what's on the laptop.

"The government cannot identify the evidence it hopes to find with any specificity," according to the EFF's brief. "New technologies present new challenges for law enforcement, but this reality does not justify the abandonment of well-established constitutional protections that secure individuals' rights."

The next hearing in the case is scheduled for July 22.

In the new, all-digital Dark Reading supplement: What industry can teach government about IT innovation and efficiency. Also in this issue: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-3828
Published: 2014-10-22
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.