Risk
7/14/2011
04:54 PM
Connect Directly
RSS
E-Mail
50%
50%

Court Case Tests Right To Withhold Passwords

The Department of Justice is attempting to compel a defendant to share her hard drive encryption key, which might violate her Fifth Amendment rights against self-incrimination.

Does the constitutional right against self-incrimination give a criminal defendant the right to withhold computer passwords that law enforcement could used to decrypt a hard drive and obtain evidence against that defendant? That question is at the root of a Colorado court case centering on multiple mortgage fraud schemes, and a defendant's encrypted laptop.

In particular, an indictment returned by a Denver grand jury on Oct. 1, 2010, charged Ramona Fricosu (aka Ramona Smith), 36, of Peyton, Colo., among other defendants, with multiple counts of bank fraud, wire fraud, money laundering, and making false statements to a financial institution.

As part of that investigation, law enforcement agents obtained a search warrant for Fricosu's house, which she shares with her mother, two children, and formerly shared with Scott Whatcott (aka Michael Scott Smith), 36, also a defendant in the case. As part of that search, investigators seized multiple computers and storage devices, including a Toshiba Satellite M305 laptop.

After obtaining another search warrant to search the laptop, investigators found that the contents had been encrypted. Accordingly, prosecutors demanded that Fricosu enter her password into the laptop, enabling them to decrypt the drive, or else provide them with a complete copy of the decrypted data.

But her attorney, Philip L. Dubois, has argued that doing so would violate her Fifth Amendment rights against self-incrimination. Dubois himself is no stranger to encryption, having previously defended Philip Zimmermann, who created Pretty Good Privacy (PGP) encryption software in 1991. Shortly after its introduction, the software became available abroad, which led to a Customs Service investigation in which Zimmermann was accused of breaking the Arms Export Control Act, for exporting strong cryptographic software, which was then classified as munitions. The investigation ended after three years; no charges were filed.

Backing Dubois's position is the Electronic Freedom Foundation (EFF), which filed an amicus brief on Friday, arguing that compelling Fricosu to divulge her password would violate her Fifth Amendment rights. "Decrypting the data on the laptop can be, in and of itself, a testimonial act--revealing control over a computer and the files on it," said Electronic Freedom Foundation (EFF) senior staff attorney Marcia Hofmann, in a statement. "Ordering the defendant to enter an encryption password puts her in the situation the Fifth Amendment was designed to prevent: having to choose between incriminating herself, lying under oath, or risking contempt of court."

According to the EFF, "the government has offered Fricosu some limited immunity in this case, but has not given adequate guarantees that it won't use the information on the computer against her." Notably, anything that prosecutors found on the computer--related to the case or not--could be used against her.

Authorities have accused Fricosu and Whatcott of defrauding multiple financial institutions and commercial lenders, including Wells Fargo Home Mortgage, USAA Federal Savings Bank, and Sun Trust Mortgage. "During the scheme to defraud, Whatcott and Fricosu located sellers in the Colorado Springs area who sought to sell their homes due to imminent foreclosure or the sellers' relocation away from Colorado," according to a statement released by the U.S. Attorney's Office for the District of Colorado. "Whatcott would tell each owner that he wished to buy the home and that he would obtain a new mortgage or assume the existing mortgage."

According to the indictment, after convincing homeowners to transfer their properties to Whatcott, he and Fricosu took over the mortgage payments, while also fraudulently obtaining the title to these homes. "Once the title was obtained, they would sell the property, receiving the sales proceeds without paying the outstanding mortgage," alleged prosecutors.

Prosecutors have argued that Fricosu should be compelled to decrypt the seized laptop hard drive, because taped conversations between her and Whatcott include references to a laptop. But according to the EFF, prosecutors haven't identified the seized laptop as the one referred to in those taped conversations, and furthermore prosecutors don't know what's on the laptop.

"The government cannot identify the evidence it hopes to find with any specificity," according to the EFF's brief. "New technologies present new challenges for law enforcement, but this reality does not justify the abandonment of well-established constitutional protections that secure individuals' rights."

The next hearing in the case is scheduled for July 22.

In the new, all-digital Dark Reading supplement: What industry can teach government about IT innovation and efficiency. Also in this issue: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.