Risk
7/14/2011
04:54 PM
Connect Directly
RSS
E-Mail
50%
50%

Court Case Tests Right To Withhold Passwords

The Department of Justice is attempting to compel a defendant to share her hard drive encryption key, which might violate her Fifth Amendment rights against self-incrimination.

Does the constitutional right against self-incrimination give a criminal defendant the right to withhold computer passwords that law enforcement could used to decrypt a hard drive and obtain evidence against that defendant? That question is at the root of a Colorado court case centering on multiple mortgage fraud schemes, and a defendant's encrypted laptop.

In particular, an indictment returned by a Denver grand jury on Oct. 1, 2010, charged Ramona Fricosu (aka Ramona Smith), 36, of Peyton, Colo., among other defendants, with multiple counts of bank fraud, wire fraud, money laundering, and making false statements to a financial institution.

As part of that investigation, law enforcement agents obtained a search warrant for Fricosu's house, which she shares with her mother, two children, and formerly shared with Scott Whatcott (aka Michael Scott Smith), 36, also a defendant in the case. As part of that search, investigators seized multiple computers and storage devices, including a Toshiba Satellite M305 laptop.

After obtaining another search warrant to search the laptop, investigators found that the contents had been encrypted. Accordingly, prosecutors demanded that Fricosu enter her password into the laptop, enabling them to decrypt the drive, or else provide them with a complete copy of the decrypted data.

But her attorney, Philip L. Dubois, has argued that doing so would violate her Fifth Amendment rights against self-incrimination. Dubois himself is no stranger to encryption, having previously defended Philip Zimmermann, who created Pretty Good Privacy (PGP) encryption software in 1991. Shortly after its introduction, the software became available abroad, which led to a Customs Service investigation in which Zimmermann was accused of breaking the Arms Export Control Act, for exporting strong cryptographic software, which was then classified as munitions. The investigation ended after three years; no charges were filed.

Backing Dubois's position is the Electronic Freedom Foundation (EFF), which filed an amicus brief on Friday, arguing that compelling Fricosu to divulge her password would violate her Fifth Amendment rights. "Decrypting the data on the laptop can be, in and of itself, a testimonial act--revealing control over a computer and the files on it," said Electronic Freedom Foundation (EFF) senior staff attorney Marcia Hofmann, in a statement. "Ordering the defendant to enter an encryption password puts her in the situation the Fifth Amendment was designed to prevent: having to choose between incriminating herself, lying under oath, or risking contempt of court."

According to the EFF, "the government has offered Fricosu some limited immunity in this case, but has not given adequate guarantees that it won't use the information on the computer against her." Notably, anything that prosecutors found on the computer--related to the case or not--could be used against her.

Authorities have accused Fricosu and Whatcott of defrauding multiple financial institutions and commercial lenders, including Wells Fargo Home Mortgage, USAA Federal Savings Bank, and Sun Trust Mortgage. "During the scheme to defraud, Whatcott and Fricosu located sellers in the Colorado Springs area who sought to sell their homes due to imminent foreclosure or the sellers' relocation away from Colorado," according to a statement released by the U.S. Attorney's Office for the District of Colorado. "Whatcott would tell each owner that he wished to buy the home and that he would obtain a new mortgage or assume the existing mortgage."

According to the indictment, after convincing homeowners to transfer their properties to Whatcott, he and Fricosu took over the mortgage payments, while also fraudulently obtaining the title to these homes. "Once the title was obtained, they would sell the property, receiving the sales proceeds without paying the outstanding mortgage," alleged prosecutors.

Prosecutors have argued that Fricosu should be compelled to decrypt the seized laptop hard drive, because taped conversations between her and Whatcott include references to a laptop. But according to the EFF, prosecutors haven't identified the seized laptop as the one referred to in those taped conversations, and furthermore prosecutors don't know what's on the laptop.

"The government cannot identify the evidence it hopes to find with any specificity," according to the EFF's brief. "New technologies present new challenges for law enforcement, but this reality does not justify the abandonment of well-established constitutional protections that secure individuals' rights."

The next hearing in the case is scheduled for July 22.

In the new, all-digital Dark Reading supplement: What industry can teach government about IT innovation and efficiency. Also in this issue: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5619
Published: 2014-09-29
The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame.

CVE-2012-5621
Published: 2014-09-29
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.

CVE-2012-6107
Published: 2014-09-29
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2012-6110
Published: 2014-09-29
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.

CVE-2013-1874
Published: 2014-09-29
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.