[Infowarrior] - US Seeks to Force Suspect to Reveal Password to Computer Files

[Richard Forno]

In Child Porn Case, a Digital Dilemma
U.S. Seeks to Force Suspect to Reveal Password to Computer Files

By Ellen Nakashima
Washington Post Staff Writer
Wednesday, January 16, 2008; A01

http://www.washingtonpost.com/wp-dyn/content/article/2008/01/15/AR2008011503
663_pf.html

The federal government is asking a U.S. District Court in Vermont to order a
man to type a password that would unlock files on his computer, despite his
claim that doing so would constitute self-incrimination.

The case, believed to be the first of its kind to reach this level, raises a
uniquely digital-age question about how to balance privacy and civil
liberties against the government's responsibility to protect the public.

The case, which involves suspected possession of child pornography, comes as
more Americans turn to encryption to protect the privacy and security of
files on their laptops and thumb drives. FBI and Justice Department
officials, meanwhile, have said that encryption is allowing terrorists and
criminals to communicate their plots covertly.

Criminals and terrorists are using "relatively inexpensive, off-the-shelf
encryption products," said John Miller, the FBI's assistant director of
public affairs. "When the intent . . . is purely to hide evidence of a crime
. . . there needs to be a logical and constitutionally sound way for the
courts" to allow law enforcement access to the evidence, he said.

On Nov. 29, Magistrate Judge Jerome J. Niedermeier ruled that compelling
Sebastien Boucher, a 30-year-old drywall installer who lives in Vermont, to
enter his password into his laptop would violate his Fifth Amendment right
against self-incrimination. "If Boucher does know the password, he would be
faced with the forbidden trilemma: incriminate himself, lie under oath, or
find himself in contempt of court," the judge said.

The government has appealed, and the case is being investigated by a grand
jury, said Boucher's attorney, James Boudreau of Boston. He said it would be
"inappropriate" to comment while the case is pending. Justice Department
officials also declined to comment.

But the ruling has caused controversy.

"The consequence of this decision being upheld is that the government would
have to find other methods to get this information," said Marc Rotenberg,
executive director of the Electronic Privacy Information Center. "But that's
as it should be. That's what the Fifth Amendment is intended to protect."

Mark D. Rasch, a privacy and technology expert with FTI Consulting and a
former federal prosecutor, said the ruling was "dangerous" for law
enforcement. "If it stands, it means that if you encrypt your documents, the
government cannot force you to decrypt them," he said. "So you're going to
see drug dealers and pedophiles encrypting their documents, secure in the
knowledge that the police can't get at them."

The case began Dec. 17, 2006, when Boucher, a Canadian citizen with legal
residency in the United States, was driving from Canada into Vermont when he
was stopped at the border by a U.S. Customs and Border Protection inspector.
The inspector searched Boucher's car and found a laptop in the back seat,
according to an affidavit filed with the court by Mark Curtis, a special
agent with Immigration and Customs Enforcement who was called in by the
inspector.

Boucher said the laptop was his, according to the affidavit. When the
inspector saw files with titles such as "Two-year-old being raped during
diaper change," he asked Boucher if the laptop contained child pornography.
Boucher said he did not know because he was not able to check his temporary
Internet files, according to the affidavit.

Curtis asked Boucher "to use the computer" to show him the files he
downloads. Curtis reviewed the video files, observing one that appeared to
be a preteen undressing and performing a sexual act, among other graphic
images, the affidavit says.

Boucher was arrested and charged with transportation of child pornography in
interstate or foreign commerce, which can carry a sentence of up to 20 years
in prison for a first offense.

The agents seized the laptop, and a Vermont Department of Corrections
investigator copied its contents. But the investigator could not get access
to the drive Z content because it was protected by Pretty Good Privacy, a
form of encryption software used by intelligence agencies in the United
States and around the world that is widely available online. PGP, like all
encryption algorithms, requires a password for decryption.

For more than a year, the government has been unable to view drive Z.

A government computer forensics expert testified that it is "nearly
impossible" to access the files without the password, the judge wrote.
"There are no 'back doors' or secret entrances to access the files," he
wrote. "The only way to get access without the password is to use an
automated system which repeatedly guesses passwords. According to the
government, the process to unlock drive Z could take years . . . "

In his ruling, Niedermeier said forcing Boucher to enter his password would
be like asking him to reveal the combination to a safe. The government can
force a person to give up the key to a safe because a key is physical, not
in a person's mind. But a person cannot be compelled to give up a safe
combination because that would "convey the contents of one's mind,'' which
is a "testimonial" act protected by the Fifth Amendment, Niedermeier said .

In a phone interview, Boucher said that he likes to download Japanese
cartoons and occasionally adult pornography, but that he does not seek to
view child porn. He sometimes inadvertently receives images of child
pornography when he downloads the other material, but reviews what he
downloads to "clean out" the child porn, he said. It is not illegal to
possess animated child porn.

He said that he agreed to show the agents where he downloaded his files
"because I was sure that there was nothing bad in those files." He also said
that he felt coerced: "I felt like they really want to force me to do it,
like I have no choice."

Asked whether he typed in a password to unlock the drive so the agents could
view it, he replied: "I prefer not to answer that one."

Boucher added the encryption software to protect the rest of his computer
from viruses that might accompany the downloaded files, he said.

Orin S. Kerr, an expert in computer crime law at George Washington
University, said that Boucher lost his Fifth Amendment privilege when he
admitted that it was his computer and that he stored images in the encrypted
part of the hard drive. "If you admit something to the government, you give
up the right against self-incrimination later on," said Kerr, a former
federal prosecutor.

Lee Tien, senior staff attorney at the Electronic Frontier Foundation, a
civil liberties group, said encryption is one of the few ways people can
protect what they write, read and watch online. "The last line of defense
really is you holding your own password," he said. "That's what's at stake
here."

Staff researcher Magda Jean-Louis contributed to this report.