5th protect password?

>> From: Hal <hfinney@shell.portal.com>
>> I have been quite appalled to read the various analyses on the net (URLs
>> not handy, but they have been posted here before I think) which conclude
>> that compelled disclosure of a cryptographic pass phrase would probably
>> be OK despite the Fifth Amendment.  This seems to be an area where there
>> is widespread agreement based on recent precedent.

>> from: --Tim May
>> What about the Fifth Amendment? Scholars are addressing this issue of
>> compelled disclosure of cryptographic keys. Note, of course, that diaries,
>> business records, papers, and, indeed, the entire contents of a putative
>> crime scene are accessible to crime investigators and the legal system.
>> (Whether giving up a key constitutes "testifying against one's self" or not
>> is undecided, so far as I know. My own inclination is that it will be
>> decided to be no different than the key to a locked diary--by itself, it is
>> not self-incrimination.)

Is this really an issue?  I am not an expert, but I just read a
Supreme Court case:

   DOE v. United States, 487 U.S. 201; 108 S. Ct. 2341 (1988)

It involved someone who was ordered by the court to consent to the
Cayman Islands bank to turn over account records.  The Supreme
Court said yes, because it is "more like 'be[ing] forced to
surrender a key to a strongbox containing incriminating documents'
than it is like 'be[ing] compelled to reveal the combination to
[petitioner's] wall safe.'"

The quote refers to Stevens' dissent, which said:

   A defendant can be compelled to produce material evidence that
   is incriminating.  Fingerprints, blood samples, voice
   exemplars, handwriting specimens, or other items of physical
   evidence may be extracted from a defendant against his will.
   But can he be compelled to use his mind to assist the
   prosecution in convicting him of a crime?  I think not.  He may
   in some cases be forced to surrender a key to a strongbox
   containing incriminating documents, but I do not believe he can
   be compelled to reveal the combination to his wall safe -- by
   word or deed.

I conclude that in a criminal case, all of the supreme court
justices agree that a criminal defendant cannot be forced to
reveal the combination to a wall safe, or any other information in
his mind, by the Fifth Amendment.

An escrow agent can presumably be compelled, unless his is accused
of a crime, or has a privilege, or is outside jurisdiction.
Interestingly, a footnote in the above case said:

   The Government of the Cayman Islands maintains that a compelled
   consent, such as the one at issue in this case, is not
   sufficient to authorize the release of confidential financial
   records protected by Cayman law.

Sounds like the Cayman Islands might be a good place for your key
escrow agents.

Roger Schlafly

Roger  Schlafly sez:
+    [quotes from]
+    DOE v. United States, 487 U.S. 201; 108 S. Ct. 2341 (1988)
+ ...
+ I conclude that in a criminal case, all of the supreme court
+ justices agree that a criminal defendant cannot be forced to
+ reveal the combination to a wall safe, or any other information in
+ his mind, by the Fifth Amendment.

Except that the Fifth Amendment is not limited to "criminal cases" in
the way one might ordinarily understand that phrase.  One may assert
the Fifth Amendment in a civil case, in an administrative proceeding,
at a legislative hearing, or, indeed, in the absence of any formal
proceeding.  See _Kastigar_. 

(I posted a summary of Doe II just the other day.  Did it not reach
the list?)

Also, "any other information" is a little too broad.  You can be
forced to reveal "pedigree" information such as name and DOB.  See
_Penna. v. Muniz_ (1990).  Asking an apparently drunk driver the date
of his sixth birthday (as part of a DWI test) is, however, an effort
to elicit Fifth Amendment "testimony"; given the added factors of
potential incrimination and compulsion (implicit in custodial
interrogation sans Miranda warnings), the privilege may be validly
exercised in response to such a question.  See ibid.

The much more interesting question, from a legal perspective, is what
happens if your key/password/passphrase is written/stored on physical
media.

On Fri, 19 Apr 1996, Roger Schlafly wrote:

> 
> An escrow agent can presumably be compelled, unless his is accused
> of a crime, or has a privilege, or is outside jurisdiction.
> Interestingly, a footnote in the above case said:
> 
>    The Government of the Cayman Islands maintains that a compelled
>    consent, such as the one at issue in this case, is not
>    sufficient to authorize the release of confidential financial
>    records protected by Cayman law.
> 
> Sounds like the Cayman Islands might be a good place for your key
> escrow agents.

Currently, no better than the United States.

First, the Cayman Islands law refers primarily (if not exclusively) to 
financial information.  

Second, the judicial blocking provisions in the Caymans have been much 
reduced by the U.S. Mutual Legal Assistance treaty that penetrates 
banking secrecy when it is interfering with a criminal investigation 
involving money laundering or a series of other crimes.

Third, even in the event your escrow information was protected the court 
would be much more successful simply by trying to compel the defendant 
through contempt sanctions.  (It's not always enough to put data overseas, 
particularly where you're still sitting in the U.S. or otherwise within 
the court's jurisdiction).

Fourth, prosecutors don't typically bother to try and compell [escrow] 
agents, but instead seek "consent orders" from defendants instructing the 
agent to release the information.

So, in sum, the Caymans law doesn't have anything to do with 
non-financial information safekeeping.  Even if it did, a criminal 
investigation that would be interesting enough to try and seek non-tax 
and non-financial information from an agent in the Islands would almost 
certainly trigger the secrecy penetration clauses of the Mutual Legal 
Assistance Treaty.  And finally, the fact that they cant get your data is 
not going to protect you from a major main in the rump.

The large article I posted to the list goes into these points in detail in 
the context of protecting financial information and assets.  If you would 
like another copy, please let me know.

> 
> Roger Schlafly
> 

---
My preferred and soon to be permanent e-mail address:unicorn@schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell@pacifier.com