0

During an investigation where one is a suspect or one may have information about a suspect, is one required to relinquish passwords or keys to personal encrypted data to the authorities?

For example maybe someone has data on their personal computer in an encrypted container, data that is used or pertaining to a crime, stolen media, stolen government documents, or data that can be used to solve a crime.

The authorities have evidence that is beyond reasonable doubt that the encrypted data contains such files pertaining to the crime. This container may contain other sensitive data that does not pertain to any crime such as Social Security Numbers if that makes a difference. Does that person legally need to relinquish password or keys if asked by authorities?

This question makes me think, how secure is an encrypted file in a world run by people? Can the police come in my door, steal my computer and hold me in jail until I give up my passwords?

This question can also pertain to a company and consumer relationship where the company may hold encryption keys to consumers data.

UPDATE I'm not involved in any criminal trail nor do i have anything illegal. When does legal intervention require someone to relinquish the security of encryption? I am not one to judge when its ethically right to give up encryption keys i was just wondering when its required.

closed as off-topic by Neil Smithline, Xander, RoraΖ, user45139, schroeder Sep 28 '15 at 20:11

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Neil Smithline, Xander, RoraΖ, Community, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 7
    What country are you in? – Mark Sep 28 '15 at 5:31
  • Physical security does usually trump computer security, examples: Rubber Hose Cryptanalysis en.wikipedia.org/wiki/Rubber-hose_cryptanalysis and the Evil Maid Attack schneier.com/blog/archives/2009/10/evil_maid_attac.html – Andrew Russell Sep 28 '15 at 6:48
  • 10
    Seek legal advice from an attorney in your country of residence / country of criminal investigation. The current correct answer is Yes/No/Maybe. – Fiasco Labs Sep 28 '15 at 6:48
  • This seems like a better question for law.se . Although AFAIK in the U.S. they can't legally force you to reveal any information. If you perjure yourself by claiming you don't have the keys, that could be a problem, but if you just plead the fifth I don't see what they could accuse you of. But then, I'm not an attorney. Ask an attorney. – Parthian Shot Sep 28 '15 at 15:51
  • Lol don't worry I'm not in any trouble nor do i have any documents that are involved in any criminal trail. I just wanted to know when a legal intervention could force one to lose the security of encryption. – user26409 Sep 28 '15 at 16:03
2

Short answer: Yes. Long Answer: In most countries, not without cause. Sadly since I live in the USA I can't really speak for other countries, but I can say that in this one they can. Wikipedia has more information than I do of other countries laws, but of course it's Wikipedia. Check the sources. There's been a number of high profile court cases in the USA where it's been ruled that there is no right where data can be kept encrypted(Much like anything you write can be used to persecute you, data is the same) under the fifth amendment during investigations if ordered in a court of law. Here we have the right to keep silent which says we can't verbally incriminate ourselves, but if we have incriminated ourselves in the past with our data, well we're up a creek. If ordered you are in fact required to provide that data unencrypted just like if you were ordered to provide documents, because that is exactly what you are doing, because you have been ordered to provide the documents on your computer that you have written. Even if they are as simple as encrypted transaction receipts, yes you have to decrypt them if they court order you too. Of course if you're not doing anything that would cause you to have too, then you won't have too. Stay safe, and stay out of trouble is a rule of thumb that can easily prevent this from happening.

3

This depends on the jurisdiction and local laws.

In some countries, you may be detained or fined for refusing to surrender encryption key or to decrypt encrypted data. This is called either key disclosure or mandatory decryption laws. In most civilized countries, enacting such laws requires warrants or court orders and may not be enacted with just probable cause. On others, even customs officer may be able to force you to decrypt data.

Not the answer you're looking for? Browse other questions tagged or ask your own question.