1-16-2008 Texas
Government investigators were able to easily break the ZIP file encryption that a Texas man allegedly used to conceal illegal images, a recent court case shows.
The investigation of John Craig Zimmerman began when his employer, the Brownsville Fire Department, received an anonymous voice message in February 2007 alleging that Zimmerman was a pedophile and had child pornography on his department-owned work computer. A city programmer named Albert Castillo searched Zimmerman's computer and found adult pornography (technically a violation of department policy but not a crime) on an external hard drive.
What Castillo also found were some password-protected ZIP files titled "Cindy 5." Castillo apparently used a program called Zipkey 5.5 to brute-force at least some of the password-protected files and find images of a partly naked minor.
Homeland Security's Immigration and Customs Enforcement agents were called in, and volunteered that they had information from a previous investigation showing that Zimmerman previously bought a membership on a child porn Web site. (Left unanswered is why, if that was in fact the case, ICE never did anything about it.)
What happened next: Zimmermann's home was raided with a search warrant, additional images he allegedly took himself were found, he was indicted on counts of receiving and possessing child pornography, and he pleaded no contest except to say that the images had nothing to do with interstate commerce. In an opinion dated December 20, U.S. District Judge Andrew Hanen said there was a "rational basis" to assume that child pornography transmissions related to interstate commerce.
I mention this case not to show that there's something remarkable about decrypting one of the older ZIP archives: the symmetric encryption algorithm used has long been known to be anything but secure. Newer WinZip archives, starting with WinZip 9.0, use more secure 128- and 256-bit key AES encryption.
The reason I'm mentioning this case is to argue that as encryption becomes more widespread--it's part of OS X and Vista, after all--police will encounter it more frequently, and not just in cases involving illegal images. And not all encrypted files will be as easy to brute-force. Which means that the outcome of the Boucher case becomes more important than ever. ..more.. by Declan McCullagh
January 18, 2008
Child porn defendant locked up after ZIP file encryption broken
January 16, 2008
Pretty Good Privacy Causes Legal Problems for a Vermont Court
1-16-2008 Vermont:
Pretty Good Privacy is an encryption software used to protect computer files. One Canadian man, Sebastian Boucher, uses the PGP program to protect certain files, and those certain password protection files are the focus of the US District Court in Vermont.
The 30 year old drywall installer is a Canadian citizen with legal residency in Vermont. On December 17, 2006 Boucher was driving to Vermont from Canada when he was stopped by a US Customs & Border Protection investigator. After searching the car, Boucher‘s laptop was discovered.
Suspecting the computer contained child porn, after reading the title of a file named, Two-year-old being raped during diaper change, the investigator asked Boucher to show him the folder his downloaded files. The investigator saw a file of a preteen undressing and performing acts. Boucher was then arrested and charged with transportation of child pornography in interstate or foreign commerce.
The laptop was seized, however, authorities were not able to gain access onto the computer’s Z drive since it was password protected by Pretty Good Privacy. So begins the court room dilemma.
Boucher is being asked to provide the password to open the Z drive, however Magistrate Judge Jerome J. Niedermeier says “If Boucher does know the password, he would be faced with the forbidden trilemma: incriminate himself, lie under oath, or find himself in contempt of court.”
It’s a tricky case. A privacy and technology expert, Mark D. Rasch, says that ruling will be a “dangerous” one for law enforcement. “If it stands, it means that if you encrypt your documents, the government cannot force you to decrypt them…So you're going to see drug dealers and pedophiles encrypting their documents, secure in the knowledge that the police can't get at them." ..more.. by TransWorldNews
To read the court decision: CLICK
Court may demand porn suspect's computer password
1-16-2008 Vermont:
The federal government is asking a U.S. District Court in Vermont to order a man to type a password to unlock files on his computer, despite his claim that doing so would constitute self-incrimination.
The case, believed to be the first of its kind to reach this level, raises a digital-age issue about how to balance privacy and civil liberties against the government's responsibility to protect the public.
The case, which involves suspected possession of child pornography, comes as more Americans turn to encryption to protect the privacy and security of files on their laptops and thumb drives. FBI and Justice Department officials have said that encryption is allowing terrorists and criminals to communicate covertly.
On Nov. 29, Magistrate Judge Jerome Niedermeier ruled that compelling Sebastien Boucher, a 30- year-old drywall installer who lives in Vermont, to enter his password into his laptop would violate his Fifth Amendment right against self-incrimination.
Boucher had been stopped at the Canadian border, where a customs agent observed that files on his computer had titles that implied child pornography. The laptop was seized, but the encrypted files could not be opened.
The government has appealed, and the case is under grand jury investigation, said Boucher's attorney, James Boudreau of Boston.
The ruling is already prompting controversy.
"The consequence of this decision being upheld is that the government would have to find other methods to get this information," said Marc Rotenberg, executive director of the Electronic Privacy Information Center. "But that's . . . what the Fifth Amendment is intended to protect."
But Mark Rasch, a privacy and technology expert with FTI Consulting and a former federal prosecutor, said the ruling was "dangerous" for law enforcement.
"You're going to see drug dealers and pedophiles encrypting their documents, secure in the knowledge that the police can't get at them," he said. ..more.. by Ellen Nakashima, The Washington Post
