[00:00.540 --> 00:03.160]  Thanks for coming, and I'm really excited to be here today.
[00:03.860 --> 00:04.940]  I'm Marcia Hofmann.
[00:05.100 --> 00:19.000]  I'm with the Electronic Frontier Foundation, and the inspiration for this talk actually was, for me, the last hope, which was one I was not here for.
[00:19.460 --> 00:22.140]  But how many of you were here for that, the last one?
[00:22.660 --> 00:29.920]  Okay, so I'm sure, as a lot of you know, Julian Assange was supposed to give a keynote at that conference.
[00:30.000 --> 00:32.620]  And he wasn't able to come.
[00:33.040 --> 00:36.400]  And so Jake Applebaum gave a talk in his place.
[00:36.860 --> 00:42.260]  And for quite some time after that, Jake got a lot of hassle.
[00:43.820 --> 01:06.020]  And, you know, I think that partly based on the fact that there is an ongoing criminal investigation into WikiLeaks, and partly based on the fact that there's a lot of investigative activity and prosecution activity around anonymous related things, I have gotten the sense over a period of time that there are a lot of people in this community that are nervous.
[01:06.640 --> 01:15.140]  And they're not nervous because they've done anything wrong, but they're nervous because they feel like they might be of interest to the police because they're part of this community.
[01:16.720 --> 01:29.420]  And so I wanted to talk about what happens when the police want to talk to you or what happens when they want to seize your computers or they want to seek information about you from a service provider.
[01:30.560 --> 01:44.260]  So what we're going to start off talking about today is, first of all, your legal rights when your computer or other device is seized and or searched by the police, what that means for you.
[01:45.340 --> 01:57.820]  Then I'm going to talk about your legal rights when the police seek data about you from third-party service providers like Twitter or Google or Dropbox or any other company out there that has data that you store with them.
[01:58.840 --> 02:06.620]  Then we're going to talk a little bit about interactions with the police and, you know, when they want to speak with you, what does that mean?
[02:07.080 --> 02:08.780]  Do you have to answer their questions?
[02:08.960 --> 02:10.760]  Do you not have to answer their questions?
[02:11.040 --> 02:12.100]  How do you behave with them?
[02:12.700 --> 02:29.900]  And then, related to that, I'm going to speak briefly, but not a whole lot, about the Fifth Amendment privilege against self-incrimination, particularly if the government tries to force you to disclose passwords or encryption passphrases or decrypted versions of data.
[02:30.760 --> 02:34.640]  So I need to start off by giving a standard disclaimer.
[02:34.880 --> 02:35.960]  I'm sorry, I'm a lawyer.
[02:36.140 --> 02:37.000]  You know how it is.
[02:37.280 --> 02:38.620]  This is not legal advice.
[02:38.620 --> 02:39.900]  This is legal information.
[02:40.240 --> 02:45.020]  If you have particular questions about your particular situation, you should speak with a lawyer about that.
[02:45.020 --> 02:49.100]  And my colleague, Hanni Fakhoury, could you stand up, Hanni?
[02:50.180 --> 02:51.520]  This is my colleague, Hanni.
[02:56.740 --> 02:58.640]  He's been with us for a little bit over a year.
[02:58.800 --> 03:03.480]  And before he came to EFF, he practiced criminal defense.
[03:03.900 --> 03:05.560]  He was a federal defender.
[03:05.880 --> 03:07.640]  And so I am here.
[03:07.760 --> 03:08.360]  Hanni's here.
[03:09.120 --> 03:12.620]  Feel free to come talk to us, and we are happy to chat with you.
[03:13.240 --> 03:17.060]  You should also feel free to contact EFF in the future, and we're happy to chat with you.
[03:17.820 --> 03:27.280]  If we figure out, based on our conversation, that we can't help you out or we're not the best people to help you out because somebody else has better expertise in that issue, we will try to find you someone to talk to.
[03:27.280 --> 03:32.520]  So, okay, first of all, searches and seizures of computers and the data on them.
[03:34.100 --> 03:45.440]  So, for purposes of this part of the talk, let's think of a scenario where a policeman shows up at your door and says, I have a warrant to do a search here.
[03:46.360 --> 03:49.940]  So, what is the constitutional right that comes into play?
[03:49.940 --> 03:51.560]  It's the Fourth Amendment.
[03:51.840 --> 03:56.780]  The Fourth Amendment protects us against unreasonable searches and seizures by the government.
[03:58.260 --> 04:09.860]  So, what it says very specifically is that it protects the right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures by the government.
[04:11.000 --> 04:18.760]  And something that's a little bit difficult in this day and age is the fact that, of course, this constitutional amendment was written a really long time ago.
[04:19.450 --> 04:22.900]  And, you know, they weren't really thinking about things like data.
[04:24.210 --> 04:41.440]  And so, courts have really struggled in this day and age to figure out how this constitutional amendment applies, considering that, you know, when originally conceived, it was supposed to, you know, protect your rights to be secure in your physical person,
[04:41.440 --> 04:49.150]  the space where you lived, and the things that you had, which, of course, did not include such, you know, such things as data.
[04:50.930 --> 05:01.520]  So, this is actually a very interesting constitutional amendment to talk about right now because the general basic test has changed a little bit just within the past few months.
[05:01.520 --> 05:04.770]  The Supreme Court decided a case called United States v. Jones, which is this kind of big landmark case.
[05:04.940 --> 05:07.650]  Jones, which is this kind of big landmark case.
[05:08.140 --> 05:13.290]  If some of you saw the ACLU's talk last night, you heard a little bit about that case.
[05:13.380 --> 05:17.560]  And I suspect Hanni's talk tomorrow, he will be talking about Jones quite a bit.
[05:17.560 --> 05:32.260]  It was a case looking at the question of whether the police have to get a warrant before attaching a GPS device to a car and then tracking a person over a period of 28 days.
[05:32.460 --> 05:43.980]  And the government said that, as a general matter, that counts as a Fourth Amendment search, but left open the question of whether, you know, of what kind of a search would be unreasonable in that kind of situation.
[05:43.980 --> 05:48.540]  Remember that the Fourth Amendment only protects against unreasonable searches and seizures.
[05:49.600 --> 05:55.730]  Okay, so, but here's the basic test as explained by the Supreme Court recently in United States v. Jones.
[05:56.320 --> 06:02.790]  The first thing we ask is, number one, is the government physically intruding on a person's property to gather information?
[06:03.600 --> 06:13.000]  The second question is, does the person have a reasonable expectation of privacy in the place to be searched or the things to be seized?
[06:13.000 --> 06:20.200]  Now, this concept of the reasonable expectation of privacy is something we're going to talk about quite a bit.
[06:20.520 --> 06:26.420]  And when I use that term, I mean two specific things.
[06:26.730 --> 06:34.320]  The first is, did the person actually subjectively believe that he or she had a reasonable expectation of privacy?
[06:34.320 --> 06:40.160]  And then more objectively, is that an expectation that society would generally recognize as reasonable?
[06:40.440 --> 06:41.980]  So keep both those things in mind.
[06:42.630 --> 06:54.280]  Now, if the answer to either of these questions is yes, then generally, the police have to get a warrant based on probable cause.
[06:56.190 --> 06:58.580]  And a judge has to approve it.
[07:00.060 --> 07:02.000]  What does probable cause mean?
[07:03.510 --> 07:21.600]  So, as a general matter, I would describe that term as meaning, if a reasonable person looked at the facts, then that person would believe that it is more likely than not that evidence of a crime is going to be found there.
[07:21.600 --> 07:22.220]  Okay?
[07:22.660 --> 07:26.840]  And so, what the police do is they explain the facts that they know to a judge.
[07:27.020 --> 07:30.280]  And they say, based on what we see here, we think we're going to find evidence of a crime.
[07:30.700 --> 07:34.080]  And if the judge agrees, then the warrant issues.
[07:34.820 --> 07:38.660]  And then they have authority to go conduct that search.
[07:39.690 --> 07:46.640]  Now, the warrant has to describe, with reasonable particularity, the places to be searched and the things to be seized.
[07:47.260 --> 07:53.110]  And if there's a warrant, and it affects your space and your things, you have the right to see it.
[07:53.380 --> 07:58.340]  And so, you will be able to know what they are authorized to search.
[07:59.720 --> 08:13.900]  And, you know, if you're in a situation where you are having a search conducted of your things, you know, you should take note and make sure that, you know, the things that they are searching and the places they are going don't go out of the bounds of that warrant.
[08:14.950 --> 08:20.500]  Now, if they do go out of the bounds of the warrant, you should not interfere with that by any means.
[08:20.500 --> 08:26.820]  You should not interfere with the search, but you should just take note and make sure that you have the identifying information of the officers.
[08:27.790 --> 08:29.900]  And then you would want to talk to a lawyer about that.
[08:30.290 --> 08:30.560]  All right?
[08:33.170 --> 08:41.540]  If they search your stuff and they take some of it, you might also want to talk to a lawyer later about the possibility of filing a motion for return of property.
[08:41.900 --> 08:43.320]  That's the way you get your stuff back.
[08:45.920 --> 08:52.920]  Now, sometimes there are circumstances where the police don't have to get a warrant to perform a search.
[08:55.450 --> 09:08.300]  And this is not by any means an exclusive or a complete list of all of those exceptions, but the ones that I think are important for purposes of this conversation include consent.
[09:09.040 --> 09:10.760]  If they ask you, hey, can we do this?
[09:10.860 --> 09:11.880]  And you say, oh, yeah, that's fine.
[09:12.480 --> 09:14.780]  If they don't need to get a warrant, they're allowed.
[09:15.040 --> 09:20.580]  So, you know, keep that in mind if you're ever in a circumstance where you're dealing with the police.
[09:21.660 --> 09:28.000]  If they ask you to consent to a search of something, you do not have to do that.
[09:29.820 --> 09:30.540]  Plain view.
[09:31.100 --> 09:43.460]  If they are in a place where, you know, they're authorized to be, and they see something right in front of their noses that's evidence of a crime that's something different, then they don't have to look the other way.
[09:43.660 --> 09:45.240]  They can seize that, too.
[09:45.720 --> 10:01.500]  So, for example, if they come to a house and they're there searching for evidence of a burglary, and then when they walk into the house, they see cocaine on the table in front of them, then, you know, that's okay.
[10:01.560 --> 10:03.980]  They don't need a warrant to seize that.
[10:05.080 --> 10:07.100]  There is an automobile exception.
[10:07.600 --> 10:18.260]  So, if you are driving somewhere, and they pull you over, and they have probable cause to think there's evidence of a crime in your car, they don't have to go get a warrant then to come back and search it.
[10:18.500 --> 10:26.480]  And the general reason for that is because, you know, cars can drive away very quickly, and then, you know, the evidence of the crime is gone, basically.
[10:26.480 --> 10:34.440]  So, they have evidence to search the interior of the car and the containers within it, and don't have to get a warrant to do that.
[10:35.160 --> 10:37.200]  And then there's exigent circumstances.
[10:37.520 --> 10:50.600]  If they have reason to think that if they take the time to get a warrant, the evidence of the crime is just going to evaporate because somebody is going to destroy it, or the person is going to run away, or whatever, then they don't have to get a warrant.
[10:54.170 --> 11:00.170]  Now, there's a concept also known as a Terry stop, which I'm going to talk about again a little bit later.
[11:00.350 --> 11:02.130]  I want you to know about it a bit now.
[11:03.270 --> 11:20.770]  If they have a reasonable suspicion that there's some criminal thing going on, but it doesn't rise to the level of probable cause, they can briefly detain somebody, and if they think that person might have a weapon or something, they can pat down that person's clothing,
[11:21.470 --> 11:24.370]  you know, to make sure they're not in any danger or anything.
[11:24.690 --> 11:34.870]  And then they can, you know, take that opportunity, that brief detention, to try to get a better handle on the situation, which sometimes may lead to the higher standard of probable cause.
[11:35.630 --> 11:40.390]  Or sometimes it means that they learn that their initial suspicions were wrong, and then the whole thing's over.
[11:41.750 --> 11:45.950]  And then the other thing to be aware of is search incident to arrest.
[11:46.170 --> 11:57.330]  If they arrest you for something, they are allowed to search your person and, you know, the things that you have with you as a general matter.
[11:59.190 --> 12:02.070]  A special note about cell phones.
[12:05.330 --> 12:16.730]  Now, several, actually a bunch of courts now, have looked at the question of, you know, if you are arrested and you have a cell phone in your pocket or a cell phone in your purse, can they search the cell phone without a warrant?
[12:17.210 --> 12:22.490]  Or do they have to then delay and get a warrant to come back and search the phone?
[12:24.810 --> 12:30.410]  And what the courts have said is that, you know, some courts have said, well, they can search that phone incident to arrest.
[12:30.670 --> 12:37.690]  Because, you know, our cases generally say that they can pat you down and they can search your pockets and whatever you have on your person.
[12:37.950 --> 12:42.150]  So if your cell phone is, you know, one of those items, then they can search it.
[12:42.330 --> 12:54.830]  And other courts have said, well, but cell phones are very special Because they contain a tremendous amount of information and there may be nothing vaguely even relevant to the crime on that phone.
[12:55.370 --> 13:01.890]  In fact, it's likely that there's going to be a lot that's not relevant and it's going to be highly invasive, so they have to get a warrant.
[13:03.170 --> 13:08.250]  There was a case in California, the Supreme Court of California, in California v. Diaz, ruled that no warrant is necessary to search a phone, incident to arrest.
[13:14.070 --> 13:23.390]  And that opinion suggested very strongly that that wouldn't be limited to phones but would apply also to, say, laptops or other digital devices that you might have.
[13:24.210 --> 13:28.170]  The Supreme Court of Ohio, looking at the same question, went the other way.
[13:28.710 --> 13:31.210]  So this is something that's very much in flux.
[13:32.090 --> 13:38.350]  You know, the rule for you is going to depend heavily upon where you live and where you are.
[13:38.350 --> 13:44.590]  And so, if it's something you're concerned about, you know, it's worth knowing about and, you know, looking into.
[13:45.630 --> 13:46.190]  Okay.
[13:46.670 --> 14:00.870]  So, in terms of this particular situation, you know, having a cell phone with you and, you know, the possibility that it might be searched if you get arrested, what can you do about that?
[14:01.990 --> 14:13.390]  If you have a situation, if you have a situation, if you have a reason to think that you are going to be in a situation where you might get arrested, for example, you're protesting, and you think it might get potentially, you know, contentious or whatever,
[14:14.650 --> 14:18.190]  consider not having your phone with you or any mobile device.
[14:18.330 --> 14:20.330]  Consider leaving it at home or leaving it with a friend.
[14:21.630 --> 14:23.150]  Also, back up your data.
[14:23.890 --> 14:31.270]  I think you probably want to make sure that you're not in a situation where, if your phone gets seized, you lose all the stuff on it.
[14:32.750 --> 14:34.190]  Password protect your data.
[14:34.430 --> 14:42.130]  If you use a password lock, that is a pretty good indication that you have a reasonable expectation of privacy in your phone.
[14:42.130 --> 14:49.310]  And that is a fact that may make a difference if your situation gets before a judge.
[14:50.270 --> 14:54.350]  And if it's possible, encrypt the data on your devices.
[14:54.950 --> 14:56.690]  Full disk encryption is preferable.
[14:57.530 --> 15:00.210]  How many of you use Android-based devices?
[15:01.970 --> 15:02.870]  Of course.
[15:03.090 --> 15:03.690]  Tablets.
[15:03.830 --> 15:03.930]  Okay.
[15:04.130 --> 15:04.390]  All right.
[15:04.790 --> 15:09.350]  Well, how many of you are familiar with Moxie Marlin Spike and Whisper Systems?
[15:11.010 --> 15:11.870]  Fewer, but a lot.
[15:12.050 --> 15:12.170]  Okay.
[15:13.450 --> 15:13.890]  Well...
[15:13.890 --> 15:15.430]  How many people have seen the source code?
[15:15.750 --> 15:17.310]  How many people have seen the source code?
[15:17.950 --> 15:18.390]  Okay.
[15:18.530 --> 15:18.970]  That's fair.
[15:19.330 --> 15:19.990]  That's fair.
[15:20.390 --> 15:26.710]  But, you know, I am not aware of many options out there for, you know, for full disk encryption on phones.
[15:26.850 --> 15:30.810]  But Whisper Systems has actually produced one.
[15:31.030 --> 15:32.050]  So that's something.
[15:32.310 --> 15:34.530]  It is not available right now, unfortunately.
[15:36.950 --> 15:40.030]  Because Whisper Systems has been purchased by Twitter.
[15:40.850 --> 15:47.830]  And, you know, sort of the status of that company's products are, you know, kind of in flux at the moment.
[15:48.350 --> 15:57.490]  But actually, Whisper Systems has produced a whole suite of encryption programs for Android phones.
[15:57.490 --> 16:05.790]  So it's worth looking at if you're interested in keeping an eye on when some of those things come back into use.
[16:06.550 --> 16:08.210]  Text Secure is one of them.
[16:08.450 --> 16:12.930]  And that actually is available right now for anybody who wants to download it and use it.
[16:13.050 --> 16:16.250]  And, you know, that's certainly worth knowing about.
[16:16.890 --> 16:17.350]  Okay.
[16:17.550 --> 16:21.070]  So, Fourth Amendment, a special case, the border.
[16:23.030 --> 16:25.910]  The Fourth Amendment technically applies at the border.
[16:26.230 --> 16:35.850]  But all of the searches that are done there are pretty much just considered reasonable because of the fact that they're at the border.
[16:36.110 --> 16:45.670]  And the reason that that is the case is because the courts have said, well, you know, the government has a very special interest in making sure that, you know, bad stuff doesn't come into the country.
[16:46.170 --> 16:51.230]  And so they can search stuff, you know, pretty much willy-nilly at the border.
[16:52.150 --> 17:07.350]  For the most part, no suspicion of wrongdoing whatsoever is needed for a search of pretty much anything at the border except for, you know, basically a search of, you know, the interior of a person's, you know, body.
[17:07.350 --> 17:12.410]  You know, if they suspect that you have, you know, that you're smuggling drugs or something.
[17:12.890 --> 17:16.490]  In that case, they need reasonable suspicion, which still is an even probable cause.
[17:16.830 --> 17:28.690]  But at this point, the courts, unfortunately, are pretty uniform in saying that searching an electronic device at the border is just a routine thing and no suspicion of wrongdoing is needed.
[17:28.910 --> 17:35.170]  If the government wanted to, they could search every electronic device that comes across the border, but they just kind of don't have the resources to do that.
[17:36.650 --> 17:42.850]  If you're interested in this topic, EFF has a white paper on it, Defending Privacy at the U.S.
[17:42.930 --> 17:43.150]  Border.
[17:43.370 --> 17:44.650]  You can download it here.
[17:45.610 --> 17:48.670]  You know, the fact of the matter is the legal protections aren't very strong.
[17:48.670 --> 18:02.590]  And so if you are planning to carry a computer or a phone or any other device across the border because you need it for work or whatever, there are, you know, certain technical measures and I think common sense measures that you can take to protect your data,
[18:02.790 --> 18:04.670]  considering that the legal protections aren't very good.
[18:04.950 --> 18:07.470]  So, you know, check that out if you're interested in this topic.
[18:08.990 --> 18:11.630]  You know, in short, what can you do at the border?
[18:13.030 --> 18:15.030]  Try to carry as little data as possible.
[18:16.150 --> 18:18.250]  Don't take the stuff you don't need to take with you.
[18:20.070 --> 18:28.210]  To make that happen, sometimes it's good to think about having a special laptop or a special hard drive that you use specifically for travel.
[18:28.610 --> 18:34.170]  You know, a hard drive that you can just kind of swap in quickly if you have the type of computer that lets you do that easily.
[18:34.730 --> 18:36.550]  That just really has minimal data on it.
[18:36.630 --> 18:38.150]  Just, you know, the bare minimum.
[18:39.250 --> 18:44.230]  You know, remember to back up your data in case your device is seized.
[18:44.550 --> 18:51.810]  And also consider just storing your data in the cloud somewhere, taking a blank device with you and just downloading it when you get to your destination.
[18:53.170 --> 18:58.650]  And passwords and encryption, of course, these things are helpful.
[18:59.490 --> 19:02.530]  Encryption is... full disk encryption is the best option.
[19:03.210 --> 19:09.130]  Password protection is not a fantastic precaution, but it's better than nothing.
[19:09.630 --> 19:11.950]  You know, using these things in conjunction can be helpful.
[19:12.550 --> 19:16.170]  And if you want more detail about the border stuff, I refer you again to the paper.
[19:16.290 --> 19:17.330]  We've got a lot of good stuff in there.
[19:18.170 --> 19:19.550]  Okay, so, number two.
[19:19.690 --> 19:22.950]  Police efforts to get your data from third-party service providers.
[19:23.690 --> 19:28.550]  You know, the fact of the matter is there's not a whole lot that you can do about that if they decide to try to do it.
[19:28.570 --> 19:32.790]  But I wanted to talk about it because there have been some high-profile cases along these lines.
[19:33.690 --> 19:43.470]  So, the way that the law applies to this situation is actually really complex and confusing and the courts are in the midst of just trying to sort it all out.
[19:43.810 --> 19:46.550]  The first question is how the Fourth Amendment applies, right?
[19:46.790 --> 19:51.570]  Do you have a Fourth Amendment interest in your data stored with third-party providers?
[19:51.570 --> 20:08.930]  Now, there is a very troubling doctrine out there that comes from a couple of old Supreme Court cases that, you know, were not decided at a time when the use of computers was so widespread.
[20:08.930 --> 20:21.110]  But, basically, this doctrine says that people don't have any reasonable expectation of privacy in information they voluntarily disclose to someone else.
[20:21.430 --> 20:26.490]  You know, the idea being that if it really was private, you wouldn't have made it available to anybody else.
[20:27.510 --> 20:33.950]  And if you have no reasonable expectation of privacy, then, you know, it's basically not a Fourth Amendment problem.
[20:33.950 --> 20:36.790]  And the police don't have to get a warrant.
[20:37.050 --> 20:52.330]  If that is true in the information age, think about what that means for your Gmail account, for the things that you store in Dropbox, in the Dropbox service, or any other third-party service.
[20:52.330 --> 20:55.670]  I mean, everybody, almost everybody, is moving in that direction.
[20:55.970 --> 21:00.810]  I mean, that is a rule that is going to cause a lot of problems if it stays.
[21:02.090 --> 21:04.350]  Now, some of the courts are recognizing this.
[21:04.550 --> 21:07.770]  And a couple of years ago, there was a case called United States v. Warshak.
[21:09.230 --> 21:11.130]  EFF was involved in this case.
[21:11.370 --> 21:13.050]  We filed an amicus brief.
[21:13.790 --> 21:18.770]  And it reached the Sixth Circuit Court of Appeals, which is a pretty high-level court.
[21:19.710 --> 21:22.290]  You know, there are district courts, appeals courts, and the Supreme Court.
[21:22.430 --> 21:23.810]  So this is, you know, an appeals court.
[21:24.230 --> 21:31.230]  And that court found that people do have a reasonable expectation of privacy in email stored with third-party providers.
[21:31.370 --> 21:33.770]  So that is a very good result.
[21:33.950 --> 21:35.870]  And we hope to see that expanded.
[21:36.230 --> 21:38.790]  Certainly, that doesn't align with the third-party doctrine.
[21:38.790 --> 21:41.530]  And we hope that's kind of the first strike against it.
[21:42.510 --> 21:45.190]  Another encouraging thing is that in United States v. Jones, which I mentioned earlier, one of the justices filed a separate opinion in which she talked about a number of things.
[21:55.030 --> 22:03.910]  But one of them was, you know, she expressed a lot of concern about this idea that if you store data with somebody else, you don't have any reasonable expectation of privacy in it.
[22:03.910 --> 22:23.230]  So this is really an exciting idea that suggests perhaps that, you know, at least one Supreme Court and perhaps other Supreme Court members may, you know, recognize the situation here and be willing over time to change the way that the law is going in that direction.
[22:24.110 --> 22:28.070]  But as promising as that is, it's going to take a long time for that to happen.
[22:28.070 --> 22:31.350]  You know, legal processes are really slow, unfortunately.
[22:32.450 --> 22:35.670]  So aside from the Fourth Amendment, there are other things that complicate this question.
[22:36.190 --> 22:49.170]  There is a federal law called the Stored Communications Act that, in general, basically governs the way that third-party providers can disclose information under certain circumstances.
[22:49.890 --> 22:58.950]  And it, among other things, regulates when law enforcement can get stored records from third-party providers.
[22:59.130 --> 23:03.410]  And the rules there are very detailed and complicated.
[23:03.410 --> 23:10.670]  But, you know, I think that we can kind of boil it down to, you know, three basic ideas.
[23:10.670 --> 23:20.450]  The first one is that if the record involves content, then it's protected more strongly than a record that doesn't have content.
[23:20.710 --> 23:23.890]  And when I'm talking about content, I mean like, you know, an email message.
[23:24.330 --> 23:33.510]  You know, something that really conveys something meaning and, you know, a person's thoughts and something substantive.
[23:34.310 --> 23:42.310]  Non-content might be, you know, just basic subscriber information, an IP address at times.
[23:42.950 --> 23:45.650]  You know, just information that would route something from A to B.
[23:45.990 --> 23:47.950]  How about a credit card number or a...
[23:48.550 --> 23:49.670]  A credit card number?
[23:49.770 --> 23:51.010]  A credit card number or a database entry.
[23:51.190 --> 23:51.790]  Is that kind of content?
[23:51.990 --> 23:52.950]  Or a database entry?
[23:53.130 --> 23:53.910]  What kind of database?
[23:54.590 --> 23:55.850]  How about a credit card database?
[23:58.210 --> 23:58.650]  Well...
[23:58.650 --> 24:02.070]  I've got customers at eCommerce store that I store on Amazon EC2.
[24:02.790 --> 24:04.330]  Are my credit card numbers...
[24:04.330 --> 24:06.590]  Are the credit card numbers of my customer's content?
[24:07.350 --> 24:08.190]  That's a good question.
[24:08.210 --> 24:09.650]  And I'm not sure what the answer is.
[24:11.210 --> 24:13.050]  Let me... let me mull that over a little bit.
[24:15.750 --> 24:16.110]  Huh.
[24:16.250 --> 24:16.850]  That's interesting.
[24:17.210 --> 24:18.030]  We'll come back to that.
[24:19.610 --> 24:20.330]  Content versus...
[24:20.330 --> 24:28.250]  You know, I also think it's a little bit complicated because, you know, there are statutes out there that protect financial data in certain ways.
[24:28.470 --> 24:30.610]  And I'm not sure how they interact exactly with this.
[24:30.610 --> 24:31.250]  So...
[24:31.830 --> 24:32.190]  So...
[24:32.190 --> 24:32.810]  Pardon?
[24:34.470 --> 24:34.830]  PC...
[24:34.830 --> 24:35.370]  I'm sorry.
[24:35.550 --> 24:36.670]  We're getting kind of sidetracked.
[24:36.810 --> 24:38.390]  I'm happy to talk with you about this stuff later.
[24:39.490 --> 24:40.010]  But, okay.
[24:40.110 --> 24:41.230]  Content versus non-content.
[24:42.050 --> 24:45.850]  One of the things that we worry about quite a bit is, what about things like location data?
[24:47.470 --> 24:51.990]  An IP address, we think, under certain circumstances, might be just routing information.
[24:51.990 --> 24:53.570]  Maybe it's just like an address.
[24:53.810 --> 25:05.890]  But under other circumstances, if you combine it with other data or you have IP addresses showing a person's connections to a service over time, it might reveal a lot more about that person's activities.
[25:06.230 --> 25:08.650]  And at that point, does that rise to the level of content?
[25:09.170 --> 25:10.190]  We think it should.
[25:10.970 --> 25:16.030]  Another question is, within the concept of content, how old is it?
[25:16.910 --> 25:30.670]  As a general matter, if it's 180 days old or older than that, then it's protected less strongly than if it's more recent than that.
[25:32.450 --> 25:38.690]  And this law actually only applies to providers of electronic communication services or remote computing services.
[25:38.970 --> 25:43.910]  And, you know, something that is really frustrating is that the Stored Communications Act was written in 1986.
[25:44.490 --> 25:47.130]  And it's never really been substantially updated.
[25:47.390 --> 25:53.990]  And so, you know, I think that Congress was considering certain types of services at the time.
[25:54.210 --> 25:55.970]  Electronic communication services, okay.
[25:56.150 --> 25:59.910]  These are services that let people communicate with each other electronically.
[25:59.910 --> 26:07.010]  Remote computing services, you know, this tends to involve storage, services that store data for people.
[26:07.150 --> 26:10.010]  But we have providers now that do both of those things.
[26:10.650 --> 26:14.610]  And, you know, how do we treat them in this statutory scheme?
[26:15.010 --> 26:18.630]  And so, this starts to get really complicated.
[26:18.950 --> 26:25.310]  And it's funny, you know, when you see court opinions on this, often the judges start out just by saying, okay, this is really complicated.
[26:25.530 --> 26:27.690]  I'm going to take my best stab at it, but this is hard.
[26:27.690 --> 26:30.670]  And so, you know, number one, the law needs to be updated.
[26:30.830 --> 26:34.250]  But, you know, number two, it just doesn't apply very well to the situation at the moment.
[26:34.470 --> 26:37.870]  And then there are also state laws that play into this as well.
[26:38.210 --> 26:40.690]  So, very, very difficult, complicated situation.
[26:41.970 --> 26:44.850]  This stuff has come up in a couple recent cases that you may have heard about.
[26:44.850 --> 26:53.430]  One involved a government order to Twitter seeking information about some individuals in the WikiLeaks investigation.
[26:54.250 --> 26:59.990]  And EFF represents a person along with the ACLU in that case.
[26:59.990 --> 27:16.110]  And three of the users, our client Brigitte Onstotter and Jake Applebaum and Rop Gonggrijp, we challenged the order for non-content data sought by the government from Twitter in the WikiLeaks investigation.
[27:16.230 --> 27:18.510]  And, unfortunately, it didn't go that well.
[27:19.190 --> 27:20.990]  We made Fourth Amendment arguments.
[27:20.990 --> 27:22.990]  We made Stored Communications Act arguments.
[27:22.990 --> 27:26.270]  We made First Amendment arguments based on right of association.
[27:26.890 --> 27:34.170]  And the court basically said, well, you know, looking at all of this, we just don't think that you have rights in this, really.
[27:34.590 --> 27:36.650]  So, that's just kind of how that goes.
[27:36.970 --> 27:39.230]  You know, another one was New York v. Harris, a recent case here involving an Occupy Wall Street protester who was charged by the police here with disorderly conduct based on his participation in a protest.
[27:54.090 --> 28:05.470]  And the police sent a subpoena to Twitter trying to get information about Mr. Harris's activities on Twitter for a period of three months.
[28:05.650 --> 28:08.790]  And that included actual content, tweets.
[28:09.250 --> 28:12.310]  And it appears to have extended also to direct messages.
[28:12.310 --> 28:13.750]  So, even private content.
[28:14.070 --> 28:18.190]  Not just content that's just out there for everybody to see.
[28:19.650 --> 28:21.910]  And Mr. Harris pushed back against this.
[28:22.050 --> 28:25.310]  Twitter filed a motion pushing back against this.
[28:26.430 --> 28:29.090]  The ACLU and EFF and Public Citizen.
[28:29.370 --> 28:31.970]  We joined together to file an amicus to support them.
[28:32.590 --> 28:38.690]  But unfortunately, again, the court didn't recognize the privacy interest in the way that we'd hoped.
[28:39.070 --> 28:44.590]  And so, you know, these are fights that we're working on now and continuing to work on.
[28:44.670 --> 28:49.570]  And I think that these are issues that organizations like ours are going to be working on for a long time.
[28:49.750 --> 28:57.210]  This is one of our big battles in the coming years, is trying to show the courts that there are privacy interests in data stored with third parties.
[28:57.410 --> 28:58.290]  And that's important.
[29:00.910 --> 29:06.370]  We launched a campaign a couple years ago called When the Government Comes Knocking, Who Has Your Back?
[29:06.850 --> 29:13.830]  And the idea was to recognize certain companies who actually have good practices along these lines.
[29:13.830 --> 29:17.870]  And I know you probably can't see the categories very well.
[29:18.190 --> 29:26.070]  But we gave various companies stars for telling users about data demands from the government.
[29:26.250 --> 29:41.650]  So, you know, when the government sends a data demand to Twitter, for example, we gave them a star because they have a policy of letting the customer know that so that the subscriber can actually like push back against that.
[29:42.830 --> 29:50.450]  That can't always be the case, unfortunately, because sometimes the demand comes with a provision that says, you know, this is sensitive and you can't tell anybody.
[29:50.830 --> 29:59.050]  But, you know, to the extent that services are able to tell their subscribers, there are several that do.
[30:00.090 --> 30:05.630]  We also gave stars for companies that are transparent about government requests.
[30:05.810 --> 30:12.450]  There are some... there are an increasing number of companies that publish reports about this on an annual basis that say how many requests they get, what kind of requests they get.
[30:13.950 --> 30:25.090]  We gave stars for fighting for user privacy in the courts and for fighting for user privacy in Congress because, as I mentioned, some of these laws are really outdated and they need to be improved given advances in technology.
[30:25.090 --> 30:37.510]  So, this is not a complete list of all of the companies that we have given stars to, but I encourage you to take a look at that report so you can get a sense of what the practices of the various companies are.
[30:38.070 --> 30:47.410]  I will tell you that some of the best practices out there are Twitters and also a little ISP in Northern California called Sonic.net.
[30:47.770 --> 30:49.850]  How many people are Sonic customers here?
[30:50.990 --> 30:51.770]  Just a few.
[30:53.110 --> 30:54.570]  I give those guys a lot of credit.
[30:56.430 --> 31:01.910]  So, a lot of this is out of your hands because, you know, we're talking about your data stored with other people.
[31:02.630 --> 31:03.630]  But what can you do?
[31:04.570 --> 31:09.990]  So, understand what data you're actually disclosing to service providers and that they actually have and maintain.
[31:10.970 --> 31:16.030]  And be selective about the services you use because some of those companies have better practices than others.
[31:17.150 --> 31:24.330]  If it's possible, if you're using a service where you can encrypt data before you upload it, and then you should do that.
[31:24.550 --> 31:39.710]  It's best to use a service that, you know, lets you encrypt the data yourself and then upload it rather than organizing their or designing their services in such a way where they actually might be able to give the government information that would allow decryption of that data.
[31:41.710 --> 31:48.690]  And as I mentioned before, I feel like the legal issues here are tough.
[31:49.150 --> 31:51.310]  And right now, the law is not on our side.
[31:51.450 --> 31:58.070]  And so, I think this is another area where technical solutions are a good idea.
[31:58.070 --> 32:02.410]  And so, keep an eye out for technical solutions and build technical solutions.
[32:03.230 --> 32:16.110]  You know, we're working to do what we can with the law, but those of you who are actually in a position to design good privacy enhancing protections for data stored by third party services, that's all good stuff.
[32:17.310 --> 32:24.510]  Okay, so briefly, questioning by law enforcement and other interactions you may have with them.
[32:29.090 --> 32:35.510]  So, let's take our scenario before, with the cop coming to your house with a warrant.
[32:36.630 --> 32:45.710]  And, you know, as the police are searching your home and or, you know, seizing your things, they're asking you questions.
[32:46.390 --> 32:48.670]  Who here thinks you have to answer those questions?
[32:51.430 --> 32:51.990]  Yay!
[32:53.370 --> 32:54.830]  You don't have to answer those questions.
[32:55.390 --> 33:03.450]  And in fact, it's best, I think in your best interest, to try to speak to a lawyer before you answer any questions that they ask you.
[33:04.330 --> 33:13.790]  Okay, let's say you're at a protest, and things are getting a little bit kind of heated and weird, and a policeman comes up to you and starts asking you questions.
[33:14.290 --> 33:15.770]  Who thinks you have to answer those questions?
[33:18.190 --> 33:19.550]  Okay, awesome, that's good.
[33:20.150 --> 33:23.110]  As a general matter, you don't have to answer those questions.
[33:24.250 --> 33:28.210]  There is one little caveat there, which I'm going to talk about.
[33:30.570 --> 33:32.510]  Oh, actually, I'm going to talk about that right now.
[33:33.950 --> 33:36.890]  I gave an early version of this talk a few months ago at Noisebridge.
[33:37.170 --> 33:40.830]  And, you know, people at Noisebridge are very smart and they have great questions.
[33:40.990 --> 33:48.230]  And one person asked me, well, okay, so you don't have to answer questions, but what if they ask you who you are or ask you for ID?
[33:48.450 --> 33:49.450]  Do you have to answer that question?
[33:50.630 --> 33:51.630]  And here's the deal.
[33:52.370 --> 34:08.830]  There are some states, about half the states out there, have statutes that say that if the police have some suspicion that you're doing something wrong, maybe it's not probable cause, but it's reasonable suspicion, they can ask you who you are and you have to answer.
[34:09.070 --> 34:10.590]  And if you don't, that's against the law.
[34:10.590 --> 34:18.850]  Now, there was a Supreme Court case a few years ago called Heibel versus Nevada.
[34:19.810 --> 34:38.790]  And that case said that if you are in a Terry stop situation, that is, the police already have a reason to believe that you may have done something, but, you know, they're not sure, but they think maybe, um, they can ask you for, they can ask you to identify yourself.
[34:39.530 --> 34:42.230]  And, uh, that, that doesn't violate your Fourth Amendment rights.
[34:43.090 --> 34:45.950]  Um, so, uh, there are two questions there.
[34:46.130 --> 34:48.290]  A, are you in a state that has that law?
[34:48.690 --> 34:51.990]  And B, uh, are you in a Terry stop situation?
[34:52.410 --> 34:57.810]  And remember that means that you're being temporarily detained, meaning you're not free to walk away.
[34:58.350 --> 35:00.930]  So how do you know when you're in that situation?
[35:01.230 --> 35:05.990]  I mean, what if you're having a little bit of a moment with a police officer there and he asks you who you are?
[35:06.170 --> 35:07.370]  I mean, how do you, how do you know?
[35:07.890 --> 35:10.830]  And what I would suggest is you ask, am I free to go?
[35:11.570 --> 35:14.530]  And if he says no, then you have a Terry stop situation.
[35:14.750 --> 35:18.150]  And if he says yes, then you don't have to answer the question and you can walk away.
[35:18.530 --> 35:18.710]  Okay?
[35:20.450 --> 35:21.550]  Uh, another thing.
[35:22.190 --> 35:31.150]  If they, um, are asking you for help, for example, searching your computer, or finding things in your home, you don't have to help them.
[35:31.510 --> 35:35.750]  And remember that consent is one of those exceptions to the Fourth Amendment.
[35:35.970 --> 35:46.230]  And so, uh, it may very well be in your best interest not to help, even if you feel like you're being impolite or difficult and you're concerned about causing a difficult, awkward interaction, right?
[35:46.510 --> 35:52.930]  Because, um, you wouldn't want your, uh, good-natured help to be, uh, considered something that it's not.
[35:54.330 --> 35:58.150]  Um, remember that you can always ask to speak to a lawyer.
[35:58.730 --> 36:00.430]  Maybe they won't always say yes.
[36:00.870 --> 36:08.310]  Um, uh, but, you know, if you're having an interaction with the police that you're uncomfortable with, uh, I, it's never a bad idea.
[36:08.650 --> 36:15.550]  And, um, as a general matter, if they want information from you, um, it is, it is a good idea, I think, to speak to a lawyer first.
[36:15.550 --> 36:19.190]  Because, as we all know, anything you say can be used against you.
[36:19.910 --> 36:23.970]  And, um, if you don't give them information, then they can't.
[36:26.530 --> 36:28.850]  So, maybe this is, um, a little bit...
[36:28.850 --> 36:30.710]  I'm, I'm, I'm very big on etiquette.
[36:30.990 --> 36:33.090]  And, um, my mother was as well.
[36:33.170 --> 36:35.710]  And so, I always feel a little bit silly when I, when I talk about this.
[36:35.990 --> 36:38.570]  Because I'm just kind of, I have a thing about politeness.
[36:38.770 --> 36:45.390]  But, um, really, seriously, in situations like this, I think it never is in, it's never a bad thing to be polite.
[36:45.390 --> 36:49.650]  I think these situations can often, uh, become very awkward.
[36:50.250 --> 36:57.070]  And you feel strange being uncooperative because it feels confrontational and like you're only going to escalate things and make everything worse.
[36:57.530 --> 37:03.050]  But, um, remember, it's, it, it's not in your best interest to be helpful and it's not in your best interest to offer information.
[37:03.450 --> 37:08.210]  And, uh, I think that often police officers can try to use, use, use that against you.
[37:08.530 --> 37:14.930]  You know, try to, you know, make you feel like you're being awkward, you know, rude and uncooperative so that you, you feel like you need to change the way you're acting.
[37:14.930 --> 37:22.530]  So, I think that to help, kind of, keep things, you know, kind of calm and copacetic, you know, just be polite.
[37:23.010 --> 37:27.670]  I mean, you know you're not going to help them, but you don't have to be antagonistic, you know.
[37:29.110 --> 37:34.650]  There are some things that are some very bad ideas if you do them and you know I'm not giving legal advice here.
[37:34.810 --> 37:37.010]  But I'm just saying there are some things that are bad ideas.
[37:37.710 --> 37:39.450]  One is lying to the police.
[37:39.450 --> 37:41.590]  It is a very bad idea to lie.
[37:41.930 --> 37:44.450]  That is a separate and distinct crime.
[37:44.690 --> 37:51.390]  And if you lie, it may give them grounds to pursue something against you that they didn't have before.
[37:52.390 --> 37:57.810]  And so never lie either affirmatively or by omission.
[37:58.030 --> 38:00.450]  I think that is important.
[38:01.710 --> 38:03.910]  It's a bad idea to interfere with a search.
[38:04.510 --> 38:17.470]  If they come into your home and they are searching your things, if they are searching, you know, if you look at that warrant and it doesn't have computers in it, and they're searching your computer or they're taking your computer, don't try to wrestle it away from them.
[38:17.650 --> 38:21.770]  Or, you know, just let them do it and then talk to your lawyer about it.
[38:23.330 --> 38:29.810]  It is very important not to destroy, delete, or alter anything that might frustrate an investigation.
[38:30.030 --> 38:31.890]  And Hanni gave a whole talk on this yesterday.
[38:33.030 --> 38:37.670]  He's done a lot of research on this and if you have questions about this, he's a great person to talk to.
[38:38.590 --> 38:39.110]  Okay.
[38:39.710 --> 38:45.530]  So, compelled disclosure of passwords and encryption passphrases and encrypted information.
[38:45.530 --> 38:57.470]  I'm actually giving a whole talk on this at DEFCON in a couple of weeks, and so I'm not going to get into it a whole lot, but I think that it is a good thing to discuss.
[38:58.410 --> 39:02.810]  So, the Fifth Amendment gives you the right to not incriminate yourself.
[39:03.690 --> 39:08.050]  No person shall be compelled in any criminal case to be a witness against himself.
[39:09.750 --> 39:20.870]  So, the privilege against self-incrimination protects against government attempts to force you to give testimonial evidence that would tend to incriminate you.
[39:22.510 --> 39:27.090]  Now, I think it's easy to grasp the concept of what is compelled.
[39:27.350 --> 39:28.590]  It's when they force you.
[39:29.490 --> 39:31.510]  It's when you don't have a choice, right?
[39:32.270 --> 39:39.990]  If they walk into your house and, you know, they want to, like, log on to your computer and they're saying, oh, hey, would you give me your encryption passphrase?
[39:40.910 --> 39:42.050]  Do you have to give it to them?
[39:42.570 --> 39:43.710]  Who thinks you have to give it to them?
[39:45.690 --> 39:46.010]  Excellent.
[39:47.790 --> 39:53.790]  The only time you can be forced to give information in a situation like this is by a judge, okay?
[39:54.470 --> 39:57.970]  And only if you don't have a valid privilege against self-incrimination.
[39:57.970 --> 40:02.210]  So, keep that in mind when we talk about compulsion.
[40:04.250 --> 40:04.990]  Excuse me?
[40:07.750 --> 40:09.310]  I'm getting to that.
[40:09.890 --> 40:10.370]  Okay.
[40:10.570 --> 40:12.690]  So, the next part is testimonial evidence.
[40:13.390 --> 40:16.170]  What is testimonial versus non-testimonial?
[40:16.390 --> 40:16.570]  Okay.
[40:16.810 --> 40:20.530]  Testimonial evidence is when you reveal the contents of your mind, okay?
[40:20.710 --> 40:23.570]  As opposed to, like, some physical, tangible thing.
[40:23.570 --> 40:30.030]  So, a good way to think about this is a combination lock versus a key.
[40:30.430 --> 40:37.050]  And this is actually a comparison that the Supreme Court has put out there.
[40:37.250 --> 40:52.570]  So, if the police wanted to unlock a safe, and the safe had a combination lock, and the only way they could get the combination is by making you say it, then that implicates the privilege against self-incrimination.
[40:52.890 --> 40:56.310]  Because you would have to be telling them something that reveals the contents of your mind.
[40:56.550 --> 40:56.910]  Alright?
[40:57.410 --> 41:01.890]  Now, if there is a key to that safe, and they say, give us the key to that safe.
[41:02.070 --> 41:06.550]  If you have the key, the Fifth Amendment doesn't protect you from having to turn it over.
[41:06.550 --> 41:07.930]  Because it is a physical thing.
[41:08.130 --> 41:14.830]  It doesn't reveal anything about your mind that would give them evidence against you.
[41:14.950 --> 41:15.430]  Okay?
[41:15.810 --> 41:16.490]  Does that make sense?
[41:19.050 --> 41:22.590]  Well, and we're going to talk a little bit about that, too.
[41:23.830 --> 41:24.310]  Okay.
[41:25.390 --> 41:30.530]  One thing that's important to realize, and this is something that gets a little bit difficult to figure out.
[41:31.230 --> 41:42.230]  The privilege of self-incrimination can apply to an act of production, giving something over, if it has testimonial aspects.
[41:42.670 --> 41:53.410]  Meaning, if you give it to them, it would tend to confirm the existence of something, or that you possess it, or that you control it, or that it's authentic.
[41:53.810 --> 41:54.370]  Alright?
[41:54.370 --> 42:02.630]  And I think that's where this becomes important when we talk about attempts to force you to turn over passwords and encrypted data.
[42:02.770 --> 42:05.890]  Because if you are first... if you... you know, this is stuff that already exists.
[42:06.010 --> 42:06.070]  Right?
[42:06.150 --> 42:17.950]  But if you are forced to turn over a password, or a passphrase, or you're forced to decrypt it, what you're basically showing is that you have control over it.
[42:18.170 --> 42:18.530]  Right?
[42:18.690 --> 42:21.710]  And that can be very important and incriminating in a case.
[42:25.810 --> 42:39.350]  Something that I think a lot of people don't know, but it's important to realize, is that the Fifth Amendment right against self-incrimination is something that's very personal to you and your situation.
[42:41.390 --> 42:48.590]  It can only be invoked by the person who actually has the right.
[42:48.590 --> 42:57.910]  So, if you know something about a friend that might be incriminating, you can't invoke the Fifth Amendment right against self-incrimination to protect your friend, okay?
[42:58.150 --> 42:59.810]  It only lies with you.
[43:01.130 --> 43:06.370]  Now, I realize I actually made a mistake in the next slide, I believe.
[43:06.950 --> 43:07.990]  Oh, no, I didn't.
[43:08.370 --> 43:08.510]  Okay.
[43:09.010 --> 43:15.330]  One thing that I did not put in my slides, but is important also, is what the concept of incrimination is.
[43:15.950 --> 43:31.380]  Now, if something is incriminating, what that means is that it might give the government the information that it would need to try to prosecute you for something.
[43:31.480 --> 43:33.620]  It doesn't mean that you're actually guilty, okay?
[43:34.500 --> 43:43.080]  The Fifth Amendment is something... the Fifth Amendment privilege against self-incrimination is something that protects the innocent as well as the guilty, and that's something the Supreme Court has said.
[43:43.320 --> 43:55.180]  What the Fifth Amendment protects is it protects you against adverse police action based on being ensnared in ambiguous circumstances.
[43:55.580 --> 43:59.200]  That is actually the Supreme Court's phrase, ensnared in ambiguous circumstances.
[43:59.420 --> 44:05.500]  So, you might be a totally innocent person in a situation that looks bad, and you have a Fifth Amendment right against self-incrimination.
[44:06.960 --> 44:23.460]  And, you know, the privilege is basically intended to protect you from being in this odd, awkward position where, you know, your only options are basically to, you know, give up information that might be against your interest, that might be used to bring charges against you either rightfully or wrongfully,
[44:23.740 --> 44:30.040]  or lie to the police, or say, you know, I can't give you that information and being thrown in jail.
[44:30.180 --> 44:34.740]  That's why we have the privilege against self-incrimination, is because we don't want people to be in that situation.
[44:34.780 --> 44:35.860]  We think it's unfair.
[44:37.480 --> 44:39.520]  There are a couple of important exceptions.
[44:40.140 --> 44:41.960]  The first is foregone conclusion.
[44:42.220 --> 44:51.200]  If the cops already have a pretty good idea that there is evidence in your possession and what it is and where they're going to find it, the privilege might not apply.
[44:51.520 --> 44:56.040]  Because the important factor is the difference between what you know and what they know.
[44:56.300 --> 45:02.320]  And if basically you wouldn't be telling them anything they don't already know, then there's no privilege to protect, basically.
[45:02.320 --> 45:04.020]  And you may still have to turn the stuff over.
[45:04.980 --> 45:06.280]  The other thing is immunity.
[45:06.660 --> 45:21.600]  The government can overcome a privilege that you have, by giving you immunity from prosecution based on that production of information, or anything they would learn as a result of having that information.
[45:21.820 --> 45:24.720]  Or anything they would discover as a result of having that information.
[45:25.040 --> 45:33.880]  And the reason why that is, is because if there's no longer a possibility that you could incriminate yourself, because they're not going to bring charges If there's a privilege that goes against you, then the privilege doesn't apply, okay?
[45:34.140 --> 45:41.640]  But the important thing is that whatever immunity they offer has to be just as broad as the privilege, or else it's just not good enough and you still have a privilege.
[45:42.700 --> 45:47.980]  There have been some important cases along these lines, and they've really just come up in the past few years.
[45:48.180 --> 45:49.980]  I'm not going to talk about them in detail.
[45:50.780 --> 45:56.420]  I'm going to go through them in excruciating detail at DEFCON, if you want to come to that talk.
[45:57.360 --> 46:15.060]  But basically, the rule that kind of emerges from these cases, I would say, is that the courts seem to believe that you have a valid Fifth Amendment privilege against self-incrimination that protects you against having to disclose your password if it would tend to incriminate you.
[46:16.260 --> 46:25.020]  It can be a tougher call if it is a situation where they just want you to produce a decrypted version of encrypted data.
[46:26.100 --> 46:39.080]  But basically, if they already have a good sense that there's something incriminating on your computer and turning it over wouldn't tell them anything they don't already know, then foregone conclusion and the privilege doesn't apply.
[46:39.260 --> 46:44.540]  But if they're trying to force you to decrypt data, and it would tell them something they don't already know.
[46:44.620 --> 46:48.580]  It would reveal the existence of evidence that they don't know about.
[46:48.580 --> 46:57.260]  If it would reveal that you have a certain amount of control over something that they didn't know you had control over, then you may very well have a Fifth Amendment privilege against self-incrimination.
[46:57.660 --> 46:57.820]  All right?
[46:58.560 --> 46:59.480]  So, okay.
[46:59.740 --> 47:00.760]  What can you do?
[47:01.180 --> 47:04.400]  Choose strong passphrases that you can remember.
[47:04.680 --> 47:06.100]  So they're in your brain.
[47:07.580 --> 47:09.380]  I use a password manager.
[47:09.980 --> 47:11.860]  How many people here use password managers?
[47:12.300 --> 47:12.680]  Okay.
[47:15.440 --> 47:19.120]  I think that this is a good option because you can have strong passwords.
[47:19.500 --> 47:23.460]  And while it is true they are recorded, you have to have a password to access them.
[47:23.680 --> 47:28.480]  And if you remember that password, I think that that is a good situation.
[47:29.640 --> 47:33.660]  If you are asked to turn over a password, consider exercising your right to remain silent.
[47:33.860 --> 47:35.260]  Consult a lawyer about that.
[47:36.060 --> 47:38.520]  And, you know, remember only a judge can force you to turn it over.
[47:38.520 --> 47:43.300]  So it might be best to err on the side of refusing to disclose information and let your lawyer deal with it.
[47:44.280 --> 47:45.600]  Choosing a strong passphrase.
[47:46.140 --> 47:47.620]  I don't know how well you can see this.
[47:48.820 --> 47:49.260]  XKCD.
[47:49.260 --> 47:51.260]  Good advice on choosing a strong password.
[47:51.460 --> 47:59.420]  If you want to come back and look at this, you want a password with high entropy, but something that's easy for you to remember and difficult for other people to guess.
[48:00.780 --> 48:10.220]  You know, he basically suggests choosing four random common words and having a mnemonic device so that it means something to you, but it doesn't mean anything to anybody else.
[48:11.060 --> 48:11.660]  Okay, further reading.
[48:11.960 --> 48:14.280]  We have a white paper, know your rights.
[48:15.100 --> 48:19.240]  We have tips for talking to the police, which you can get at the EFF vendor booth.
[48:19.900 --> 48:20.860]  And that's it.
[48:21.620 --> 48:24.360]  And I got questions for whoever wants them.
[48:30.940 --> 48:32.220]  And one second before we start.
[48:33.320 --> 48:37.440]  Remember, if you have a personal situation that you'd like to talk about, don't bring it up here.
[48:37.560 --> 48:38.540]  Come talk to us privately.
[48:38.540 --> 48:42.280]  And I know that probably we're not going to have enough time to take everybody's questions.
[48:42.440 --> 48:44.460]  So come talk to me and or Hanni later.
[48:44.680 --> 48:44.880]  Okay?
[48:45.740 --> 48:46.020]  Hello.
[48:46.300 --> 48:46.560]  Thank you.
[48:46.660 --> 48:47.280]  Wonderful talk.
[48:47.480 --> 48:52.360]  I was wondering about these little USB drives and some hypothetical situations.
[48:53.020 --> 48:54.620]  What's a better position to be in?
[48:54.740 --> 48:58.580]  The USB drive is in your computer desk and your house gets searched.
[48:58.920 --> 49:00.280]  You have it on your person.
[49:00.440 --> 49:01.160]  You get searched.
[49:01.420 --> 49:04.740]  Or you're running away from cops and it gets lost in the woods.
[49:09.600 --> 49:10.600]  Oh, my gosh.
[49:13.580 --> 49:18.780]  I guess if the question is what puts you in the best position legally...
[49:18.780 --> 49:19.200]  Yes.
[49:19.720 --> 49:25.400]  I would say that if you have it in your desk drawer, they're probably going to need a warrant to get it.
[49:25.680 --> 49:33.020]  If you have it on your person and you're in a situation where you get arrested or something, I think it depends on the jurisdiction.
[49:33.360 --> 49:35.740]  You know, they may say, well, we seized an incident to arrest.
[49:35.840 --> 49:36.520]  We don't need a warrant.
[49:36.700 --> 49:38.880]  Some other court might say that they do need a warrant.
[49:39.000 --> 49:45.060]  If you throw it away, my concern is that if they find it, it looks like maybe you tried to get rid of evidence.
[49:45.300 --> 49:47.040]  And that probably isn't very good for you.
[49:47.740 --> 49:48.720]  That's my take on that.
[49:48.720 --> 49:53.100]  And I was wondering about third-party information disclosures.
[49:53.280 --> 49:56.140]  Has there been any case law about VPS providers?
[49:56.280 --> 50:03.520]  Because they're like virtual imaginary computer systems, but you're in complete control, although the hardware belongs to someone else.
[50:03.800 --> 50:05.640]  I'm not aware of any cases on that yet.
[50:06.080 --> 50:06.380]  All right.
[50:06.480 --> 50:06.780]  Thank you.
[50:06.940 --> 50:07.780]  The law is slow.
[50:07.920 --> 50:09.620]  Like I said before, it takes a long time to catch up.
[50:13.480 --> 50:17.600]  Okay, I've been asked to remind you that we have a table downstairs and you can, you know, meet with us down there.
[50:17.740 --> 50:18.640]  We're happy to talk with you.
[50:19.320 --> 50:20.780]  Do I have time for a couple more questions?
[50:20.920 --> 50:21.040]  Yeah, yeah.
[50:21.160 --> 50:21.380]  Okay.
[50:22.620 --> 50:27.980]  So you mentioned that you need reasonable suspicion at airports for them to actually search your body.
[50:29.380 --> 50:32.620]  So not like the outside of your person, but it's like if they think that...
[50:32.620 --> 50:32.700]  But the insights.
[50:33.120 --> 50:38.300]  So how do the full body scanners play into that at all, and if they do?
[50:38.300 --> 50:41.860]  Yeah, that, that is, that is kind of a difficult question.
[50:42.040 --> 50:55.580]  You know, I think the, the reason that the courts have said, and the Supreme Court has said that, you know, if they suspect you're smuggling drugs or something, they need reasonable suspicion to, you know, search the interior of your body, is because that is such an invasive thing.
[50:56.360 --> 50:56.660]  All right?
[50:56.860 --> 50:58.000]  Like physically invasive.
[50:58.460 --> 51:05.700]  And I don't think anybody disputes that you have a reasonable expectation of privacy in, you know, your elementary canal.
[51:05.920 --> 51:06.240]  All right?
[51:06.460 --> 51:12.600]  And I think that the idea is that, you know, the full body scanners don't involve any physical intrusion.
[51:12.960 --> 51:19.140]  And I'm aware of one court who's, you know, considered the Fourth Amendment implications and said that under the Fourth Amendment, it's kosher.
[51:19.580 --> 51:27.400]  And I, I suspect that if it was a more physically invasive procedure, that case might not have gone that way.
[51:27.820 --> 51:28.900]  That's my take on that.
[51:31.540 --> 51:31.940]  Hi.
[51:32.400 --> 51:35.360]  I wanted to go back to search incident to arrest.
[51:36.020 --> 51:44.860]  I'm not well read on the issue, but I know that, and I read the Seventh Circuit opinion where basically Judge Posner upheld a search of a cell phone data, the incident to arrest.
[51:44.860 --> 51:47.860]  And his rationales were not convincing to me at all.
[51:48.080 --> 51:48.940]  I know I'm a little biased.
[51:49.120 --> 51:55.000]  But I'm curious, playing devil's advocate, what are the best arguments you've heard in support of that search?
[51:55.740 --> 52:00.220]  Because typically I thought they were supposed to be based on officer safety and preservation of evidence.
[52:00.720 --> 52:06.100]  The best, the best arguments in favor of the idea that the police ought to be able to search an incident to arrest?
[52:06.240 --> 52:06.460]  Correct, yeah.
[52:06.520 --> 52:12.520]  I think the best arguments that I've, I've heard the government offer up is the idea that you might remotely wipe your phone.
[52:13.040 --> 52:16.220]  And if they take the time to get a warrant, the evidence might disappear.
[52:17.480 --> 52:30.960]  And, you know, our response to that has been that, you know, a sound forensic practice would be to, you know, put that phone in a Faraday bag of some sort and, you know, basically get a warrant and then search it.
[52:31.400 --> 52:34.840]  Because if you don't do that, I mean, you may end up tainting your evidence anyway.
[52:35.100 --> 52:42.980]  So, I mean, if you have a situation where a policeman is just rifling through a phone, that's probably not a good situation from a forensics perspective.
[52:43.520 --> 52:47.300]  So, yeah, I would say that's probably the best argument.
[52:47.820 --> 52:48.740]  Okay, thank you.
[52:51.280 --> 52:59.740]  Could you go over a few of the main differences between a criminal investigation versus like a civil lawsuit, like discovery law that would...
[53:00.300 --> 53:00.620]  Discovery?
[53:00.940 --> 53:12.320]  Yeah, like, so instead of when, you know, they're searching your house, but when you're in the discovery process and you're being asked questions and, you know, you're having to give up information voluntarily.
[53:14.840 --> 53:17.240]  I think that that could be a very long and involved answer.
[53:17.480 --> 53:19.600]  Why don't we talk about that a little later, if that's okay?
[53:20.460 --> 53:21.400]  All right, great talk.
[53:21.720 --> 53:21.960]  Thank you.
[53:21.960 --> 53:24.800]  You said financial info is always privileged.
[53:25.220 --> 53:30.940]  So, if I upload a copy of like QuickBooks to my Dropbox, would that prevent them from revealing any of my data?
[53:31.180 --> 53:36.260]  So, I'm sorry, I did not mean to suggest that financial data is always privileged.
[53:36.620 --> 53:47.240]  What I meant to say, I mean, my point was that there are different laws that protect privacy of financial data in certain circumstances, like when it's held by financial institutions.
[53:47.240 --> 53:53.180]  And I wasn't sure how those laws interact with ECPA, with the communications privacy laws.
[53:53.980 --> 54:01.560]  I don't think it is sort of universally true that financial data gets, you know, like a special like financial privilege or something like that.
[54:02.240 --> 54:24.340]  But what I would say is that, you know, if you have data that you encrypt that is uploaded to a service like, well, to a third-party storage service, and you are the only one who's in a position to decrypt that information, I think that you're in a pretty good position legally because,
[54:24.340 --> 54:29.560]  you know, they're gonna have a hard time getting access to that data with a low-level process.
[54:30.280 --> 54:34.240]  Because, you know, you would have to be in a position to have to decrypt it, right?
[54:34.240 --> 54:34.320]  Well, that's great.
[54:34.660 --> 54:36.800]  So we'd be talking about Fifth Amendment stuff at that point.
[54:37.420 --> 54:37.820]  That's it.
[54:37.920 --> 54:38.000]  Okay.
[54:38.160 --> 54:38.280]  Sorry.
[54:38.400 --> 54:38.640]  I'm done.
[54:38.840 --> 54:39.440]  Thank you guys.