A federal judge in Wisconsin has ordered a suspect in a child porn investigation to either provide prosecutors with the passwords to several encrypted storage devices of his that are thought to contain incriminating evidence or to provide them with a decrypted copy of the contents of the drives.
Reversing a ruling from a few weeks ago, Magistrate Judge William Callahan for the U.S. District Court for the Eastern District of Wisconsin ordered Jeffrey Feldman, a senior software development engineer at Rockwell Automation, to comply with prosecution demands for access to the contents of several hard drives seized from his residence.
In a four page ruling last week, the judge noted that prosecutors in the case had provided enough evidence to show that Feldman had access and control over the storage devices. They also have shown that they know the names of files containing child porn and the probable existence of those files on the encrypted hard drives.
So getting Feldman to decrypt the files would not give the government any information they did not already have. As a result the request for the decryption keys did not violate his Fifth Amendment protections against compelled self-incrimination, the judge ruled.
This is not the first time that someone implicated in a criminal investigation has tried to cite constitutional protections to avoid handing over decryption keys to encrypted documents. In each case, the implicated individuals have claimed that turning over the decryption keys would amount to their admitting they had control over and knowledge of the encrypted contents.
In Feldman's case, court records show that federal agents seized a total of 16 storage devices during a search of his residence in January. Nine of those devices were encrypted, making the data in them inaccessible to investigators.
The encrypted programs used to protect the data appeared to be of a kind that would lock or destroy the data if too many failed password attempts were made. FBI investigators did however discover a peer-to-peer file-sharing program on one of the devices that showed that someone had downloaded many files containing names suggestive of child pornography.
After spending four months attempting to decrypt the hard drives, the government filed a motion seeing court intervention in getting Feldman to provide access.
Judge Callahan denied the government's initial motion in April on the grounds that the request would infringe upon Feldman's Fifth Amendment protections.
In order to compel Feldman to disclose the decryption keys, the government needed to show that it already knew what the encrypted devices would contain. They would also need to show that Feldman had access to, and control over the devices that potentially contained the incriminatory evidence.
In his ruling denying the motion, the judge noted that while the government had succeeded on the first count, it had failed to show conclusively that Feldman really had access to the devices.
A few weeks later, Callahan agreed to review the ruling again at the government's request.
This time around, prosecutors provided evidence showing they had managed to decrypt a small portion of the encrypted devices. The partially decrypted devices revealed many files that appeared to contain incriminating images. Also revealed were several files containing detailed financial records and images of Feldman.
The government contended, and the judge agreed, that the contents show Feldman had access and control over the devices in question. "The encrypted storage devices were found in Feldman's residence, where he admittedly lived alone for the past 15 years," the judge wrote in his ruling.
"Significantly, the recently decrypted portion of the storage system contains personal financial documents and images clearly belonging to Feldman," the judge noted. Thus, Fifth Amendment protections are no longer available to Feldman, with respect to the devices in question.
Feldman has until June 4 to comply with the judge's order.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed. His e-mail address is jvijayan@computerworld.com.
See more by Jaikumar Vijayan on Computerworld.com.
Read more about encryption in Computerworld's Encryption Topic Center.