Stocks & Blondes
17
Thesis defended
I KNEW when I walked into the room, it was going to be tough. Lars and Jordan sat on one side of the room with Professor Martin and Oren Rawlings on the other side. There was an empty chair on either side so I could imagine Dag in whichever position I wanted.
Defense
My thesis has been defended and now I await my degree. Lars called in the evening to say the committee had approved my thesis and recommended graduation with honors. What a long haul. It took them long enough. I presented at ten in the morning and we argued through lunch. If the audience had been allowed to participate instead of just the committee, I don’t think I’d be out of there yet. Cinnamon asked if she could watch, since she’s never seen this side of the computer forensics business. She kind of thinks being a detective is all about having a clever disguise and impenetrable secret identity. I wasn’t expecting Lars to invite the entire Criminal Justice Department to observe. There were twenty people in the little conference room we used for the presentation.
In 1998, computer hacker Kevin Mitnick was doing time for having breached computer security and allegedly having stolen billions of dollars worth of software and intellectual property. He was kept in prison without trial longer than any civilian before the War in Afghanistan, while appellate courts threw out nearly every motion made to set bail and gain release of Mitnick, and while Mitnick himself was becoming an urban legend. The United States District Court did establish that the government could not hack into Mitnick’s encrypted files to gain evidence against him, nor was the defense required to provide the government files from Mitnick’s encrypted drives. While prosecution has an affirmative duty to reveal evidence favorable to the defense, the defendant has no reciprocal duty. Under Fifth Amendment protection, prosecution cannot require a defendant to explain the evidence in the prosecution’s possession nor force the defendant to give up the encryption codes. So, the court noted that encrypted evidence would not be part of the prosecution’s case since it had no idea of what was on the encrypted devices. The court concluded that “as long as he has the keys in his pocket, there’s nothing this court is going to do about it.” The court denied access to the encrypted material unless Mitnick voluntarily gave up the encryption key.
In another case, just a few years later, Ari David Levie appealed his conviction in Minnesota for various child pornography and child sex abuse charges. In his appeal, he said the court improperly allowed evidence from his computer, including his browser history and the presence of encryption software to be admitted in the trial. The Minnesota Appeals Court ruled that the presence of encryption software on a computer may be viewed as evidence of criminal intent, and therefore the evidence was admissible.
My thesis is that encryption software and encrypted files are not evidence of wrongdoing or of criminal intent and, on the contrary, encryption of computer files is the only way to prevent such heinous crimes as identity theft, theft of intellectual property, or corporate espionage. Therefore, evidence pertaining to the mere existence of encryption software on a computer—which has increasingly been included in computer software and operating systems—implies neither criminal intent nor malfeasance and as such it would be a breach of civil liberties to attempt to break an encryption code or to assume wrongdoing because either encryption software or encrypted files happen to exist on a computer.
“Ms. Riley,” came my first question from Mr. Rawlings of Microsoft, “in your opinion and based on your research, do you believe that the encryption routines embedded in operating systems or computer software could be used as evidence against, say yourself, if your computer was confiscated by the police?” Whoa! Let’s get personal right away.
“The laws have not been fully tested,” I said. “The courts sidestepped the issue in the Levie case by saying the conviction was based on the firsthand testimony of the child involved and was merely corroborated by browser history and the presence of encryption software. I believe the ruling might have been different had it been anything other than a child pornography charge. In general, our society considers that a far more heinous crime and juries are far more willing to convict for the sake of the victim than, say, a crime that was merely financial in nature. I consider it unlikely that my protection of my private journal with a password, a provision made in Microsoft Word, as admissible that I was doing something fraudulent. In fact, I simply don’t want my personal musings to become public should I die or my computer be stolen by a pernicious individual. I’d die of embarrassment—again.” That succeeded in lightening thing up a bit, but Jordan went on the attack.
“As someone who is tracking down financial crimes on a daily basis, I can say the first thing we look for is the presence of encryption software, or encrypted files. I suggest that if you have adequate reason to suspect a person is concealing a crime and can convince a judge of the need for a search warrant, a person’s computer is no different than any other room in his home. We should have the right to demand access and to search encrypted files, just as we would search the kitchen, basement, and behind the toilet tank for concealed evidence in the case.”
“But that is a fundamental infringement of Fifth Amendment rights,” said Professor Martin. “You are asking the defendant to provide evidence against himself by giving you the keys to his files.”
“And in the Levie case, there weren’t even any encrypted files,” Mr. Rawlings said. “That’s simply a presumption of guilt based on something that is increasingly circumstantial.”
“But if we are to stop cyberterrorism,” Lars said, “we have to be able to tell what these people are planning. We can’t let encryption go unchallenged.”
“The next thing you will want is to use x-ray vision to see through people’s clothes when they board an airplane,” Professor Martin said. “It is a gross invasion of privacy.”
“Professor,” I said softly, “perhaps you haven’t traveled by air recently. They’re actually doing that.”
As you can see, law enforcement and investigation were opposed to my thesis while both academic and commercial interests were proponents. In the end, neither side ‘won the argument,’ which was not the point in the first place. But both sides agreed that the arguments in my thesis had merit and showed that I fundamentally understood a field that was of utmost importance to both law enforcement and human civil liberties. But it took them five hours to reach that decision!
Lars said there was not a page in my paper that wasn’t challenged and that my research and reading (thank you, Dag!) were so well-documented that even those who disagreed with my conclusions could not disagree with my research. Lars has recommended that I pursue a PhD in Criminal Justice and Computer Forensics.
Unauthorized entry
Cinnamon was all squee! when I finished. We had a late lunch and went back to the office to check the recordings we were making of Georgia’s house while we were away. We were reviewing recordings when in walks Detective Handsome. I felt guilty when I closed the lid on my laptop, putting it immediately into hibernation.
“I hear there is a reason to celebrate,” Tom said as he entered my office. “I’m off for four hours. How about dinner?” Am I going to say no to that? No! Cinnamon, bless her heart, begged off, saying she had a prior commitment and shooed us out of the office to go have our little dinner. It was fun and I had to tell him all about my adventure in thesis defense. I so wanted to tell him about the investigation at Georgia’s house but realized that if anything comes of it, I will have to turn my evidence over to Tom disguised as Peg. Oh, what a pain in the ass! I couldn’t even tell him about being drugged and nearly raped Saturday night or my treatment at police headquarters. That wasn’t me. It was Peg.
I got home about nine-thirty and Tom rushed off to his stakeout.
I popped open my laptop and tapped into the virtual private network at work. I picked up where Cinnamon and I left off in our review of the recordings. It was slow and dull, even with the recording running forward at 8x normal speed. I almost missed the action. It was so not what I was expecting!
It didn’t come in the middle of the night or wee hours of the morning. In fact, it came while I was defending my thesis, comfortably certain no one would break in in the middle of the day. What were they thinking? There wasn’t a room in the house they didn’t go through. Holy shit!
Comments
Please feel free to send comments to the author at devon@devonlayne.com.
