Policy —

Indefinite prison for suspect who won’t decrypt hard drives, feds say

"This is not a fishing expedition on the part of the government," feds say.

Indefinite prison for suspect who won’t decrypt hard drives, feds say

US federal prosecutors urged a federal appeals court late Monday to keep a child-porn suspect behind bars—where he already has been for seven months—until he unlocks two hard drives that the government claims contain kid smut.

The suspect, a Philadelphia police sergeant relieved of his duties, has refused to unlock two hard drives and has been in jail ever since a judge's order seven months ago—and after being found in contempt of court. The defendant can remain locked up until a judge lifts the contempt order.

The government said Monday he should remain jailed indefinitely until he complies. The authorities also said that it's not a violation of the man's Fifth Amendment right against compelled self-incrimination because it's a "foregone conclusion" that illegal porn is on the drives and that he is only being asked to unlock the drives, not divulge their passcodes.

"This is not a fishing expedition on the part of the government," federal prosecutors told the 3rd US Circuit Court of Appeals of Philadelphia.

The suspect has not been charged with any child-porn related crimes, yet he is imprisoned in Philadelphia's Federal Detention Center for refusing to decrypt two drives encrypted with Apple's FileVault software in a case that highlights the federal government's war on encryption. A federal magistrate has ordered him imprisoned "until such time that he fully complies" with the decryption order. The man's attorney, Federal Public Defender Keith Donoghue, is demanding that the appeals court immediately release his client from prison because he is being "held without charges." (PDF)

Investigators say they know child porn is on the drives. His sister saw some of it, and the suspect is said to have shown his family an illicit video, too.

The drives, the government said, (PDF) were connected to a Mac Pro.

A subsequent forensic exam of his Mac Pro computer revealed that Doe had installed a virtual machine (software that emulates a separate computer within his computer). Within the virtual machine the examiner found one image of what appeared to be a 14-year-old child wearing a bathing suit and posed in a sexually suggestive position. There were also log files that indicated that Doe had visited groups titled: “toddler_cp,” “lolicam,” “hussy,” “child models – girls,” “pedomom,” “tor- childporn,” and “pthc,” terms that are commonly used in child exploitation.

The exam also found that Freenet, the peer-to-peer file sharing program used by Doe to obtain child pornography from other users, had been installed within the virtual machine. The exam showed that Doe accessed or attempted to access more than 20,000 files with file names consistent with obvious child pornography... and that he used the external hard drives seized by Delaware County detectives to access and store the images.

The defendant, who is referred to as "John Doe" in court papers, claims he forgot the passwords. The suspect's identity is Francis Rawls, according to trial court papers.

The government, however, countered.

In fact, Doe had multiple layers of password protection on his devices, and he always entered his passcodes for all of his devices from memory. Doe never had any trouble remembering his passcodes (other than when compelled to do so by the federal court), never hesitated when entering the passcodes, and never failed to gain entry on his first attempt.

In winning the contempt-of-court order, the authorities cited a 1789 law known as the All Writs Act to compel (PDF) the suspect to decrypt. The All Writs Act was the same law the Justice Department asserted in its legal battle with Apple, in which a magistrate judge ordered Apple to produce code to enable the FBI to decrypt the iPhone used by one of two shooters who killed 14 people at a San Bernardino County government building in December. The case was dropped when the authorities paid a reported $1 million for a hack.

The Supreme Court has never addressed the compelled decryption issue. However, in 2012, a federal appeals court ruled that a financial fraud suspect must decrypt her laptop. The ruling wasn't enforced, as the authorities got the password from a co-defendant.

A child-porn investigation centered on Rawls in 2015 when Pennsylvania prosecutors were monitoring the online network Freenet, got a search warrant, and executed it at Rawls' home, the authorities said.

The court may rule on Rawls' plight at any time or schedule oral arguments in a process that could take months or more.

Channel Ars Technica