Thesis Defended

I knew when I walked into the room that it was going to be tough. Lars and Jordan sat on one side of the room with Professor Martin and Oren Rawlings were on the other side of the room. There was an empty chair on either side so I could imagine Dag in whichever position I wanted.

10:00 p.m.

My thesis has been defended and I now await my degree! Lars called at 6:00 to say that the committee had approved my thesis and recommended graduation with honors. What a long haul. It took them long enough. I presented at 10:00 and argued until 12:30. If the audience had been allowed to participate instead of just the committee, I don’t think I’d be out of there yet. That was the big surprise of the day. Cinnamon asked if she could watch since she’s never seen this side of the computer forensics business. She kind of thinks being a detective is all about having a clever disguise and impenetrable secret identity. What I wasn’t expecting was that Lars had invited the entire Criminal Justice Department to observe. There were 20 people in the little conference room that we used for the presentation.

In 1998, computer hacker Kevin Mitnick was doing time for having breached computer security and allegedly having stolen billions of dollars worth of computer software and intellectual property. He was kept in prison without trial longer than any civilian before the War in Afghanistan. While appellate courts through out nearly every motion made to set bail and gain release of Mitnick, and while Mitnick himself was becoming an urban legend, The United States District Court did establish that the government could not hack into Mitnick’s encrypted files to gain evidence against him, nor was the defense required to provide the government files from Mitnick’s encrypted drives.  While prosecution has an affirmative duty to reveal evidence favorable to the defense, the defendant has no reciprocal duty. The Fifth Amendment cannot force a defendant to explain the evidence in the prosecution’s possession. So the court noted that encrypted evidence would not be part of the prosecution’s case since it had no idea of what the files contained. The court concluded that “as long as he has the keys in his pocket, there’s nothing this court is going to do about it. The court denied access to the encrypted material unless Mitnick gave up the encryption key.

In another case, just a few years later, Ari David Levie appealed his conviction in Minnesota for various child pornography and child sex abuse charges. In his appeal, he said that the court improperly allowed evidence from his computer, including his browser history and the presence of encryption software to be admitted in the trial. The Minnesota Appeals Court ruled that presence of encryption software on a computer may be viewed as evidence of criminal intent, and that therefore the evidence was admissible.

My thesis is that encryption software and encrypted files are not evidence of wrong-doing, or of criminal intent, and that on the contrary, encryption of computer files is the only way to prevent such heinous crimes as identity theft and theft of intellectual property, or corporate espionage. Therefore, evidence pertaining to the mere existence of encryption software on a computer—which has increasingly been included in computer software and operating systems, including Mac OSX and Windows Vista—implies neither criminal intent nor malfeasance and that as such it would be a breach of civil liberties to attempt to break an encryption code or to assume wrong-doing because either encryption software or encrypted files happen to exist on a computer.

“Ms. Riley,” came my first question from Mr. Rawlings of Microsoft. “In your opinion, and based on your research, do you believe that the encryption routines embedded in operating systems or computer software could be used as evidence against, say yourself, if your computer was confiscated by the police?” Whoa! Let’s get personal right away.

“The laws have not been fully tested,” I said. “The courts sidestepped the issue in the Levie case by saying that conviction was based on the first-hand testimony of the child involved and was merely corroborated by browser history and the presence of encryption software. I believe that the ruling may have been different had it been anything other than a child pornography charge. In general, our society considers that a far more heinous crime and juries are far more willing to convict for the sake of the victim, than, say, a crime that was merely financial in nature. I consider it unlikely that the fact that I password protect my private journal, written in Microsoft Word, as admissible that I was doing something fraudulent. In fact, I simply don’t want my personal musings to become public should I die or my computer be stolen by a pernicious individual. I’d die of embarrassment—again.” That succeeded in lightening things up a bit, but Jordan went on the attack.

“As someone who is tracking down financial crimes on a daily basis, I can say that the first thing we look for is the presence of encryption software, or encrypted files. I say that if you have reason to suspect that the person is concealing a crime and can convince a judge that you need a search warrant, a person’s computer is no different than any other room in his home. We should have the right to demand access and to search encrypted files just as we would search the kitchen, basement, and behind the toilet tank, for concealed evidence in the case.”

“But that is a fundamental infringement of First Amendment rights,” said Professor Martin. “You are asking the defendant to provide evidence against himself by giving you the keys to his files.”

“And in the Levie case, there weren’t even any encrypted files,” Mr. Rawlings said. “That’s simply a presumption of guilt based on something that is increasingly circumstantial.”

“But if we are to stop terrorism,” Lars said, “we have to be able to tell what these people are planning. We can’t let encryption that is better than the government’s go unchallenged.”

“The next thing you will want is to use x-ray vision to see through people’s clothes when they board an airplane,” Professor Martin said. “It is a gross invasion of privacy.” It was twenty minutes before I was actually asked another question!

As you can see, law enforcement and investigation were opposed to my thesis, while both academic and commercial interests were proponents. In the end, neither side “won the argument,” which was not the point in the first place. But both sides agreed that the arguments in my thesis had merit and added to the body of academic knowledge in a field that was of utmost importance to both law enforcement and human civil liberties. But it took them five hours to reach that decision! Lars said there was not a page in my paper that wasn’t challenged and that my research and reading (thank you Dag!) were so well documented that even those who disagreed with my conclusions could not disagree with my research. Lars has recommended that I pursue a PhD in Criminal Justice and Computer Forensics.

Cinnamon was all *squee* when I finished. We had a light lunch and went back to the office to check the recordings we were making of Georgia’s house while we were away. We were reviewing tapes when in walks Detective Handsome. I felt guilty when I closed the lid on my laptop, putting it immediately into hibernation. (It will be a miracle if I can get this new system to wake up.)

“I here there is a reason to celebrate,” Tom said as he entered my office. “I am off for four hours. How about dinner?” Am I going to say no to that? No. Cinnamon, bless her heart, begged off saying that she had a prior commitment, but shooed us out of the office to go have our little dinner. It was fun and I had to tell him all about my adventure in thesis defense. I so wanted to tell him about the investigation at Georgia’s house, but realized that if anything comes of it, I will have to turn my evidence over to Tom, disguised as Peg. Oh, what a pain in the ass! I couldn’t even tell him about being drugged and nearly raped Saturday night or my treatment at police headquarters. That wasn’t me. It was Peg.

I got home about 9:30 and Tom rushed off to his stake-out. I popped open my laptop and tapped into the virtual private network at work. I picked up where Cinnamon and I left off in our review of the tapes. It was pretty slow and dull going with the tape running forward at 4x normal speed. I almost missed the action. It was so not what I was expecting!

It didn’t come in the middle of the night or wee hours of the morning. In fact, it came while I was defending my thesis, comfortably certain that no one would break in in the middle of the day. What were they thinking. There wasn’t a room in the house that they didn’t go through. Holy shit!