Not to say that lawyers can never give good legal advice to legal questions without researching--but the paradigm that I just described is a big reason why people, including lawyers, answer legal questions with "hire a lawyer."

I'm sympathetic to your cause, but playing with intellectual property issues is serious stuff and the reality of the situation is that better-funded players will not infrequently attempt to bully you into getting what they want, as appears to have occurred here. Obviously hindsight is 20/20, but you should have consulted an attorney immediately on receiving a cease-and-desist letter, even if you thought that their claim was entirely frivolous (which, given the facts presented here, is hard to say). Had this occurred, you almost certainly would either not be in this situation, or saved yourself a ton of trouble.

Given that you did not and this situation has evolved to what it is, your only choice is to retain an attorney if you’d like to continue operate the app and not pay whatever damages they alleged. And, frankly, you're in a poor position because, since the court has already entered a default judgment against you, you will have to show cause as to why the court should set aside this judgment, which will require more time and effort than if you have initially opposed the lawsuit, even if what you say regarding a piece of the document missing is true.

If you do retain an attorney and fight this, realize that, if you lose, the opposing side might be able to recoup the entirety of their attorney's fees (which would be very expensive for you, particularly in the unlikely event you went to trial or the like, and it appears that they have already alleged this right now), and, possibly, your profits (depending on a number of factors). That's very serious stuff.

I wish I could give more direct advice, and I strongly agree with commenters here in other posts lamenting how elitist law is and so on, but you have absolutely no alternative but to retain an attorney. I don't know where you live and where this litigation is taking place, but there are tons of lawyer referral services out there (your local county bar will have such a service, you can find out on their website), and you can speak to various attorneys who might understand your financial situation and be able to work with whatever budget you have. Just because an attorney says that they charged $X does not mean that you can’t find another, competent attorney, who might charge less. If I were in your position, and wanted to fight this, I would spend my time either finding/raising money, or talking to attorneys about how you can structure a fee schedule that would work with your finances (lawyers are open to negotiating: you can say "I can only pay you this or that" or "I can pay you this or that in the future"—see what they say and how flexible they will be). I am skeptical that someone would take your case pro bono.

As a general piece of advice based on personal experience to others: don't ignore intellectual property issues. Getting a trademark is not particularly expensive (and, unlike this situation, something that you can, actually, do without consulting an attorney, or at least for little $ should you need to consult an attorney) and can save you headaches in the future. If you receive a cease and desist-type letter, take it seriously, regardless of how frivolous you think their claim is. If whoever sent you the letter went to the trouble to have their lawyer draft a letter to you--which means that they probably paid the lawyer a non-insignificant fee to do that--they are certainly taking it seriously, and so should you. Even well-funded companies don't throw money away to, of all people, lawyers, unless they think they can get something they want from you, and/or they think they actually have a meritorious claim. Do not attempt to respond to the cease and desist letter, unless you have experience in how to do this. If you want to avoid paying an enormously onerous legal fee, you can try your hand at drafting a response—but absolutely get a lawyer to look at it prior to sending it. This may be more affordable than you think (~1-2 hour of work, or the like, for a lawyer). If you're worrying that you may be infringing someone else's trademark, or someone will try to sue you in the future (as apparently happened here), you can get a declaratory judgment (for a fee) from a court stating that you're not infringing-again, something to talk to a lawyer about.

http://www.techdirt.com/articles/20091207/1149277233.shtml

Additionally the other big case in this domain, Capital v. Thomas, has seen much of the same. Some very talented people working the case pro-bono, but seemingly doing this for the spotlight.

It's good to have options. It's good to not have these things turn into a circus if it can be helped. But then again, IANAL.

http://www.nwprogressive.org/weblog/2012/04/supreme-court-sa...

I don't think is a wise idea to take this to the supreme court at this moment. They could easily say that it is illegal to record police.

By the way, the word you're looking for is "unconstitutional", not "illegal". Even should the Court restrict the right to record--which they won't, it's a well-established right--jurisdictions may establish that right through law anyway.

I'd totally take a beatdown if it would make me a multi millionaire :)

In a number of ways the process is more open and participatory than legislative law making, and, as mentioned, the regulations passed often have more of a direct impact on day to day life. There are a number of solutions out there that are attempting to make this process more transparent and participatory: for example, http://regulationroom.org/ (operated by a clinic at Cornell law school). In my opinion, informing the public of the importance and participatory nature of rulemaking (and getting more people involved) is probably a more realistically achievable goal than the proposed solution, and would likely have more tangible effect.

So, the issue as related to piracy is not necessary that people would never change their behavior, its just that the cost of monitoring behavior and enforcing currently existing law/creating new law to effect such a behavioral change ("don't pirate stuff") is extraordinarily high. Right now, the strategy of the media industry appears to be to spend money under the presumption that the amount of money they spend enforcing/lobbying/trying to pass laws to prevent piracy makes economic sense: they will gain/save more money than they spend. This seems unlikely, but probably people have punched the numbers for these companies and concluded that this is the case. The radical alternative approach is to completely rethink the distribution and pricing scheme, and focus less on margins but more on quantity--distribute the content to as many people as possible, but make fewer $/product. To impose that would require either some fairly revolutionary thinking in companies that have repeatedly shown a hesitancy to innovate (and would require them to abandon a strategy now that still makes hefty profits), or to make media companies hurt to such an extent that they have no alternative (which, right now, does not appear to be happening).

Of course it's the case: their endgame is to get governments to criminalize all copyright infringement and get the taxpayer to pay for all that. Of course, the balance for society as a whole is well in the red, but why should they care?

But the worst is not the economic costs, but the (much more important IMHO) costs in terms of human rights, such as freedom from censorship, privacy, access to a indispensable medium, etc.

The issue here is child pornography: the would-be defendant was suspected of having child pornography on various hard drives which were encrypted. The court states that the actual contents of the hard drive are themselves not testimonial—that is, they are not covered by the Fifth Amendment and, if the government had access to the hard drives, they could present whatever was incriminating on them into evidence. So the issue is whether the act of producing the documents is a testimonial act and therefore covered by the Fifth Amendment

The court concludes that the act of production is a testimonial act because, one, the testimony was not a "foregone conclusion." This holding is based on a case called Fisher v. United States, in which the Supreme Court stated that it was not testimonial to hand over certain papers that might have incriminating evidence because conceding that documents existed, that you had control over the documents, or that they were in your possession was not incriminatory given the circumstances of that case. Under the "foregone conclusion" doctrine, the government knew of the existence and location of these papers so the production of the papers added nothing or little to the government's information. If the government did NOT know that documents existed, they could not compel a would-be defendant to reveal the documents.

Second, and most importantly, the court concluded that decrypting the documents would "use the contents of [the would-be defendant]'s mind" because "the decryption and production would be tantamount to testimony by Doe of his knowledge of the existence and location of potentially incriminating files; of his possession, control, and access to the encrypted portions of the drives; and of his capability to decrypt the files." It's again important to note that this is a child pornography case: possession of child pornography is a crime, so if the would-be defendant here provided a decryption key, this would be tantamount to him admitting that he possessed the hard drive and had access to the files within it—that alone would constitute a crime if the files were found to be child pornography. This is therefore what the court later refers to as an "implied factual statement" and the Fifth Amendment protects this. Although the court also suggests that providing a decryption key might be like providing a combination (and therefore be admissible for Fifth Amendment protection on other grounds), it unfortunately devotes very little space to this discussion—and this seems to be the really big issue here.

The case therefore leaves several unanswered questions: this is a child pornography cases where mere possession alone is a crime: what if that wasn't the case? What if this was a murder case and the defendant had stored notes about his murder on the computer? What if the foregone conclusion doctrine wasn't applicable—would the conclusion here be the same (most of the opinion is actually devoted to this discussion, which is less broadly applicable because, if the police know of the existence of specific files on hard drive, this doctrine is inapplicable)?

Anyhow: it still is possible to get access to these documents if the government gives him sufficient immunity, as the court notes. This would be pretty important because if no one could ever access these documents (which presumably would be possible if the would-be defendant doesn't decrypt them) that would be an enormous problem for our justice system.

In conclusion: the applicability of this case to future cases is unclear, so, for those that want this result, I don't really think this is a "slam dunk." There will likely be many future cases further developing this doctrine. As such, right now, it's very difficult to discuss the merits of the court's holding on the "decryption is testimony" argument (which, in my mind, is the most important) in a general sense, since the reasoning here seems very specific to the facts of case.

If someone is asked to decrypt their drive for a murder case, could they then invoke the Fifth Amendment on the basis that they might have child pornography? Can the Fifth Amendment protect you on an unrelated crime that you mention without either admitting to it?

In short, a judge will grant a person legal immunity from prosecution. This removes the fifth amendment argument, as you cannot be prosecuted for the child porn, and you can be compelled to testify.

For example, an accomplice to a crime might be offered immunity -- after which the accomplice cannot refuse to testify under the fifth amendment. Remember, the fifth only guarantees that you will not be compelled to serve as a witness against yourself -- it does NOT grant you the right to remain silent at all times, contrary to popular belief.

as it should be! i think that neither "all decryption is testimonial" or that "no decryptions are testimonial" are good policies. imho, decryptions should be treated in the same manner as other paper based evidence production requests: most of the time, the government cannot compel you to produce evidence testifying against you, but there are certain exceptions ("foregone conclusions" included).

> What if this was a murder case and the defendant had stored notes about his murder on the computer?

i don't think you're interpreting the "foregone conclusion" doctrine correctly. what it means is that keys, passwords, decryptions, etc cannot be used for the police to go on fishing expeditions for evidence. if they know you have incriminating evidence and can show that, then they can compel the production of that evidence. this is something that happened in US v Fricosu, in which Fricosu actually was compelled to decrypt. note that this ruling, which does not compel decryption, is entirely consistent with US v Fricosu

not if it knew that these documents were under your control and were incriminating. what exactly suggests your reading? the opinion was pretty specific about how the government could not prove the existence of any specific incriminating files on the defendant's drive, and thus, it was not a foregone conclusion

> the murder case ... possession of those files alone would not constitute a crime

whether the possession of the files is in and of itself a crime is irrelevant to the fifth amendment. the only thing that matters is whether your testimony can be used to incriminate yourself.

> Given the dicta in this case, however, it is arguable that, even in such a scenario, a defendant would be able to prevent decryption, thus creating an inconsistency with Fricosu

Author of the article disagrees. From the article:

> Also note that the court’s analysis isn’t inconsistent with Boucher and Fricosu, the two district court cases on 5th Amendment limits on decryption. In both of those prior cases, the district courts merely held on the facts of the case that the testimony was a foregone conclusion.

However, in addition to that, the court notes that there are two reasons why the Fifth Amendment prevents compelled description. Besides the foregone conclusion doctrine, there is discussion such at 22: "the decryption and production of the hard drives would require the use of the contents of Doe’s mind and could not be fairly characterized as a physical act that would be nontestimonial in nature. We conclude that the decryption and production would be tantamount to testimony by Doe of his knowledge of the existence and location of potentially incriminating files; of his possession, control, and access to the encrypted portions of the drives; and of his capability to decrypt the files." This to me implies the court's belief that the act of production would be testimonial because it would imply that Doe possesed and had access to incriminating files. Since possessing and having access to child pronography is a crime, that alone--that act of him affirming that he had access to such files by providing a decryption key--would incriminate him. By implication, this would not be the case if possession of certain docuemnts was not itself a crime, yet these documents could be incriminating.

The court spends 2 paragraphs discussing this, but I think it is not inconceivable that this sort of argument could be applied to other cases where the foregone conclusion doctrine might otherwise be succesfully applied to compel decryption, since ostensibly any 1 of the court's two points could be used to prevent compelled decryption. I wonder if this conclusion is based solely on the nature of the crime alleged here, or would be applicable to other crimes where merely showing that you have possession to access to incriminating documents is not itself a crime, as in child pornography.

Here's the sticking point for me: it's perhaps overly pedantic, but I want to view the world honestly, and there are some great points of absurdity here. (I always like the absurd, and the ways our world is otherworldly.)

The problem is that much of our approach to information is creative, and we need to start thinking in those terms.

If you have a JPEG of a murder on your unencrypted hard drive, that's not actually a photograph; it's a set of magnetic pointings which can with certain hardware be used to produce a photograph. If you think about it, that also applies to writing on paper, or colored splotches encoding an image into a physical photograph. Those require a creative attempt to produce meaning. The meaning can be off if the creative attempt is not followed through correctly. The easy way to see this is to imagine someone systematically using a common word in an uncommon way -- Feynman for example was once, on the Challenger commission, chasing down memos which sounded like NASA had been actively irresponsible, but instead it turned out to be a figure of speech they'd adopted for a certain phase of their construction. Or imagine that our demented individual really does have a very detailed, lifelike photograph which appears to document his murder of another, but in fact the "murdered" girl is a still-alive actress who was paid to appear in these photographs; the "blood" and such is very convincing but is ultimately a prop.

So the meaning can be off, if the creative act goes awry. I'm using this to underscore that you have to think, at some level, about that recreation of semantics from the physical fact.

Let me be clear: I don't think this is a barrier to investigation usually. I think it's clear that we expect a sort of 'normal hardware' that allows us to recreate semantics. The photographs in this safe, when viewed by a normal person in normal lighting, would show an image of the defendant committing a murder -- and if they want to say that this was all theatrically staged, they may produce the actress or others involved in the production. By that account, photographs inside of a safe are also governed by this principle: even if their physical location happens to be remote and inaccessible, reproducing the image from the photograph is as simple as just looking at it. The photograph really contains the image, up to a 'trivial' semantics.

Now bring this back to your other example of an encrypted disk storing child pornography. That is a nontrivial semantic inflation: you are literally asking the defendant to create child pornography for the purposes of the case. In some sense perhaps you're just saying "create whatever this drive's contents are," with the understanding that the police is going to look through it for child pornography -- in that phrasing, it's more clear that this pornography might not actually exist, etc. -- so there is perhaps a way to comply without generating child pornography at the judge's request.

But still, that's a little mad and absurd in the wonderful way that our world can be otherworldly. It opens up all sorts of questions which I have no clue how to answer. Decryption, like most computation, is a creative act. To demand decryption is to demand creation.

I quoted the above in particular because I really don't care about the "enormous problem for our justice system." Like, the fact that we don't have embedded realtime GPS trackers installed in our spines is an "enormous problem for our justice system" because it makes it so tremendously hard to figure out whether our alibis are true or false. Screw that sort of thinking. Whatever caused the investigators to think this individual was manufacturing or downloading kiddie porn should have been enough to convict. This shouldn't be a gray-matter area. "We just cracked down on this peer-to-peer kiddie porn program, we saw that you were using it to share many images, here are the filenames that the defendant's computer was sharing at the time we busted into his house with a warrant." (Are the police allowed to download such things? Probably. "Here are just a couple of the images we downloaded from him," too, then.) So, if they don't have a case and are fishing through the hard drive to try to make one, that's more or less explicitly what the Fifth Amendment is supposed to guard against: "we don't know your exact sins but we know you're a sinner so damn it, confess!"

But still, the sticking point is the glorious absurdity: "Mr. Doe, we have reason to believe that if you say the magic word, your computer will manufacture child pornography. We demand that you say the magic word, so that we know whether this is true." How will we decide that issue in the face of its pure and present absurdity?

Most encryption software, including TrueCrypt, will complain if you provide the wrong key. I object to this behaviour strenuously. What if it stopped doing that? What if it just gave you whatever output would arise from feeding key x into the algorithm? It would be upon the court to show that the resulting incoherent mass of bytes does not contain "satisfactory" output, which requires them to show what the satisfactory output ought to be, which means they must have some idea of what they're looking for to begin with and the ability to show that it exists on the encrypted medium to begin with. This would be problematic in most cases.

There is another cool utility - encfs. It have magic option "--anykey". Basically, it stops verification of key hash and always tries to decrypt with key you provided. Thing is - it will show you only correctly decrypted files. So, by using different passwords you essentially create layers of encrypted files, where each layer is decrypted by different password..

Truth is - if something did not decrypt, LEO will see it, but I do not see how they could prove you provided wrong password intentionally, and not at some point changed password to new one, and old been forgot. This essentially will happen when you use different password - you will receive no error and empty container where you can start add personal files..

Even if TrueCrypt didn't protect their encryption with a message-authentication code, the police would still notice that you had given them a decrypted file without a filesystem on it -- much less a filesystem containing /media/truecrypt1/where-I-buried-him.txt . If they have already convinced a judge to force you to decrypt the file, they could just tell the judge "this person is being uncooperative!" and your hijinks will get you nowhere.

Now suppose that they do not have this, but convince the judge that since you have TrueCrypt, and this is the only random-looking file on your computer, that this is probably your TrueCrypt archive. They convince the judge to threaten you with contempt if you don't decrypt it, through whatever means they have available to them. Well, TrueCrypt containers are always meant to be directories -- i.e. they always hold file systems -- and so you'd best decrypt this container into a file system! But that severely restricts your defense.

TrueCrypt will let you do something different: to provide a 'wrong key' which indeed decrypts the device to a valid file system. This is their 'hidden volume' system.

I'm kind of mixed in my reaction to TrueCrypt's hidden partitions, for other reasons. But they address the problem that you've identified, and I haven't figured out a better solution.

TrueCrypt is not meant to hold file systems any more than a hard drive is. There is nothing stopping you from not creating a file system on your truecrypt volume and just storing garbage in it - or use another encryption software on top of it.

TrueCrypts hidden-volume feature is quite meaningless in most cases (my opinion) due to the way it is likely used. If you present a decryption key that gives access to a filesystem that does not match what was expected then you are in trouble.

Especially the hidden OS feature... So you have been using this laptop on multiple occasions the last week (of which we have proof) but according to the filesystem you presented to us this system haven't been used for over a month.

The same goes for a hidden volume. Unless you actively use it as often as you use your device (which is really cumbersome to do right) you might just be better of without it since exposing it will tell them way more than you want to tell them (for starters it will tell them that you are actively lying and having made precautions in order to try and get away with lying).

The problem is, due to what I guess is something of a flaw in the central idea, you ultimately have to provide the password for your inner volume when you do all of these things which don't involve it. So now your private data is split up over two drives, which is at least somewhat questionable, and also the "mundane" drive requires the "important" password.

This may be acceptable if you're collecting a small cache of text documents which you believe could harm a corporation -- then you say "no, I don't have those articles, see, this really is just my porn stash, please don't hurt me. But a criminal or a government -- no, they're willing to be patient and they're perhaps willing to peek at your password input prompts with webcams or audio-recordings. They would know that there's an extra password being entered every time you decrypt that file.

this is not a pedantic side concern, but is in fact, the key component of the government's ability to compel evidence production. if they cannot show that they know what's on your hard drive, that you control it, and that what's on your hard drive is incriminating, they cannot compel you to decrypt it.

so yeah, if you gave them a bad key and your decryption algo returned garbage, they'd certainly lock you up for contempt (given the aforementioned conditions were true).

http://en.wikipedia.org/wiki/Deniable_encryption

Now, such isomorphisms turning one information into another could in theory be found for any two pieces of information, but here we are talking about a very limited family of isomorphisms between spaces of all finite binary sequences, so there is little to no creativity involved in selecting and using such an encryption function.

But then you seem to be fine ignoring all that and calling the decrypted contents "child pornography". Why aren't the encrypted contents also child pornography? Why is decrypting them the point of creation, rather than, say, opening them in an image viewer?

Now, I'm also trying to form a line of demarcation for why we feel we can abstract those away, and I think that at least an acceptable first approximation, a first abstraction layer, is something like "a normal person with normal tools can look at X and, through this, view a pornographic image."

If it's encrypted then the point is that this becomes one of Joel on Software's "leaky abstractions." The problem is that no, we can no longer ignore the massive number of creations, because you need to say a Magic Phrase to interpret this thing as an image. If you pronounce a different phrase, it just looks like random data. What we're telling the defendant is something like, "say the phrase that makes this look incriminating" -- or perhaps just "say the phrase that makes this not look random."

I guess to answer your last question: Neither the encrypted nor the decrypted contents are, in the absolute strictest sense, images. They have to be rendered onto a screen and then viewed by a conscious person of sound mind to be images. (Maybe a better word is "viewings.")

So decrypting them is a point of creation, as is opening them in an image viewer, as is looking at that image viewer. The absurd thing to me is, if you really focus on the technical details, you'd have to conclude that they don't become "child pornography" until we view them and say "that looks like it was intended to arouse someone, and it looks like it contains an underage person."

So part of why I'm proposing the above "normal people with normal tools" idea is to give some ground to say that the decrypted stuff "can be thought of as child pornography" -- because a normal person will come to that judgment when using the data in a normal way. So in that sense, the decrypted contents "are" child pornography.

You may wish to ignore me on that; I may be becoming too philosophical and solving problems that don't need solving. Perhaps the big problem that's sitting at the back of my mind is this: for any large random-looking block of bits you give me, there is in principle a stream of bits which can be XORed with it to convert it into a JPEG file. In practice there are some limits based on block sizes and ciphers, but in principle there exists some mathematical transform which converts any normal hard drive into this sort of thing.

So I'm interested in the philosophical problem of excluding all of the transforms which we don't want to admit.

Point being, presuming that something is not a "right" or even a "fundamental right" simply becasue it does not exist in the Constitution or hasn't been interpreted to be included in it is, in my mind, a miscontruing of our federalist system. You could conceive of every state passing legislation permitting abortions (or not making abortions illegal) and have the same result as Roe. Similarly, if Congress has the power to pass a "Privacy Bill of Rights" as normal legislation (i.e. through the commerce clause), this would effectively "increase" the rights everyone has. If Congress wanted to pass a law (again, presuming that they had the power to--which is the underlying issue here) saying something like "everyone has a right to privacy," or criminalizing entities who impinge on people's privacy, this would also effectively increase the rights of everyone, subject to Congress changing its mind in the future.