Would police in the US have any alternative for handling a confiscated computer with a hidden partition?

Question

I've heard some fellow geeks (who are always obsessed with computer privacy) talk about how 'amazing' a hidden partition is for privacy. I don't really see the point of all the trouble if I'm not actively engaging in illegal activities on my machine, but for now I'm more interested in rather or not such a hidden partition is as foolproof as these individuals claim; specifically would it really render any law enforcement powerless to do anything.

Without going too deep into the technical factors involved the idea is to have another partition (ie part of the computer reserved to install and run software on) where the partition is both encrypted and not listed in the boot sector, where partitions are usually stored. The net result is a hidden partition, no one can see or access it without using some special boot technique, such as using a CD or thumb drive to change how the computer boots up, to connect to it. if you don't plug in your magic thumb drive before you start your computer then in theory it would be impossible to tell you have another hidden partition or connect to it.

I know enough about computers to know this hidden partition isn't quite as foolproof as claimed, as inferring the existence of a hidden partition shouldn't be impossible on a technical level. The fact that a large part of the computer isn't allocated, effectively preventing use of part of your computer's storage, should be enough to make an analyst at least suspect a hidden partition may exist, doubly so if someone mostly used their hidden partition so that their visible partition was rarely used or too small to be useful. Once a hidden partition is suspected some analysis of 'randomness' of the 1 and 0 on the unallocated space could be used to provide extremely strong evidence that there was encrypted data saved there, with a very large area of encrypted data in turn being very suggestive, but not definitively prove, that a hidden partition is being used.

So say that a suspected criminal, who used one of these hidden partitions, had his computer confiscated. Let's further say the polices' technical folks are on the bar and noticed the evidence which strongly suggests, but could never definitively prove, that the suspect was using a hidden partition. The police would, of course, like to get access to this hidden partition to see if anything incriminating is saved on it, but their going to need the magic thumb drive to view anything saved on it.

I suspect the police could not compel the criminal to hand this over directly, as the evidence, no matter how suggestive, would not be be absolute proof that the hidden partition existed. Though if the police were able to find some other proof of a hidden partition, such as conversations the suspect had with someone where the suspect refers to his use of such a partition, they may be able to meet a sufficient burden of proof to compel the suspect to make the content of the partition available to them?

Would there be any other options that the police may have to deal with such a suspected hidden partition which may contain incriminating data? The two obvious ones I could think of are:

1. getting a second search warrant to allow them to search for the thumb drive used to connect to the partition. I imagine that they only need reasonable suspicion of a hidden partition to get a more extensive search warrant? Though I doubt that would be too useful since a criminal would presumably destroy such a device immediately after their computer was confiscated to prevent police from getting hold of it?

2. Could the mere (strongly suspected) presence of a hidden partition be used against the suspect? for instance in a criminal trial could the prosecutor argue the fact that the suspect was apparently going to great lengths to make it impossible to see what he was using his machine for as evidence that the suspect likely was doing something unlawful with the machine?

Answer 1

Though if the police were able to find some other proof of a hidden partition, such as conversations the suspect had with someone where the suspect refers to his use of such a partition, they may be able to meet a sufficient burden of proof to compel the suspect to make the content of the partition available to them?

The US courts have ruled on this, and the answer is "no":

San Francisco - A federal appeals court has found a Florida man's constitutional rights were violated when he was imprisoned for refusing to decrypt data on several devices. This is the first time an appellate court has ruled the 5th Amendment protects against forced decryption – a major victory for constitutional rights in the digital age.

In this case, titled United States v. Doe, FBI agents seized two laptops and five external hard drives from a man they were investigating but were unable to access encrypted data they believed was stored on the devices via an encryption program called TrueCrypt. When a grand jury ordered the man to produce the unencrypted contents of the drives, he invoked his Fifth Amendment privilege against self-incrimination and refused to do so. The court held him in contempt and sent him to jail.

TrueCrypt is one of the forerunners of hidden partition cryptographic tools. The anonymous team behind it closed shop suddenly and unexpectedly in 2014 in mysterious circumstances.

getting a second search warrant to allow them to search for the thumb drive used to connect to the partition.

This is entirely reasonable, as it does not require self incrimination - if the USB key was password protected (as it should be) then you are back to square one.

Could the mere (strongly suspected) presence of a hidden partition be used against the suspect? for instance in a criminal trial could the prosecutor argue the fact that the suspect was apparently going to great lengths to make it impossible to see what he was using his machine for as evidence that the suspect likely was doing something unlawful with the machine?

It would be a very weak argument, if allowed by the court - the defence could equally argue that the partition contains medical information, self taken naked pictures or grand political plans that the defendant does not want to be made public. Both arguments would technically be equal in nature, as the contents cannot be corroborated.

Answer 2

There have been several cases with several outcomes. Here’s what I think the current state is:

1. You never have to produce the password. Unlocking the drive without anyone seeing the password is good enough.

2. If the mere fact that you can decrypt the drive is incriminating then decrypting it would be self-incriminating and you don’t have to do that.

3. The police needs a warrant for the data. Which means they need reasonable grounds to believe that there is relevant evidence on the drive. The fact that you were hiding the drive or refuse to decrypt it doesn’t give these reasonable grounds.

4. If the police has a warrant, and (2) doesn’t apply, you have to unlock it.

5. In a civil case, if you don’t provide things that are asked for in discovery, a court can assume that what you are hiding speaks against you.

Answer 3

First of all, there is no need to have that "magic" thumb drive to prove that a "hidden" partition exists. A mediocre system engineer can just boot the computer from his own geeky thumb drive and see what partitions there are.

So, it will be pretty easy for the police to prove that there is a partition that is not visible when the computer is booted normally.

But that's all they can prove.

If done properly, it will be impossible to prove that the "hidden" partition contains any encrypted data — versus just being rubbish of zeroes and ones. This is where the owner's "magic" thumb drive is needed together with the knowledge of how to use it (what commands and password to enter). And this knowledge is protected by Fifth Amendment. Even if the police finds this thumb drive, again, it will be impossible to prove that it can be used to open the partition (if made properly).

Obviously, the argument can be "what would be the reason to have such a partition other than to keep encrypted data on it?". But this does not prove that there is encrypted data, let alone unlawful data.

Therefore, rubber-hose cryptanalysis is the only feasible way, be it legal or not.