The District Court for the Eastern District of Wisconsin held last week that compelled production of decrypted data violates the Fifth Amendment because it would require the suspect to admit to having access and control over the devices. In re The Decryption of a Seized Data Storage System, 13-M-449 (E.D. Wis. 2013).
The FBI seized 16 storage devices from the suspect, nine of which were encrypted. After four months of attempts to access the files, the government sought to force the suspect to "assist in the execution" of the search warrant by providing a decrypted copy of the files.
The predominant legal issue in such cases is the Fifth Amendment and whether or not the act of providing the decrypted files would be considered "testimonial." The issue has caused a split in district courts, but only the Eleventh Circuit has decided the issue at the appellate level, holding that forced production does violate the Fifth Amendment.
As distinguished from some other cases, the government here knew the encrypted drives contain files and had evidence to show that some of the filenames indicate they are images of child pornography. Further, the defendant has a computer science degree and works as a software developer, so he "may very well be capable of accessing the encrypted portions of the hard drives."
However, the deciding issue for the court was whether or not the suspect "has access to and control over the ... devices." Because he has not admitted to having access and control, he could not be compelled to provide the decrypted copy.
This is a close call, but I conclude that Feldman’s act of production, which would necessarily require his using a password of some type to decrypt the storage device, would be tantamount to telling the government something it does not already know with “reasonably particularity”—namely, that Feldman has personal access to and control over the encrypted storage devices. Accordingly, in my opinion, Fifth Amendment protection is available to Feldman. Stated another way, ordering Feldman to decrypt the storage devices would be in violation of his Fifth Amendment right against compelled self-incrimination.Thus, the government's attempt to compel production of the files was denied. Visit our encryption label to read about related cases on encryption and compelled production.
For a little more background info, see here: http://www.jsonline.com/news/crime/west-allis-encryption-case-delves-into-fifth-amendment-debate-gi9mrag-204772741.html
ReplyDeleteI wonder how, when the government is aware that the disks contain contraband, the foregone conclusion doctrine does not apply?
ReplyDeleteIt's possible the defendant could have argued that the government could not or did not know the actual disks were his: that would get more to the actual information conveyed by the act of production (i.e., "I have the password to these encrypted disks, therefore, I have control / possession of the disks").
Still, this whole area seems off-balance. I just wrote a paper suggesting that the Fifth Amendment's testimonial distinction (articulated by J. Stevens in Fisher & Hubbell) based on mental v. physical acts just doesn't cut it anymore. It may have worked in the past as a highly administrable rule, especially when the cost to society was low. For example, in Fisher or Hubbell, the Fifth Amendment protected a defendant from surrendering paper documents because he was forced to use the contents of his mind in complying with the subpoena. But the cost to society in these cases was low: the government could simply gather enough evidence (if it existed) for a Fourth Amendment search warrant and get the incriminating documents.
But in the cryptographic context, we have the opposite situation. The government already has probable cause: the disks have been seized. Now, the distinction between physical / mental acts suddenly results in a high cost to society.
Furthermore, the degree the suspects in Fisher and Hubbell used the contents of their minds differs drastically from the degree suspects in encryption cases use theirs. Fisher and Hubbell required the suspects to read the subpoena, interpret it, look through thousands of documents, determine which ones fell within the subpoenas' ambit, decide which documents were responsive, and then surrender the documents. Obviously, the scope of the subpoenas demanded a great deal of effort on the part of the suspects.
But compare that to the crypto context: all the mental effort that is used is, give the password (if I know it).
That hardly seems like the kind of act the Fifth Amendment should be protecting, at least not when the cost is so high.
In any case, interesting case!