Another Federal Court Says Compelled Decryption Doesn't Raise Fifth Amendment Issues

from the not-a-blanket-statement,-but-more-often-than-not dept

Another federal court is wrestling with compelled decryption and it appears the Fifth Amendment will be no better off by the time it’s all over. A federal judge in North Carolina has decided compelling decryption of devices is only a small Fifth Amendment problem — one that can be overlooked if the government already possesses certain knowledge. [h/t Orin Kerr]

The defendant facing child porn charges requested relief from a magistrate’s order to compel decryption. The government isn’t asking Ryan Spencer to turn over his passwords. But it wants exactly the same result: decrypted devices. The government’s All Writs Order demands Spencer unlock the devices so law enforcement can search their contents. As the court notes in the denial of Spencer’s request, the Fifth Amendment doesn’t come into play unless the act of production — in this case, turning over unlocked devices — is both “testimonial” and “incriminating.”

Spencer argued both acts are the same. The government may not ask him directly for his passwords, but a demand he produce unlocked devices accomplishes the same ends. As the court notes, the argument holds “superficial appeal.” It actually holds a bit more than that. A previous dissenting opinion on the same topic said the government cannot compel safe combinations by “either word or deed.”

This opinion [PDF], however, goes the other way. Judge Breyer likes the wall safe analogy, but arrives at a different conclusion than Justice Stevens did in an earlier dissent. The court finds drawing a Fifth Amendment line at password protection would produce a dichotomy it’s not willing to accommodate.

[A] rule that the government can never compel decryption of a password-protected device would lead to absurd results. Whether a defendant would be required to produce a decrypted drive would hinge on whether he protected that drive using a fingerprint key or a password composed of symbols.

The refusal to craft this bright line ultimately makes little difference. The line already exists. Almost no courts have said the compelled production of fingerprints is a Fifth Amendment violation. Producing passwords, however, is an issue that’s far from settled. In the cases that have gone the government’s way, the key appears to be what the government already knows: the “foregone conclusions.” The same goes here.

The court admits producing unlocked devices strengthens the government’s case even before any searches take place.

So: the government’s request for the decrypted devices requires an act of production. Nevertheless, this act may represent incriminating testimony within the meaning of the Fifth Amendment because it would amount to a representation that Spencer has the ability to decrypt the devices. See Fisher, 425 U.S. at 410. Such a statement would potentially be incriminating because having that ability makes it more likely that Spencer encrypted the devices, which in turn makes it more likely that he himself put the sought-after material on the devices.

But that only deals with the incrimination side. Is it testimonial? The court thinks it isn’t. Or at least, it believes whatever testimonial value it adds is almost nonexistent. All the government needs to show is that the defendant has the ability to unlock the devices.

Turning over the decrypted devices would not be tantamount to an admission that specific files, or any files for that matter, are stored on the devices, because the government has not asked for any specific files. Accordingly, the government need only show it is a foregone conclusion that Spencer has the ability to decrypt the devices.

It’s a low bar but one that’s sometimes difficult to reach if the government can’t clearly link the defendant to the locked devices obtained during the search of a residence or business. As the court notes, it requires more than a reasonable assumption that files the government seeks might reside on the locked devices.

But it is nonsensical to ask whether the government has established with “reasonable particularity” that the defendant is able to decrypt a device. While physical evidence may be described with more or less specificity with respect to both appearance and location, a defendant’s ability to decrypt is not subject to the same sliding scale. He is either able to do so, or he is not. Accordingly, the reasonable particularity standard cannot apply to a defendant’s ability to decrypt a device.

The government needs far more if it seeks to compel decryption.

The appropriate standard is instead clear and convincing evidence. This places a high burden on the government to demonstrate that the defendant’s ability to decrypt the device at issue is a foregone conclusion. But a high burden is appropriate given that the “foregone conclusion” rule is an exception to the Fifth Amendment’s otherwise jealous protection of the privilege against giving self-incriminating testimony.

And the court finds the government does possess clear, convincing evidence.

All three devices were found in Spencer’s residence. Spencer has conceded that he owns the phone and laptop, and has provided the login passwords to both. Moreover, he has conceded that he purchased and encrypted an external hard drive matching the description of the one found by the government. This is sufficient for the government to meet its evidentiary burden. The government may therefore compel Spencer to decrypt the devices.

There is one caveat, however.

Once Spencer decrypts the devices, however, the government may not make direct use of the evidence that he has done so.

As the court points out, if the government’s foregone conclusion is the correct conclusion, additional evidence linking Spencer to the locked devices will be unnecessary. The government should have no use for the testimony inherent in the act — the concession that Spencer owned and controlled the now-unlocked devices, making him ultimately criminally responsible for any evidence located in them.

In terms of compelled production, passwords continue to beat fingerprints for device security, but only barely.

Filed Under: , , , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Another Federal Court Says Compelled Decryption Doesn't Raise Fifth Amendment Issues”

Subscribe: RSS Leave a comment
48 Comments
Nathan F (profile) says:

Re: Re:

That would result in ‘spoliation of evidence’ and the courts have almost always held that harshly against whoever did the spoiling. Also might not actually be all the effective cause even though the drive is encrypted they can still make a copy of it, so just cause you nuked that copy doesn’t mean they don’t have another.

Anonymous Coward says:

Re: Re: Re:

It’s possible to make the reading of a device without the proper password destroy the data. So you wouldn’t have to worry about copies. Combine that with encrypted data in the free space and you have plausible deniability.

So if you type in the duress password, a partition that has innocous data is decrypted and the key to the rest of the data is wiped. No way to prove that data ever existed in the first place.

All of this has been done before. It’s just never been popular enough for Mass acceptance.

Anonymous Coward says:

Re: Re: Re: Re:

Its lack of popularity might have something to do with the risks of wondering whether the nuke password works when drunk. Also, setting such a password and remembering it while not using it is a problem all of its own.

Also, can you make and keep secure a backup?

Anonymous Coward says:

Re: Re: Re:

A much better option is a ‘rubber hose’ type encryption system. Basically it works by filling the drive with random data. This makes the encrypted portions indeterminate. Next, two encrypted volumes are created. This allows you to unlock a dummy volume, with no way to prove the existence of the second volume.

https://en.wikipedia.org/wiki/Rubberhose_(file_system)

Anonymous Coward says:

Once Spencer decrypts the devices, however, the government may not make direct use of the evidence that he has done so.

So what would happen if the government presents the contents of the device as evidence in court and the defendant testifies that it was from an encrypted device he did not have access to?

Anonymous Coward says:

courts wrongs

…the courts are gutiing the 5th Amendment just like they did with the 4th and 2nd Amendments.

That’s been the clear trend for over a century. Federal judges “interpret” Constitutional text as expanding government power, while steadily diminishing citizen rights against government power.

Why do you think this is happening?

DannyB (profile) says:

Only a s SMALL constitutional problem

A federal judge in North Carolina has decided compelling decryption of devices is only a small Fifth Amendment problem — one that can be overlooked

With this precedent the government can engage in actions that are only a SMALL 1st amendment problem, a SMALL 2nd amendment problem, a SMALL 4th, and 14th amendment problem.

In fact, the government can do things that are a SMALL problem with anything in the entire constitution. Or all of our written laws and court precedents. After all, it’s only a SMALL problem.

In fact, the president dissolving congress because it is inconvenient would only be a SMALL violation of the how our system of government works. While he’s at it, just dissolve the Supreme Court as well.

And for efficiency’s sake, put an end to these pesky elections every four years. It’s only a SMALL problem.

Anonymous Coward says:

Re: Only a s SMALL constitutional problem

And why even waste time an money on a trial when we already know the accused is guilty? Skipping the technicality of an "unnecessary" trial would only be a small problem that shouldn’t bother anybody except the guilty hoping to postpone justice. Of course, the innocent would still be entitled to full trials, so there would be no harm. Who could object to that?

SirWired (profile) says:

Re: This is a reasonable interpretation of the 5th's text

The 5th amendment says that you cannot be compelled to be a witness against yourself. That is, you cannot be forced to utter a single word that will ever be heard in a courtroom. If they are not allowed to use your possession of the password as evidence (so they must authenticate your ownership during a trial via other means), what part of the 5th do you suppose is being violated?

The founding fathers certainly could have wrote that you cannot be compelled to assist in an investigation against yourself, but they limited the text to prohibitions against actually producing testimony.

Anonymous Coward says:

Re: Re: This is a reasonable interpretation of the 5th's text

… they limited the text to prohibitions against actually producing testimony.

In the Commonwealth of Virginia, Section 8 of the Bill of Rights reads:

[I}n criminal prosecutions a man . . . . shall not . . . be compelled in any criminal proceeding to give evidence against himself

That provision of the Commonwealth’s constitution traces back to the Virginia Declaration of Rights. Drafted by George Mason, it was adopted unanimously June 12, 1776.

In the Commonwealth of Massachusetts, First Part, Article XII reads:

No subject shall be . . . compelled to accuse, or furnish evidence against himself.

The Massachusetts Constitution was adopted in 1780.

The provisions, as well as others, use the language of “evidence”.

Anonymous Coward says:

Re: Re: This is a reasonable interpretation of the 5th's text

The First is also held to state not only are you allowed freedom to speak and cannot be curtailed by the federal gov, you can’t be compelled TO speak as silence is also held as a right, then codified for criminal cases in the 5th.

If there were a physical lock with dead tree evidence, that’s one thing. Even if the key was lost you could still gain entry, and a lost key would not prompt contempt of court. You just get a lock smith.

Likewise these devices aren’t actually unbreakable, the technical means of gaining entry to them without passwords does happen to exist. If there is information on those devices of criminal enterprise it’s up to the government to get to it, not the defendant to enable their attack on his defense. That’s the very basis of an adversarial court system. The defendant is not required to help the criminal investigation in any way, nor is he allowed to hinder it. It’s well established law that remaining silent, or sitting on one’s hands in this case, is not legally hindering an investigation when you’re a named defendant.

Uriel-238 (profile) says:

Re: Re: Re: "A physical lock and dead tree evidence"

There aren’t many boxes that are trapped, but they exist. Upon detection of illicit entry, they cook their contents in a magnesium fire or otherwise rapidly destroy it.

Could a court of law demand a combination to such a vault?

If that is protected by the fifth amendment then why not data under strong crypto?

DannyB (profile) says:

Re: Re: This is a reasonable interpretation of the 5th's text

The 5th amendment says that you cannot be compelled to be a witness against yourself.

Being tortured is not the same as being compelled. You still have a choice. You can always simply resist and refuse to testify against yourself to avoid conviction and punishment.

That One Guy (profile) says:

Re: Re: Re: This is a reasonable interpretation of the 5th's text

Being tortured is not the same as being compelled. You still have a choice. You can always simply resist and refuse to testify against yourself to avoid conviction and punishment.

The screwed up thing is that is basically the exact argument as to why ‘contempt of court’ charges having no upper limit are perfectly acceptable.

I’m not keeping them in jail indefinitely, that’s all on them. They can end their incarceration at any time, they just need to hand over the password, so really it’s their fault they’re in jail.’

discordian_eris (profile) says:

From the All Writs Act

(a) The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.

See, there’s the entire problem. This obviously follows the current usages and principles of law. Maybe not in the US, but the act never says it has to follow American law.

Anonymous Coward says:

Re: Re: From the All Writs Act

We sometimes reference British law when an issue is old and well established.

Established in Camera Stellata.

The historical abuses of the Star Chamber are considered a primary motivating force behind the protections against compelled self-incrimination embodied in the Fifth Amendment to the United States Constitution.

(Citation omitted.)

Anonymous Coward says:

dystopian 'justice'

Does the Fifth Amendment even apply to accused pedophiles and terrorists? Recent history would suggest it probably does not, at least in the opinion of those whose opinions matter.

Here’s a possible ‘solution’ to the fifth amendment problem … when such people are arrested, make sure its a violent, scary, and painful arrest. If it’s perfectly OK for cops to be screaming “do you have any weapons” as they have the suspect in a very painful hold –and no surprise, getting their question answered 100% of the time — then what if they replaced the ‘weapon’ question with a ‘password’ question at that moment?

Even if the painfully-extracted incriminating evidence can’t be used in court, known pedophiles tend to have short lives in jail anyway, so probably no need for a trial.

christenson says:

Thoughtcrime!

That’s right, I drew an illegal picture (say, child pornography made with photoshop and Getty Images material) on my computer, did not share it, encrypted it….

and now I must decrypt my data? That amounts to being prosecuted for thoughtcrime….

OK, yeah, the guy did transmit something. How about considering what’s encrypted privileged, like they do for lawywers, and appointing a special master to sort out what was privileged and what wasn’t, and to search with particularity? No, “my encrypted drive” is a very general place; it’s huge, containing an entire library or six!

Speaking of rubber hoses…don’t forget, this computer was virused…it runs stuxnet if you boot off my encrypted drive!

Anonymous Coward says:

Re: Thoughtcrime!

That amounts to being prosecuted for thoughtcrime….

Treason Act 1351 (25 Edw 3 St 5 c 2):

When a Man doth compass or imagine the Death of our Lord the King . . .

Blackstone:

LET us next see, what is a compassing or imagining the death of the king, etc. These are synonymous terms; the word compass signifying the purpose or design of the mind or will, and not, as in common speech, the carrying such design to effect. . . .

HOW far mere words, spoken by an individual, and not relative to any treasonable act or design then in agitation, shall amount to treason, has been formerly matter of doubt. We have two instances, in the reign of Edward the fourth, of persons executed for treasonable words . . .

If the words be set down in writing, it argues more deliberate intention; and it has been held that writing is an overt act of treason; for scribere est agere [writing is action]. But even in this case the bare words are not the treason, but the deliberate act of writing them. And such writing, though unpublished, has in some arbitrary reigns convicted its author of treason: particularly in the cases of . . .

That One Guy (profile) says:

The 'Fifth amendment violation test'

As always it seems it would be trivial to call the ‘it’s not a violation/large violation’ bluff by asking for immunity.

If a person isn’t being asked to provide something that will be used against them then the fifth doesn’t apply, but at the same time you cannot use anything that results in their actions/word against them, so granting immunity wouldn’t in any way impact the case.

On the other hand, if you do plan on using evidence gained from compelling decryption/handing over the password against the accused then the fifth absolutely does(or should) apply, and in that case granting immunity would be counter-productive to the entire point of demanding a password/decryption, which is why they’d never grant it.

If a prosecutor or judge wants to claim that compelling decryption isn’t a fifth amendment violation then great, give the accused total immunity for anything that results from it. Anything less and they might as well flat out admit that it is a violation, and they just don’t care.

Anonymous Coward says:

Yet again, all Techdirt has is a hope to avoid punishment.

EVERY day, it’s wailing that some dodge isn’t effective to let criminals off the hook.

First comment actually proposes committing second crime to cover up the first!

It’s the 21st century, kids. An encrypted HDD is just like a locked drawer. You are not testifying by opening a drawer in response to search warrant. The lock does not guarantee that you can escape consequences of criminal behavior. Courts will not permit criminals to escape by way of high-tech. That’s not justice, it’s the opposite.

bob says:

Re: Yet again, logic escapes the troll poster.

Government is free to hire a lock Smith to open the locked drawer. It is also free to break the encryption on a locked hard drive. Just because the lock is harder to break doesn’t mean the government can abuse your 5th amdedment rights by holding you in contempt until you provide a “key”.

Anonymous Coward says:

Re: Yet again, all Techdirt has is a hope to avoid punishment.

A) knows but refuses to provide password
B) knew but now cannot remember the password
C) never had knowledge of the password

Locking someone up for C would be absurd.
Locking someone up for B is equally absurd.

How can you prove that someone is A and not B or C?

Last I checked we did not have brain scanners that can prove someone knows something. If we did have such scanners we would just scan his head and extract the password anyway.

Uriel-238 (profile) says:

Re: Letting criminals off the hook.

Do we need another reminder that we are all felons, but for selective prosecution? Even Anonymous Coward commits an average of three felonies a day, and it is only because an official doesn’t have need to feed him into the legal system mill, or remove him from his current residence that he is free (so far).

We are all one ambitious prosecutor away from felony conviction and long-term incarceration.

Food for thought before we look at others and decide that they are criminal or otherwise bad people and should be denied their life or liberty.

Anonymous Coward says:

In re Search of a Residence in Aptos, Calif. 95003

From the opinion

Ryan Michael Spencer moves for relief from an order by a magistrate judge compelling him to decrypt several electronic devices. In re Search of a Residence in Aptos, Calif. 95003, No. 17-mj-70656-JSC, 2018 WL 1400401 (N.D. Cal. March 20, 2018).

United States Magistrate Judge Jacqueline Scott Corley’s order:

In re Search of a Residence in Aptos, California 95003 (N.D. Cal. Mar. 20, 2018) “Order Granting Application Under The All Writs Act Compelling Michael Spencer To Aid In The Execution Of A Search Warrant”

 

Uriel-238 (profile) says:

Re: In re Search of a Residence in Aptos, Calif. 95003

So what I’m seeing here, they have ground enough to convict. If they do, they don’t need to look the locked data.

If they don’t, it falls into the threshold where coercion (including by contempt charges) is a breach of Fifth amendment protections.

My guess is they have enough to convict but want to tack on more charges or more years. That again puts them in the position of breaching fifth amendment provisions if they coerce.

Rather it just sounds like our officers of the legal system are so disgusted with the defendant that they’re willing to disregard rules in order to maximize a sentence. That’s not justice, that’s revenge. And it is a greater crime for the state to engage in reprisals of vengeance than it is for a single person to escape justice, even for heinous crimes.

Anonymous Coward says:

Re: Re: In re Search of a Residence in Aptos, Calif. 95003

So what I’m seeing here, they have ground enough to convict.

Just a bit ago, I was looking at The Massachusetts Body of Liberties from 1641.

45. No man shall be forced by Torture to confesse any Crime against himselfe nor any other unlesse it be in some Capitall case, where he is first fullie convicted by cleare and suffitient evidence to be guilty, After which if the cause be of that nature, That it is very apparent there be other conspiratours, or confederates with him, Then he may be tortured, yet not with such Tortures as be Barbarous and inhumane.

Setting aside the plain inapplicability of an obsolete 17th century Massachusetts Bay Colony document to a 21st century California case, and applying this standard, would you say that the evidence here is so very “cleare and suffitient” that the defendant perhaps might be pressed until he yields up the passwords for the devices?

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...