Another Federal Court Says Compelled Decryption Doesn't Raise Fifth Amendment Issues
from the not-a-blanket-statement,-but-more-often-than-not dept
Another federal court is wrestling with compelled decryption and it appears the Fifth Amendment will be no better off by the time it’s all over. A federal judge in North Carolina has decided compelling decryption of devices is only a small Fifth Amendment problem — one that can be overlooked if the government already possesses certain knowledge. [h/t Orin Kerr]
The defendant facing child porn charges requested relief from a magistrate’s order to compel decryption. The government isn’t asking Ryan Spencer to turn over his passwords. But it wants exactly the same result: decrypted devices. The government’s All Writs Order demands Spencer unlock the devices so law enforcement can search their contents. As the court notes in the denial of Spencer’s request, the Fifth Amendment doesn’t come into play unless the act of production — in this case, turning over unlocked devices — is both “testimonial” and “incriminating.”
Spencer argued both acts are the same. The government may not ask him directly for his passwords, but a demand he produce unlocked devices accomplishes the same ends. As the court notes, the argument holds “superficial appeal.” It actually holds a bit more than that. A previous dissenting opinion on the same topic said the government cannot compel safe combinations by “either word or deed.”
This opinion [PDF], however, goes the other way. Judge Breyer likes the wall safe analogy, but arrives at a different conclusion than Justice Stevens did in an earlier dissent. The court finds drawing a Fifth Amendment line at password protection would produce a dichotomy it’s not willing to accommodate.
[A] rule that the government can never compel decryption of a password-protected device would lead to absurd results. Whether a defendant would be required to produce a decrypted drive would hinge on whether he protected that drive using a fingerprint key or a password composed of symbols.
The refusal to craft this bright line ultimately makes little difference. The line already exists. Almost no courts have said the compelled production of fingerprints is a Fifth Amendment violation. Producing passwords, however, is an issue that’s far from settled. In the cases that have gone the government’s way, the key appears to be what the government already knows: the “foregone conclusions.” The same goes here.
The court admits producing unlocked devices strengthens the government’s case even before any searches take place.
So: the government’s request for the decrypted devices requires an act of production. Nevertheless, this act may represent incriminating testimony within the meaning of the Fifth Amendment because it would amount to a representation that Spencer has the ability to decrypt the devices. See Fisher, 425 U.S. at 410. Such a statement would potentially be incriminating because having that ability makes it more likely that Spencer encrypted the devices, which in turn makes it more likely that he himself put the sought-after material on the devices.
But that only deals with the incrimination side. Is it testimonial? The court thinks it isn’t. Or at least, it believes whatever testimonial value it adds is almost nonexistent. All the government needs to show is that the defendant has the ability to unlock the devices.
Turning over the decrypted devices would not be tantamount to an admission that specific files, or any files for that matter, are stored on the devices, because the government has not asked for any specific files. Accordingly, the government need only show it is a foregone conclusion that Spencer has the ability to decrypt the devices.
It’s a low bar but one that’s sometimes difficult to reach if the government can’t clearly link the defendant to the locked devices obtained during the search of a residence or business. As the court notes, it requires more than a reasonable assumption that files the government seeks might reside on the locked devices.
But it is nonsensical to ask whether the government has established with “reasonable particularity” that the defendant is able to decrypt a device. While physical evidence may be described with more or less specificity with respect to both appearance and location, a defendant’s ability to decrypt is not subject to the same sliding scale. He is either able to do so, or he is not. Accordingly, the reasonable particularity standard cannot apply to a defendant’s ability to decrypt a device.
The government needs far more if it seeks to compel decryption.
The appropriate standard is instead clear and convincing evidence. This places a high burden on the government to demonstrate that the defendant’s ability to decrypt the device at issue is a foregone conclusion. But a high burden is appropriate given that the “foregone conclusion” rule is an exception to the Fifth Amendment’s otherwise jealous protection of the privilege against giving self-incriminating testimony.
And the court finds the government does possess clear, convincing evidence.
All three devices were found in Spencer’s residence. Spencer has conceded that he owns the phone and laptop, and has provided the login passwords to both. Moreover, he has conceded that he purchased and encrypted an external hard drive matching the description of the one found by the government. This is sufficient for the government to meet its evidentiary burden. The government may therefore compel Spencer to decrypt the devices.
There is one caveat, however.
Once Spencer decrypts the devices, however, the government may not make direct use of the evidence that he has done so.
As the court points out, if the government’s foregone conclusion is the correct conclusion, additional evidence linking Spencer to the locked devices will be unnecessary. The government should have no use for the testimony inherent in the act — the concession that Spencer owned and controlled the now-unlocked devices, making him ultimately criminally responsible for any evidence located in them.
In terms of compelled production, passwords continue to beat fingerprints for device security, but only barely.
Filed Under: 5th amendment, all writs act, decryption, due process, encryption, north carolina, passwords, ryan spencer
Comments on “Another Federal Court Says Compelled Decryption Doesn't Raise Fifth Amendment Issues”
We need to implement “panic passwords”. Or even fingerprints. If you input a panic ‘unlocking’ method the device will automatically brick itself while frying the storage because full wipe would take too long.
Re: Re:
That would result in ‘spoliation of evidence’ and the courts have almost always held that harshly against whoever did the spoiling. Also might not actually be all the effective cause even though the drive is encrypted they can still make a copy of it, so just cause you nuked that copy doesn’t mean they don’t have another.
Re: Re: Re:
It’s possible to make the reading of a device without the proper password destroy the data. So you wouldn’t have to worry about copies. Combine that with encrypted data in the free space and you have plausible deniability.
So if you type in the duress password, a partition that has innocous data is decrypted and the key to the rest of the data is wiped. No way to prove that data ever existed in the first place.
All of this has been done before. It’s just never been popular enough for Mass acceptance.
Re: Re: Re: Re:
Its lack of popularity might have something to do with the risks of wondering whether the nuke password works when drunk. Also, setting such a password and remembering it while not using it is a problem all of its own.
Also, can you make and keep secure a backup?
Re: Re: Re:2 Re:
If what you are encrypting is so secret or special that you want/need to have a nuke option like this, you don’t make backups.
Re: Re: Re:
A much better option is a ‘rubber hose’ type encryption system. Basically it works by filling the drive with random data. This makes the encrypted portions indeterminate. Next, two encrypted volumes are created. This allows you to unlock a dummy volume, with no way to prove the existence of the second volume.
https://en.wikipedia.org/wiki/Rubberhose_(file_system)
Re: Re: Re: Re:
Unless they intercepted some transfer to the machine, and therefore know at least one file that should be on the volume.
Re: Re: Plausible Deniability
As we’ve been brushing against this issue for a while, the technology to make multiple accounts, and to disguise data as unused memory has long been established and available as a feature on some data-encryption utilities.
So what would happen if the government presents the contents of the device as evidence in court and the defendant testifies that it was from an encrypted device he did not have access to?
Re: Re:
Perjury charges.
Re: Re: Re:
How could he be charged with perjury if they have no usable evidence that he can decrypt the device?
If the prohibition on using the evidence is in place to protect the defendant’s 5th amendment rights then it would be applicable in all cases against him.
courts wrongs
…the courts are gutiing the 5th Amendment just like they did with the 4th and 2nd Amendments.
That’s been the clear trend for over a century. Federal judges “interpret” Constitutional text as expanding government power, while steadily diminishing citizen rights against government power.
Why do you think this is happening?
Re: courts wrongs
Judge Charles Breyer is a servant of the devil?
Only a s SMALL constitutional problem
With this precedent the government can engage in actions that are only a SMALL 1st amendment problem, a SMALL 2nd amendment problem, a SMALL 4th, and 14th amendment problem.
In fact, the government can do things that are a SMALL problem with anything in the entire constitution. Or all of our written laws and court precedents. After all, it’s only a SMALL problem.
In fact, the president dissolving congress because it is inconvenient would only be a SMALL violation of the how our system of government works. While he’s at it, just dissolve the Supreme Court as well.
And for efficiency’s sake, put an end to these pesky elections every four years. It’s only a SMALL problem.
Re: Only a s SMALL constitutional problem
And why even waste time an money on a trial when we already know the accused is guilty? Skipping the technicality of an "unnecessary" trial would only be a small problem that shouldn’t bother anybody except the guilty hoping to postpone justice. Of course, the innocent would still be entitled to full trials, so there would be no harm. Who could object to that?
Re: Re: Only a s SMALL constitutional problem
They’re already saying guilt is a “foregone conclusion”.
Re: Re: Re: Guilt is a "foregone conclusion"
So we’re back to the 14-year contempt of court situation. If establishing guilt is a forgone conclusion, they can make their case adequately with the evidence they already have.
If they cannot, then it ceases to be a forgone conclusion.
“We already know you’re guilty, there’s no Fifth Amendment issue here.”
Our founding fathers are spinning in their graves so fast they’re bound to be slowing Earth’s rotation.
Re: Re:
The earth’s rotation IS slowing. 3 or 4 billion years ago, an earth day was only about 8 hours.
Re: Re: Re:
Damn cats.
Re: This is a reasonable interpretation of the 5th's text
The 5th amendment says that you cannot be compelled to be a witness against yourself. That is, you cannot be forced to utter a single word that will ever be heard in a courtroom. If they are not allowed to use your possession of the password as evidence (so they must authenticate your ownership during a trial via other means), what part of the 5th do you suppose is being violated?
The founding fathers certainly could have wrote that you cannot be compelled to assist in an investigation against yourself, but they limited the text to prohibitions against actually producing testimony.
Re: Re: This is a reasonable interpretation of the 5th's text
In the Commonwealth of Virginia, Section 8 of the Bill of Rights reads:
That provision of the Commonwealth’s constitution traces back to the Virginia Declaration of Rights. Drafted by George Mason, it was adopted unanimously June 12, 1776.
In the Commonwealth of Massachusetts, First Part, Article XII reads:
The Massachusetts Constitution was adopted in 1780.
The provisions, as well as others, use the language of “evidence”.
Re: Re: This is a reasonable interpretation of the 5th's text
The First is also held to state not only are you allowed freedom to speak and cannot be curtailed by the federal gov, you can’t be compelled TO speak as silence is also held as a right, then codified for criminal cases in the 5th.
If there were a physical lock with dead tree evidence, that’s one thing. Even if the key was lost you could still gain entry, and a lost key would not prompt contempt of court. You just get a lock smith.
Likewise these devices aren’t actually unbreakable, the technical means of gaining entry to them without passwords does happen to exist. If there is information on those devices of criminal enterprise it’s up to the government to get to it, not the defendant to enable their attack on his defense. That’s the very basis of an adversarial court system. The defendant is not required to help the criminal investigation in any way, nor is he allowed to hinder it. It’s well established law that remaining silent, or sitting on one’s hands in this case, is not legally hindering an investigation when you’re a named defendant.
Re: Re: Re: "A physical lock and dead tree evidence"
There aren’t many boxes that are trapped, but they exist. Upon detection of illicit entry, they cook their contents in a magnesium fire or otherwise rapidly destroy it.
Could a court of law demand a combination to such a vault?
If that is protected by the fifth amendment then why not data under strong crypto?
Re: Re: This is a reasonable interpretation of the 5th's text
Being tortured is not the same as being compelled. You still have a choice. You can always simply resist and refuse to testify against yourself to avoid conviction and punishment.
Re: Re: Re: This is a reasonable interpretation of the 5th's text
Being tortured is not the same as being compelled. You still have a choice. You can always simply resist and refuse to testify against yourself to avoid conviction and punishment.
The screwed up thing is that is basically the exact argument as to why ‘contempt of court’ charges having no upper limit are perfectly acceptable.
‘I’m not keeping them in jail indefinitely, that’s all on them. They can end their incarceration at any time, they just need to hand over the password, so really it’s their fault they’re in jail.’
Re: Re: Re:2 "All on them"
Yeah, that’s just a cheap way to lock them in jail indefinitely: make their release contingent on something they’re not willing to do or incapable of doing.
From the All Writs Act
(a) The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.
See, there’s the entire problem. This obviously follows the current usages and principles of law. Maybe not in the US, but the act never says it has to follow American law.
Re: From the All Writs Act
We sometimes reference British law when an issue is old and well established.
Re: Re: From the All Writs Act
Established in Camera Stellata.
(Citation omitted.)
Bet it would if it were this judge whose device was wanted to be derypted!
dystopian 'justice'
Does the Fifth Amendment even apply to accused pedophiles and terrorists? Recent history would suggest it probably does not, at least in the opinion of those whose opinions matter.
Here’s a possible ‘solution’ to the fifth amendment problem … when such people are arrested, make sure its a violent, scary, and painful arrest. If it’s perfectly OK for cops to be screaming “do you have any weapons” as they have the suspect in a very painful hold –and no surprise, getting their question answered 100% of the time — then what if they replaced the ‘weapon’ question with a ‘password’ question at that moment?
Even if the painfully-extracted incriminating evidence can’t be used in court, known pedophiles tend to have short lives in jail anyway, so probably no need for a trial.
Scooter Libby defense?
When asked to produce a password, just use the Scooter Libby defense and say, “I do not recall.”
Re: Scooter Libby defense?
That statement being truthful is what is the most scary. If you can be compelled to provide your password, and held in contempt indefinitely if you don’t. Then, seriously, what the fuck happens to an innocent person who actually doesn’t remember their password?!
Re: Scooter Libby defense?
Except it didn’t really work… he was convicted. The real Scooter Libby defense is to be friends with some presidents, who can commute the sentence and later pardon you.
Thoughtcrime!
That’s right, I drew an illegal picture (say, child pornography made with photoshop and Getty Images material) on my computer, did not share it, encrypted it….
and now I must decrypt my data? That amounts to being prosecuted for thoughtcrime….
OK, yeah, the guy did transmit something. How about considering what’s encrypted privileged, like they do for lawywers, and appointing a special master to sort out what was privileged and what wasn’t, and to search with particularity? No, “my encrypted drive” is a very general place; it’s huge, containing an entire library or six!
Speaking of rubber hoses…don’t forget, this computer was virused…it runs stuxnet if you boot off my encrypted drive!
Re: Thoughtcrime!
Treason Act 1351 (25 Edw 3 St 5 c 2):
Blackstone:
Do Mini Clones Dream of Electric Porn Stars
I guess the solution is that we all need to have little Michael Cohens in our pockets to carry out our digital wishes and then later plead the 5th if necessary.
The 'Fifth amendment violation test'
As always it seems it would be trivial to call the ‘it’s not a violation/large violation’ bluff by asking for immunity.
If a person isn’t being asked to provide something that will be used against them then the fifth doesn’t apply, but at the same time you cannot use anything that results in their actions/word against them, so granting immunity wouldn’t in any way impact the case.
On the other hand, if you do plan on using evidence gained from compelling decryption/handing over the password against the accused then the fifth absolutely does(or should) apply, and in that case granting immunity would be counter-productive to the entire point of demanding a password/decryption, which is why they’d never grant it.
If a prosecutor or judge wants to claim that compelling decryption isn’t a fifth amendment violation then great, give the accused total immunity for anything that results from it. Anything less and they might as well flat out admit that it is a violation, and they just don’t care.
Yet again, all Techdirt has is a hope to avoid punishment.
EVERY day, it’s wailing that some dodge isn’t effective to let criminals off the hook.
First comment actually proposes committing second crime to cover up the first!
It’s the 21st century, kids. An encrypted HDD is just like a locked drawer. You are not testifying by opening a drawer in response to search warrant. The lock does not guarantee that you can escape consequences of criminal behavior. Courts will not permit criminals to escape by way of high-tech. That’s not justice, it’s the opposite.
Re: Re:
This coming from the guy who uses TOR just to troll a website…
Re: Yet again, logic escapes the troll poster.
Government is free to hire a lock Smith to open the locked drawer. It is also free to break the encryption on a locked hard drive. Just because the lock is harder to break doesn’t mean the government can abuse your 5th amdedment rights by holding you in contempt until you provide a “key”.
Re: Yet again, all Techdirt has is a hope to avoid punishment.
A) knows but refuses to provide password
B) knew but now cannot remember the password
C) never had knowledge of the password
Locking someone up for C would be absurd.
Locking someone up for B is equally absurd.
How can you prove that someone is A and not B or C?
Last I checked we did not have brain scanners that can prove someone knows something. If we did have such scanners we would just scan his head and extract the password anyway.
Re: Letting criminals off the hook.
Do we need another reminder that we are all felons, but for selective prosecution? Even Anonymous Coward commits an average of three felonies a day, and it is only because an official doesn’t have need to feed him into the legal system mill, or remove him from his current residence that he is free (so far).
We are all one ambitious prosecutor away from felony conviction and long-term incarceration.
Food for thought before we look at others and decide that they are criminal or otherwise bad people and should be denied their life or liberty.
In re Search of a Residence in Aptos, Calif. 95003
From the opinion—
United States Magistrate Judge Jacqueline Scott Corley’s order:
• In re Search of a Residence in Aptos, California 95003 (N.D. Cal. Mar. 20, 2018) “Order Granting Application Under The All Writs Act Compelling Michael Spencer To Aid In The Execution Of A Search Warrant”
Re: In re Search of a Residence in Aptos, Calif. 95003
So what I’m seeing here, they have ground enough to convict. If they do, they don’t need to look the locked data.
If they don’t, it falls into the threshold where coercion (including by contempt charges) is a breach of Fifth amendment protections.
My guess is they have enough to convict but want to tack on more charges or more years. That again puts them in the position of breaching fifth amendment provisions if they coerce.
Rather it just sounds like our officers of the legal system are so disgusted with the defendant that they’re willing to disregard rules in order to maximize a sentence. That’s not justice, that’s revenge. And it is a greater crime for the state to engage in reprisals of vengeance than it is for a single person to escape justice, even for heinous crimes.
Re: Re: In re Search of a Residence in Aptos, Calif. 95003
Just a bit ago, I was looking at The Massachusetts Body of Liberties from 1641.
Setting aside the plain inapplicability of an obsolete 17th century Massachusetts Bay Colony document to a 21st century California case, and applying this standard, would you say that the evidence here is so very “cleare and suffitient” that the defendant perhaps might be pressed until he yields up the passwords for the devices?
… until it bites back some “important” politician.