Pennsylvania Supreme Court Says Compelled Password Production Violates The Fifth Amendment

from the so-it's-back-to-beating-arrestees-with-phonebooks-I-guess dept

The Fifth Amendment prevents compelled production of passwords, the top court in Pennsylvania has ruled. (h/t ACLU) It joins a handful of other state courts finding passwords to be testimonial, including Indiana, Illinois, and Florida. Unfortunately, there's no SCOTUS opinion uniting the states, so Fifth Amendment coverage remains spotty.

Securing rights remains the job of unsympathetic defendants. The state's child porn prosecution is likely to stall out with its main supply of potential evidence inaccessible. Despite the defendant basically admitting the computer law enforcement seized contained other child porn images ("we both know what's on there") and that he alone used the computer and could decrypt it, the court says [PDF] the state's foregone conclusion assertions aren't enough to render the Fifth Amendment useless.

That was the state's argument: the seized computer likely has child porn on it, based on the defendant's admissions and the investigative work that tracked porn downloads/uploads to his address. The state's Superior Court found the government's arguments persuasive, but only by drastically narrowing the scope of its focus.

Applying the foregone conclusion exception, the Superior Court, contrary to the trial court, focused on the password itself, and reasoned that the Commonwealth established the computer could not be opened without the password, that the computer belonged to Appellant and the password was in his possession, and that this information was “self-authenticating” ― i.e., if the computer was accessible upon entry of the password, the password was authentic.

While the government would like the court to believe that the compelled production of passwords is like demanding a key to a locked box, the court disagrees. There is Supreme Court precedent that guides this analysis, even if the Supreme Court has yet to rule on compelled password production.

First, the Supreme Court has made, and continues to make, a distinction between physical production and testimonial production. As made clear by the Court, where the government compels a physical act, such production is not testimonial, and the privilege is not recognized. See Holt; Doe II. Second, an act of production, however, may be testimonial when the act expresses some explicit or implicit statement of fact that certain materials exist, are in the defendant’s custody or control, or are authentic. See Fisher; Hubbell. The crux of whether an act of production is testimonial is whether the government compels the defendant to use the “contents of his own mind” in explicitly or implicitly communicating a fact.

Fifth Amendment protections may be limited in cases like these, but they're not nonexistent. The government has an evidentiary burden to meet before it can demand production of passwords.

[U]nder a foregone conclusion analysis, the Supreme Court has reasoned that an act of production does not render communication testimonial where the facts conveyed already are known to the government such that the evidence sought “adds little or nothing to the sum total of the Government’s information.” Fisher, 425 U.S. at 411. Thus, what is otherwise testimonial in nature is rendered nontestimonial, as the facts sought to be compelled are a foregone conclusion. As described above, for the exception to apply, the government must establish its knowledge of: (1) the existence of the evidence demanded; (2) the possession or control of the evidence by the defendant; and (3) the authenticity of the evidence.

The state simply doesn't have it here. It has a computer that, if unlocked by a compelled password, would become "self-authenticating." The defendant's assertions about his control of the computer isn't enough to clear these hurdles. Most of the state's "foregone conclusion" about available evidence (with the exception of a single, verified child porn image transferred from the defendant's IP address to investigators during the investigation) is nothing more than a strong hunch. That's not enough.

In sum, because the Commonwealth has failed to establish that its search is limited to the single previously identified file, and has not asserted that it is a foregone conclusion as to the existence of additional files that may be on the computer, which would be accessible to the Commonwealth upon Appellant’s compelled disclosure of the password, we find the Commonwealth has not satisfied the foregone conclusion exception.

This ruling does not go so far as to cover compelled production of biometric features, however.

Because we are dealing with a motion to require an individual to recall and disclose a memorized password to a computer, in essence, revealing the contents of one’s own mind, we need not address the related, but distinct, area involving biometric features like fingerprints, thumbprints, iris scanning, and facial recognition, or whether the foregone conclusion rationale would be appropriate in these circumstances.

But the court hints it would likely find in the state's favor if the decryption key was a fingerprint.

[N]ot only are these communications not before our Court, it is the United States Supreme Court that long ago has created the dichotomy between physical and mental communication.

Also of note is this: supporting briefs filed on behalf of the government by other state governments appear to contain threats of anti-encryption legislation if courts continue to allow the Constitution to protect defendants from self-incrimination.

In a joint amicus brief in support of the Commonwealth, various states provide an interesting history of modern encryption, press the troubling consequences of Appellant’s position ― including the altering of the balance of power, rendering law enforcement incapable of accessing large amounts of relevant evidence ― and warn that adopting Appellant’s position could result in less privacy, not more, in the form of draconian anti-privacy legislation.

There's nothing quite like multiple state governments claiming they'll strip away privacy protections if they can't ignore Constitutional protections. When it comes to weighing the interests of all involved stakeholders, it appears the government's interests weigh the most.

Filed Under: 5th amendment, compelled speech, passwords, pennsylvania, self-incrimination


Reader Comments

Subscribe: RSS

View by: Time | Thread


  • icon
    That One Guy (profile), 26 Nov 2019 @ 1:29am

    A telling, and worrying, argument

    In a joint amicus brief in support of the Commonwealth, various states provide an interesting history of modern encryption, press the troubling consequences of Appellant’s position ― including the altering of the balance of power, rendering law enforcement incapable of accessing large amounts of relevant evidence ― and warn that adopting Appellant’s position could result in less privacy, not more, in the form of draconian anti-privacy legislation.

    'If you don't let us violate constitutional rights we'll pass unconstitutional laws in order to let us do so' is really not the sort of thing you want multiple states arguing, as that shows a mindset that considers constitutional protections and privacy of the public not limits to be respected and something to uphold respectively, but obstacles to be worked around and/or undermined.

    Law enforcement has never had access to all of the evidence they've wanted, and the fact that there are more ways for people to protect their privacy, even if that includes really terrible people, is not grounds to start giving them that which they have never had and never will have, especially when it will come at such a great cost to the general public.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 26 Nov 2019 @ 3:39am

      Re: A telling, and worrying, argument

      Law enforcement has never had access to all of the evidence they've wanted, and the fact that there are more ways for people to protect their privacy, even if that includes really terrible people, is not grounds to start giving them that which they have never had and never will have, especially when it will come at such a great cost to the general public.

      As opposed to protecting the privacy of horrible criminals at NO cost to the public?

      reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 26 Nov 2019 @ 4:44am

        Re: Re: A telling, and worrying, argument

        Can you guarantee that a future government will not persecute you because of your beliefs and opinions? While strong privacy protections may allow a few criminals to escape justice, it protects even more people from a tyrannical government, and so is a price worth paying.

        reply to this | link to this | view in chronology ]

      • icon
        Stephen T. Stone (profile), 26 Nov 2019 @ 5:31am

        As opposed to protecting the privacy of horrible criminals at NO cost to the public?

        Everyone who offers a legal product or service with a generally beneficial use to society runs the risk of having it used by criminals. That doesn’t seem to stop car makers, gun manufacturers, Internet access providers, and super PACs.

        reply to this | link to this | view in chronology ]

      • icon
        That One Guy (profile), 26 Nov 2019 @ 5:56am

        Protecting the guilty to protect the innocent

        The exact same legal rights and protections that shield the absolute worst of the worst from government intrusion and overreach are the ones that protect you and everyone else from the same, such that eroding their rights and protections erodes yours right alongside them.

        If they don't have legal protections then neither do you, as the only thing preventing you from suffering the same fate of 'provide us access to everything we want to see or else' at that point is the whim of a prosecutor, and all your protestations of innocence and how it's a violation of your rights and privacy will be for naught, because after all 'the guilty don't have rights', and having been accused... well, you might as well be guilty.

        reply to this | link to this | view in chronology ]

        • icon
          Stephen T. Stone (profile), 26 Nov 2019 @ 9:20am

          The exact same legal rights and protections that shield the absolute worst of the worst from government intrusion and overreach are the ones that protect you and everyone else from the same, such that eroding their rights and protections erodes yours right alongside them.

          Hell, this logic is basically the prime directive of the First Amendment: The worst speech must remain protected from government interference so all speech can remain protected.

          reply to this | link to this | view in chronology ]

        • identicon
          Joe, 29 Nov 2019 @ 3:09am

          Re: Protecting the guilty to protect the innocent

          Not to mention it leading to Color of Law abuses like the post-revolution French agency for 'Public Safety' and Soviet political officer were infamous for. See also: Driving while black

          reply to this | link to this | view in chronology ]

      • icon
        PaulT (profile), 26 Nov 2019 @ 6:47am

        Re: Re: A telling, and worrying, argument

        "As opposed to protecting the privacy of horrible criminals at NO cost to the public?"

        There is no protection of the privacy of criminals that doesn't also protect the innocent (which includes "horrible criminals" until they're found guilty in a court of law).

        There is no abuse of of the privacy of "horrible criminals" that doesn't also infringe on the privacy of the innocent.

        reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 26 Nov 2019 @ 7:17am

        Re: Re: A telling, and worrying, argument

        When the government crosses the line of protecting the innocent until proven guilty by a jury of their peers with trampling those rights to clamp down on criminals, I would rather the criminals be protected than a rogue government trampling everyone's rights.

        reply to this | link to this | view in chronology ]

      • identicon
        Joe, 29 Nov 2019 @ 3:07am

        Re: Re: A telling, and worrying, argument

        Nothing to hide? Then you won't mind me rifling through your stuff every day.

        reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 26 Nov 2019 @ 7:04am

      Re: A telling, and worrying, argument

      I already knew compelling someone to produce passwords to their personal devices that might incriminate them or allow someone to place unlawful material on their devices was unconstitutional. How do we live with such a usurped government?

      reply to this | link to this | view in chronology ]

    • icon
      Bergman (profile), 26 Nov 2019 @ 8:52am

      Re: A telling, and worrying, argument

      It's especially absurd when you consider the twin facts that state officials -- even judges and legislators -- are not immune to prosecution under Title 18, Sections 241 & 242 of the US Code... and that those federal statutes criminalize violations of constitutional rights under color of law.

      https://www.justice.gov/crt/statutes-enforced-criminal-section

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 26 Nov 2019 @ 4:37am

    One more reason to not use biometrics for anything.

    Actually if the child abuse people keep using biometrics it's fine but it is a stupid way to protect your stuff.

    I read the first amendment as giving the right to encrypt things if you want to.

    reply to this | link to this | view in chronology ]

  • This comment has been flagged by the community. Click here to show it
    identicon
    Anonymous Coward, 26 Nov 2019 @ 5:47am

    So an IP address is sufficient to establish probable cause for child porn and defamation but not copyright infringement?

    reply to this | link to this | view in chronology ]

  • icon
    Koby (profile), 26 Nov 2019 @ 6:19am

    Compelling

    I've always found it troubling that someone can be compelled to produce a password, or else get sent to jail. What if the subject being compelled does not know the password? Although this case does not involve that element, any protections against compelled production of information is a step in the right direction against false accusations.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 26 Nov 2019 @ 7:09am

      Re: Compelling

      You can sit in jail without a conviction indefinitely until you provide passwords unless you have the most expensive lawyers in town.

      reply to this | link to this | view in chronology ]

    • icon
      Bergman (profile), 26 Nov 2019 @ 8:54am

      Re: Compelling

      For some reason, while courts will come down with both boots on someone being sent to prison for an excessive time for a minor crime, they usually have no problems with a judge sending someone to prison for life for exercising a constitutional right the judge disagrees with.

      reply to this | link to this | view in chronology ]

  • icon
    Bergman (profile), 26 Nov 2019 @ 8:53am

    Physical keys versus mental keys

    This is one reason I don't use facial recognition or a fingerprint to unlock my devices. Providing a biometric key is a physical act. Remembering a password is a product of the mind, and speaking or writing it is testimonial.

    I don't intentionally break laws, but there are so many covering so many things that even federal judges can't definitively tell whether any given act is lawful or not, nor can they tell anyone how many federal laws there are. And then you have state, county and city laws as well, plus the odd contractual requirement you may have misread or just plain missed in a contract somewhere.

    It's safer to keep your keys in your mind alone.

    reply to this | link to this | view in chronology ]

    • identicon
      Joe, 29 Nov 2019 @ 3:16am

      Re: Physical keys versus mental keys

      Did you know that keys are just like written passwords? Hypothetically (but not practically) you can recut a key every time you use it, then destroy it. In fact, physical keys usually only have about 30 bits of entropy, but since it's impractical to make billions of them, they're considered moderately secure against 'guessing' the secret. On the other hand, locksmiths and pickers have long figured out how to attack them a few bits at a time...

      reply to this | link to this | view in chronology ]

  • This comment has been flagged by the community. Click here to show it
    icon
    Enrgtech (profile), 27 Nov 2019 @ 5:53am

    Electronic items

    Buy amazing electronic items here with 50%
    <a href="https://www.enrgtech.co.uk/">Buy Electronic items in UK </a>

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here



Subscribe to the Techdirt Daily newsletter




Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Close

Add A Reply

Have a Techdirt Account? Sign in now. Want one? Register here



Subscribe to the Techdirt Daily newsletter




Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Follow Techdirt
Techdirt Gear
Shop Now: Copying Is Not Theft
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.