Earlier this week, the Massachusetts Supreme Judicial waded into the Stygian waters of the interplay between technology and the Fifth Amendment – determining for the first time whether a person could be compelled to provide the government with the decryption key protecting the privacy of documents contained on their computer.
Under the specific circumstances of the case, the Bay State court found that the person could, in fact be forced to pony up the digital keys. It’s a bad ruling, but not for the reasons most people think.
Let’s start with the Fifth Amendment’s language. “No person in a criminal case shall be compelled to be a witness against themselves.” Courts have interpreted this language to apply to civil, administrative, legislative or other proceedings, if the testimony can later be used in a criminal case.
But the privilege is a testimonial privilege – it requires some form of testimony. It doesn’t say you can’t incriminate yourself – it says you can’t be compelled to testify against yourself. So Courts have permitted people to be compelled to provide voice exemplar (remember The Usual Suspects?), handwriting exemplars, blood samples, photo lineups, and other “incriminating” actions without running afoul of the Constitution.
The other doctrine inherent in the Court’s interpretation of the Fifth Amendment is that the law prohibits the compulsion of the incrimination. Thus, if you have voluntarily created incriminating records (or had such records created by a third party) those records are not themselves protected. If you have a book of betting sheets, which incriminate you in a numbers racket, the government did not compel you to create them. If you have child porn on your computer, the act of downloading the porn was not compelled.
But forcing someone to decrypt the contents of their computer is not without legal risk. It’s not that the contents of the encrypted computer are compelled – it is that the “act of production” of those contents is compelled.
There are really two self-incrimination aspects of compelled decryption. One is the compelled production of the decrypted contents of the drive – the data itself. Since the target of the investigation was not compelled to create these documents, Courts have considered this NOT to be a Fifth Amendment issue, although there may be a bit of life left in what is called the “diary” exception (Fisher v. United States) relating to what the Court called “intimate personal papers.” But by and large, the CONTENTS of a document voluntarily created are not privileged under the 5th Amendment.
The second aspect is called the “act of production” privilege, from a case called Doe v. United States. The principle is that the “act” of producing a document or record or physical object can be incriminating itself. So if I subpoenaed from you “all guns you used to murder Jane Doe” and you produced a particular gun, the act of production would be an admission of murder. Moreover, producing the gun would admit its existence, your possession of it, and your ability to control it, its authenticity, and your knowledge that it exists.
Typically, to compel production to an individual or a sole proprietorship (corporations have no 5th Amendment privilege) you would have to provide immunity to the target – that is, you would have to agree not to use the act of production in any way to prove existence, control, authenticity, etc. This is sometimes referred to as the “manna from heaven” immunity – the unencrypted contents of the laptop can be used as if they are manna from heaven. We can’t say where they came from, but we can use them. As long as the immunity is coextensive with the privilege, the immunity extinguishes the privilege.
In the Massachusetts case, the defendant – a lawyer – was alleged to have used one or more of the four computers seized by the police from his home in furtherance of a scheme to obtain money from real estate borrowers by setting up fictitious companies to receive mortgage loan repayments. The details of the scheme are irrelevant – what is important is that, when the police came to take the computers, he said, “everything is encrypted and no one is going to get to it.”
One more legal doctrine here – it’s called “foregone conclusion” or “inevitable discovery.” In this case, the Massachusetts cops may have wanted to use the defendant’s “act of decryption” to prove that the defendant owned the computers seized, was knowledgeable about their contents, had control over their contents, and in fact was the one who encrypted the contents.
The Massachusetts Supreme Judicial Court held that by saying, “everything is encrypted and no one is going to get to it” the defendant essentially waived his Fifth Amendment rights by admitting everything the cops wanted to know. Possession, knowledge, control, etc., became a “foregone conclusion” and therefore extinguished his Fifth Amendment rights. It’s similar to the argument that is being used to assert that Lois Lerner, the embattled IRS employee waived her Fifth Amendment rights by appearing before Congress and asserting, “I did nothing wrong” before asserting her rights against self-incrimination.
So what the court is saying here is that the target has admitted already all the things that the act of production would show. The target has admitted ownership, control, possession and knowledge. Thus, he has “waived” the privilege as to the act of production, similar to a grant of immunity.
Just to muddy the waters, courts tend to treat passwords differently from biometrics. Surprisingly, giving passwords greater legal protection than biometrics. Because a password or pass phrase is something you know, there’s a feeling that there’s a testimonial aspect to forcing a person to give it up. See, Hubbell v. United States. But a biometric, being something you ARE is seen less as testimony, and more like giving a blood sample for a drunk driving case. Schmerber v. California. It’s the difference between compelling someone to give up a padlock KEY or a padlock COMBINATION.
Here’s why the court is wrong. And dead wrong. It’s not that the government can’t compel someone to decrypt the contents of a computer. In fact, the government can put you into the grand jury and ask you if you killed someone. If you assert your Fifth Amendment rights, they can grant you immunity (the federal statute is 18 USC 6001) and agree not to use what you say – or anything derived from what you say – against you. In that way, you are not in any legal jeopardy from having testified. The immunity granted is coextensive with the privilege and therefore extinguishes the privilege.
Not so here.
The government made no attempt to grant the defendant immunity. It could have done so with the stroke of a pen. Thus, the government likely wants to use the fact that the defendant decrypted the hard drives in some way against them. Otherwise, why NOT grant immunity – outwardly and expressly. Agree that you won’t use the decryption or anything derived from the decryption (not including of course the contents of the decrypted records) in any way against the defendant. Saying “everything is encrypted” is not the same as saying, “see those four computers over there? I own them and am familiar with their contents.” Saying “everything is encrypted” is not even saying, “I encrypted the contents of those computers, I have the password or passphrase, and I can decrypt them.”
Compelling decryption without granting immunity in those circumstances is not extinguishing the privilege. It’s dancing around it. And when it comes to something as critical as the privilege against self-incrimination, you can’t be too careful.