READ ABOUT: Encryption and Your Right Against Self-Incrimination
This post is the latest in a series concentrating on intersections between law and technology. A previous post gave a broad overview of some of the legal implications of cloud computing.
Does “I plead the Fifth,” that mainstay of courtroom drama tv, work when prosecutors ask you to tell them what your password is? The Fifth Amendment’s right against self-incrimination is an important element of American law. How does it apply to encrypted hard drives? ( Here is some basic information about disk encryption.)
The Fifth Amendment protects a person from having to be a witness against herself in a criminal trial. This means that prosecutors ordinarily cannot compel a person to reveal the contents of her mind. In some cases, the Fifth may also protect a person from being compelled to produce documents. But this protection only extends to instances where the act of production itself is incriminating.
It’s a confusing distinction. The Fifth can protect you from having to testify against yourself because the act of telling where you were on the night of January 5th could be incriminating. However, the Fifth does not protect you from having to provide a blood or handwriting sample, or from being asked to try on a glove, because those acts are not themselves incriminating. Providing a writing sample might link you to the crime, but that’s one step removed: again, the act itself is not incriminating. (The Fifth could protect you if being able to write was a crime.)
This leads to the general rule that the production of documents is not protected by the Fifth. Usually, producing a document is not itself incriminating. However, the Supreme Court has recognized circumstances where production would be incriminating: where you would be admitting to the documents’ existence, admitting that they’re yours, or admitting that they’re authentic (for technical Rules of Evidence purposes). Therefore, if prosecutors can’t sufficiently prove that certain documents are in your possession, the Fifth can protect you because in producing them you would be incriminating yourself by admitting that you possess them. This is an application of the “foregone conclusion” rule: if it is a foregone conclusion that the documents are in your possession, the Fifth won’t protect you.
How do these rules apply to encrypted hard drives? Properly encrypted data is virtually impossible to unlock. Unless the defendant reveals the password, prosecutors may never be able to access the documents they want.
Two recent decisions have considered whether defendants may be compelled to decrypt their hard drives.
In a 2009 federal case in the District of Vermont , prosecutors knew that the defendant’s encrypted computer contained child pornography because border patrol agents had seen it while conducting a routine search of the defendant’s belongings. Prosecutors demanded that the defendant disclose his password. The court denied this request because it would have required the defendant to reveal the contents of his mind. Prosecutors tried again, and demanded that the defendant produce an unencrypted version of his hard drive. This time, the court ordered production, ruling that the request only required the defendant to produce documents. And because prosecutors already knew the documents were on the hard drive, producing them wouldn’t be an incriminating act.
In a recent District of Colorado case, prosecutors knew that the defendant had incriminating documents on her encrypted hard drive. Instead of requesting the password, prosecutors demanded an unencrypted copy. The court granted the request, holding that because the documents’ existence was a foregone conclusion, their production was not protected by the Fifth.
The Electronic Frontier Foundation and other civil liberty groups have watched these cases carefully. In the Colorado case, EFF argued that the prosecutor’s idea to demand a decrypted copy of the hard drive instead of the password, was just sidestepping the issue. Both requests, EFF argued, require defendants to reveal defendants to reveal the contents of their minds.
This area of the law is unsettled, and it continues to evolve. The Supreme Court has not ruled on this issue yet, and it is unclear whether the Colorado case will be appealed. Finally, some commentators predict that cloud computing may present more Fifth Amendment complications. For example, for a person who stores her documents on a remote server rather than her own computer, complying with a decryption demand may be incriminating if it proves that she is the owner of those documents.