Back in late 2007, I blogged a lot about a magistrate judge ruling in In re Boucher, a case involving a how the Fifth Amendment right against self-incrimination applies to access to encryption keys. I argued back then that the magistrate's decision was wrong on narrow grounds: Although the Fifth Amendment normally blocked the subpoena of encryption keys, in this particular case the facts divulged by compliance with the subpoena were already known to the government and therefore not privileged under the "foregone conclusion" doctrine.

  Although the 2007 ruling garnered a great deal of press attention (including articles in the Washington Post and the New York Times), it was only the ruling of a magistrate judge rather than an Article III District Judge. The government sought review of the case with an Article III District Judge (more or less an "appeal" from the ruling of the magistrate judge), and we have been waiting for a ruling from the District Court for about a year.

  A few days ago, District Judge William K. Sessions III finally handed down a ruling. I have posted the opinion here: In Re Grand Jury Subpoena to Sebastien Boucher. Judge Sessions's take was basically the same as mine in my 2007 post: He ruled that under the specific facts of this case, Boucher must decrypt the hard drive and produce to the government an unencrypted version of the drive. (Notably, the subpoena orders Boucher to produce to the government an unencrypted version of his hard drive, not to actually give the government his key.) There was no Fifth Amendment privilege because the government already knew the testimonial things that compliance with the subpoena would help show, making that a "foregone conclusion." From the opinion:

  Where the existence and location of the documents are known to the government, "no constitutional rights are touched," because these matters are a "foregone conclusion." Fisher, 425 U.S. at 411. The Magistrate Judge determined that the foregone conclusion rationale did not apply, because the government has not viewed most of the files on the Z drive, and therefore does not know whether most of the files on the Z drive contain incriminating material. Second Circuit precedent, however, does not require that the government be aware of the incriminatory contents of the files; it requires the government to demonstrate "with reasonable particularity that it knows of the existence and location of subpoenaed documents."
  Boucher accessed the Z drive of his laptop at the ICE agent's request. The ICE agent viewed the contents of some of the Z drive's files, and ascertained that they may consist of images or videos of child pornography. The Government thus knows of the existence and location of the Z drive and its files. Again providing access to the unencrypted Z drive "adds little or nothing to the sum total of the Government's information" about the existence and location of files that may contain incriminating information. Fisher, 425 U.S. at 411.
  Boucher's act of producing an unencrypted version of the Z drive likewise is not necessary to authenticate it. He has already admitted to possession of the computer, and provided the Government with access to the Z drive. The Government has submitted that it can link Boucher with the files on his computer without making use of his production of an unencrypted version of the Z drive, and that it will not use his act of production as evidence of authentication.
  Because Boucher has no act of production privilege to refuse to provide the grand jury with an unencrypted version of the Z drive of his computer, his motion to quash the subpoena . . . is denied.

That seems correct to me, as explained in my original post and expanded on at length in this post. I suppose the next question will be whether Boucher will comply with the subpoena, or whether he will "forget" the key or just refuse to comply and face contempt charges instead. Stay tuned.