The Volokh Conspiracy -

Magistrate Judge Finds Fifth Amendment Right Not to Enter Encryption Passphrase: Imagine the government seizes a suspect's hard drive and finds encrypted files inside. Can the government force the suspect to enter in his encryption passphrase so the government can view the decrypted files? Or does the Fifth Amendment privilege give the suspect a legal right not to enter in the passphrase? On November 29, Magistrate Judge Jerome Niedermeier in Vermont handed down the first opinion to squarely address the issue: In re Boucher. Judge Niedermeier ruled that the defendant did have a Fifth Amendment privilege in such circumstances. This is a hard issue, but I tend to think Judge Niedermeier was wrong given the specific facts of this case.

  First, the facts. Boucher was crossing the border from Canada to Vermont when border agents began to suspect he had child pornography in the car. They saw a laptop in the back of the car and opened it up. It was not password-protected, an an agent began to look through it. (By way of background, the Fourth Amendment has an exception at the border that makes this search legal.) The agent came across several files with truly revolting titles that strongly suggested the files themselves were child pornography. The files had been opened a few days earlier, but the agent found that he could not open the file when he tried to do so. Agents asked Boucher if there was child pornography in the computer, and Boucher said he wasn't sure; he downloaded a lot of pornography on to his computer, he said, but he deleted child pornography when he came across it.

  In response to the agents' request, Boucher waived his Miranda rights and agreed to show the agents where the pornography on the computer was stored. The agents gave the computer to Boucher, who navigated through the machine to a part of the hard drive named "drive Z." The agents then asked Boucher to step aside and started to look through the computer themselves. They came across several videos and pictures of child pornography. Boucher was then arrested, and the agents powered down the laptop.

  Now here's where it gets interesting. Two weeks later a government forensic analyst started to analyze the machine. He created a "mirror" copy of the hard drive and then looked at the mirror to see what it contained. But it turned out that the part of the hard drive that was designated "drive Z" was encrypted with the popular software program PGP, and no one — no one, presumably, except for Boucher — knew the password. The government tried to guess the password and failed, so the grand jury issued a subpoena to Boucher ordering him to disclose the password to drive Z. Boucher's counsel them moved to block the subpoena, arguing that he had a Fifth Amendment privilege not to comply. The government responded that it would be happy to just have Boucher enter in the password without the government ever seeing it. The Court thus addressed only whether Boucher had a Fifth Amendment privilege not to enter in the password.

  Judge Niedermeier ruled that Boucher did have such a privilege and quashed the subpoena. According to Judge Niedermeier, entering in the password would be testimonial.

To read the rest of this post, click here.

Here's the key passage:

  Entering a password into the computer implicitly communicates facts. By entering the password Boucher would be disclosing the fact that he knows the password and has control over the files on drive Z. The procedure is equivalent to asking Boucher, "Do you know the password to the laptop?" If Boucher does know the password, he would be faced with the forbidden trilemma; incriminate himself, lie under oath, or find himself in contempt of court. Id . at 212.
  The Supreme Court has held some acts of production are unprivileged such as providing fingerprints, blood samples, or voice recordings. Id. at 210. Production of such evidence gives no indication of a person's thoughts or knowledge because it is undeniable that a person possesses his own fingerprints, blood, and voice. Id. at 210-11. Unlike the unprivileged production of such samples, it is not without question that Boucher possesses the password or has access to the files.
  In distinguishing testimonial from non-testimonial acts, the Supreme Court has compared revealing the combination to a wall safe to surrendering the key to a strongbox. See id. at 210, n. 9; see also United States v. Hubbell, 530 U.S. 27, 43 (2000). The combination conveys the contents of one's mind; the key does not and is therefore not testimonial. Doe II, 487 U.S. at 210, n. 9. A password, like a combination, is in the suspect's mind, and is therefore testimonial and beyond the reach of the grand jury subpoena.
  The government has offered to restrict the entering of the password so that no one views or records the password. While this would prevent the government from knowing what the password is, it would not change the testimonial significance of the act of entering the password. Boucher would still be implicitly indicating that he knows the password and that he has access to the files. The contents of Boucher's mind would still be displayed, and therefore the testimonial nature does not change merely because no one else will discover the password.

Judge Niedermeier also rejected the argument that the Fifth Amendment didn't apply because the testimonial fact was a "foregone conclusion" and thus not protected:

While the government has seen some of the files on drive Z, it has not viewed all or even most of them. While the government may know of the existence and location of the files it has previously viewed, it does not know of the existence of other files on drive Z that may contain incriminating material. By compelling entry of the password the government would be compelling production of all the files on drive Z, both known and unknown. . . . [T]he files the government has not seen could add much to the sum total of the government's information. Therefore, the foregone conclusion doctrine does not apply and the act of production privilege remains.
Since the government is trying to compel the production of the password itself, the foregone conclusion doctrine cannot apply. The password is not a physical thing. If Boucher knows the password, it only exists in his mind. This information is unlike a document, to which the foregone conclusion doctrine usually applies, and unlike any physical evidence the government could already know of. It is pure testimonial production rather than physical evidence having testimonial aspects. Compelling Boucher to produce the password compels him to display the contents of his mind to incriminate himself. Doe III did not deal with production of a suspect's thoughts and memories but only previously created documents. The foregone conclusion doctrine does not apply to the production of non-physical evidence, existing only in a suspect's mind where the act of production can be used against him.

  I don't play in the sandbox of the Fifth Amendment as much as I do the Fourth, but my sense is that Judge Niedermeier is wrong. True, being forced to enter in the password has a communicative aspect to it. It says, "I know the password to drive Z on my laptop." But based on the specific facts of the case, don't we already know that? Isn't it a "foregone conclusion" under the Fisher case? Boucher admitted that it was his laptop, and he described how he used it. When he agreed to show the officers the files inside, he had no problem powering it up and bringing them to the contents of drive Z. The subpoena is simply trying to get Boucher to take the officers back to where he had already taken them before: through the passphrase so they can access the files.

  Judge Niedermier's response is that this is true for the child pornography the agents saw but that there may be other files on the computer that are also incriminating. Entering in the key will be akin to producing any other files that might exist, effectively saying, "these are files on my laptop." But I think that's wrong. As I see it, entering the passphrase doesn't have any testimonial content as to Boucher's knowledge or beliefs as to any other files in "drive Z" that may or may not exist. Maybe there are other incriminating files in drive Z. On the other hand, maybe there aren't. But the answer to that is completely independent of what Boucher is being asked to do.

  It may be that entering in the passphrase will help the police find more child pornography, but that is not the result of the communicative aspect of responding to the subpoena. Boucher's entering in the password won't amount to Boucher's testimony about anything they don't already know in the context of this case. Its role is merely that it will let the police access whatever is on the hard drive, which may or may not relate to criminal activity and may or may not implicate Boucher. Boucher won't be "bringing" the files to the police in response to an order to incriminating files; he will merely be opening the door to the safe that we all know is his and that we seem to know he knows how to open.

  Given that this post might be of interest to a non-lawyer crowd, I should add an important point that will be obvious to the lawyers but not obvious to the computer crowd: This opinion does not really settle the legal issue. It's only an opinion by one judge, and that judge isn't even a "real" federal District Court judge. The opinion is only the decision of one Magistrate Judge, who is sort of an assistant judge in the federal system. If you want to make an analogy to science, this is like one professor's hypothesis rather than an experimental or theoretical proof. So while it's the first case on the issue, it may be wrong (as I tend to think it is) and probably won't be the final word either way.

  Anyway, this is an interesting and difficult issue, and that's my tentative take on it. I'd be particularly interested in hearing from techies who have a sense of what probably happened on the tech side. Finally, thanks to Robert W. Clark for bringing the case to my attention.

Related Posts (on one page):

More on Encryption, the Fifth Amendment, and the "Foregone Conclusion" Exception:
Magistrate Judge Finds Fifth Amendment Right Not to Enter Encryption Passphrase:

More on Encryption, the Fifth Amendment, and the "Foregone Conclusion" Exception: My Friday post on the Fifth Amendment and encryption discussing the Boucher case led to a very long and interesting comment thread, including several comments from readers who thought it clearly wrong to say that Boucher could be required to enter in the password even if no one doubted that he knew it. The basic argument was that entering in the password had a testimonial aspect to it, and the government could never compel someone to take those steps in a way that would hurt him in a criminal case — in Boucher, by leading the police back to the evidence on the hard drive.

In this post, I want to explain why I tend to disagree. It's my understanding that if the government already knows that Boucher has the password, having him enter it in generally does not implicate the Fifth Amendment privilege. Just to be extra clear, I'm not saying that I like the law this way, or that this is my personal theory of what the Fifth Amendment should mean. Rather, I'm saying that I think this is the correct result under existing caselaw. (So if you disagree, it's probably best to make your arguments in terms of cases, not Universal Principles of Justice.)

The key precedent here is Fisher v. United States, 425 U.S. 391 (1976), in which the Supreme Court considered whether the government could subpoena records involving the preparation of a person's taxes by his accountant over a three year period from the suspect himself, who was suspected of tax fraud. The Court concluded that the Fifth Amendment did not bar such a subpoena, even though responding to the subpoena would indicate the person's knowledge and control of the records and even though the government wanted to use the records to prove his guilt for tax fraud. Here's why:

Surely the Government is in no way relying on the "truthtelling" of the taxpayer to prove the existence of or his access to the documents. 8 Wigmore § 2264, p. 380. The existence and location of the papers are a foregone conclusion, and the taxpayer adds little or nothing to the sum total of the Government's information by conceding that he, in fact, has the papers. Under these circumstances, by enforcement of the summons, "no constitutional rights are touched. The question is not of testimony, but of surrender." In re Harris, 221 U. S. 274, 279 (1911).
When an accused is required to submit a handwriting exemplar, he admits his ability to write and impliedly asserts that the exemplar is his writing. But in common experience, the first would be a near truism, and the latter self-evident. In any event, although the exemplar may be incriminating to the accused and although he is compelled to furnish it, his Fifth Amendment privilege is not violated, because nothing he has said or done is deemed to be sufficiently testimonial for purposes of the privilege.

Under Fisher, courts have to make a judgment call about how much the testimonial component of the act of production will really add to the government's case. If the subpoena makes the target state some important fact that the government didn't know, then it's unconstitutional. See, e.g., United States v. Hubbell, 530 U.S. 27, 44-45 (2000), in which the government made the target collect his records, go through them, and identify which of the records revealed his crimes. On the other hand, if the subpoena makes the target testify about something that the government basically knows already, or is pretty unimportant, or could find out another way, then it's not unconstitutional. This is a fact-intensive test, requiring close attention to exactly what the government knows and what is relevant to their case.

To read the rest of this post, click here.

Consider United States v. Teeple, 286 F.3d 1047 (8th Cir. 2002). In Teeple, a tax protester who worked as a chiropractor did not file any tax returns for a few years. The government issued a subpoena for his financial records, and he asserted the Fifth Amendment privilege. He argued, and the Court agreed, that turning over his financial records would very likely expose him to criminal liability. According to Teeple, complying with the subpoena would amount to his testimony that the records existed and that he had them. However, the Court ruled that complying with the subpoena wouldn't be testimonial under Fisher because Teeple's past conduct had already demonstrated those facts to the government. Specifically, Teeple had made statements at an earlier court hearing that had essentially demonstrated those facts:

At [the prior] hearing Teeple testified that he possessed the documents requested in the summons; that he had received income during 1996 and 1997, including fees from various HMOs in his chiropractic business; that he had been paid by insurance companies as part of fees he received in his chiropractic business during those years; that he deposited some of the fees in bank accounts; that he was aware of Form 1099s which indicated he had received payments from various businesses during those years and that he received such payments; that he had not filed federal income tax returns in 1996 and 1997; and that he did not believe he was liable to pay federal income tax. See Appellant's App. 9-14. Teeple also testified that he kept books and records-which he called “personal accounting ledgers”-that demonstrated the amount of money he received from his chiropractic business in 1996 and 1997. Id. at 13. Teeple admitted he brought to court all the books and records that were requested in the summons. Id. at 6.
Teeple rejects the comparison to Fisher and contends his case is analogous to Doe and United States v. Hubbell, 530 U.S. 27, 120 S.Ct. 2037, 147 L.Ed.2d 24 (2000). We disagree. In both cases Teeple favors, the government knew far less about the documents and records it sought than in the present case. See Doe, 465 U.S. at 614 n. 13, 104 S.Ct. 1237; Hubbell, 530 U.S. at 44, 120 S.Ct. 2037. We think the government's knowledge of the requested documents in Teeple's case is more akin to the government's knowledge in Fisher, not Doe or Hubbell.

The Eighth Circuit had a similar case more recently, United States v. Norwood, 420 F.3d 888 (8th Cir. 2005), albeit one reflecting a deferential standard of review (because the Court viewed the "foregone conclusion" question as a finding of fact). The government thought Norwood was hiding income in offshore accounts, and a preliminary investigation suggested that Norwood used a particular offshore account and revealed a few transactions on it. The government then subpoenaed Norwood for all of the information relating to the account. Norwood objected, pointing out that responding to the subpoena would amound to his testimony that he had that account and that he had control of it (and of course that looking through the records could reveal evidence of crime). The Eighth Circuit disagreed in an opinion by Judge Colloton:

The existence of the requested records relating to Norwood's [offshore account] is a foregone conclusion. The summons seeks records such as account applications, periodic account statements, and charge receipts, all of which are possessed by the owners of financial accounts as a matter of course. Norwood does not contend that he does not possess any of these documents, and the government knows far more about the documents associated with Norwood's [account] than it did about the defendant's business records in Hubbell, 530 U.S. at 44, 120 S.Ct. 2037. In Hubbell, the government could not show "any prior knowledge of either the existence or whereabouts” of the documents sought. Id. (emphasis added). Here, by contrast, the government knows the name and location of the bank that created the records sought, Norwood's payment card numbers, and even the details of a number of discrete transactions involving the cards and his Leadenhall account. Accordingly, the district court's conclusion that "Norwood's production of the records has no testimonial significance," (Add. at 4), is not clearly erroneous.

  Now let's come back to In re Boucher, the encryption case. The testimonial aspect of Boucher's entering in the password is that he knows the password. That is, it's equivalent to Boucher saying, "I know the password to this laptop." But as I read the case, we all know Boucher knows the password. Boucher is a lot like Teeple: he has already come forward and done things that effectively conceded the point. Thanks to his own conduct, we know it's his computer; we know he uses it often; we know how he uses it and controls it; and we know he regularly accesses the Z drive. While I don't think he actually said in a flat statement that he knows the password to the Z drive, it seems to me from the facts that this isn't really in contention. If I'm right about that — something I would want to check with the complete record to know with certainty, but seems right based on my read of the opinion — it seems to me that Boucher's knowledge of the password is a foregone conclusion and therefore the subpoena does not compel any testimony under Fisher.

  It is true that entering in the password might reveal information the government doesn't have — namely the existence of more contraband beyond what the government already knows. But this was the case in Fisher, Teeple, and Norwood as well. In all three cases, compliance with the subpoena was likely to make the target give additional evidence of their crime to the police. In Norwood, for example, the government had information that Norwood had an offshore account, and knew he had used the account to make a few purchases, but it had no idea what the full extent of the illegal conduct was. This didn't matter, because the relevant question was whether the government already knew that Norwood had the account. Similarly, I think the key question is not whether the government knows of all the images on Boucher's machine; rather, it's whether the government knows that Boucher knows the password. If I'm right that this fact is pretty clear, I tend to think that knowledge of the password is a foregone conclusion under Fisher.

  Anyway, this area of law is very complicated, and my view on this are still tentative. In particular, I would want to more about the record in terms of whether Boucher has clearly demonstrated his knowledge of the password. And of course, it's entirely possible that I'm missing something in the analysis; as I said in the first post, I don't play in the sandbox of the Fifth as much as I do the Fourth's. But I did want to explain my view in light of the several critical comments, and to open it up for comments so others could respond.