Advancing Knowledge

Improving Skills

cellphone passcode

 

The Constitution and Phone Passcode Disclosure

The Miami Herald recently reported about two men who were ordered by Florida state court judges to turn over the passcodes to unlock their iPhones. One of the men was sentenced to serve 180 days in jail for contempt for his failure to turn over a valid passcode to police investigating charges of child abuse. The second man asserted that he could not remember the passcode to his phone, which had been seized by police more than 10 months after his arrest. In that contempt proceeding the court agreed that there was no proof that the defendant remembered the passcode and refused to find him in contempt. A second defendant in that case is facing similar contempt proceedings for providing a passcode that didn’t work. 

Securing the passcodes to locked smartphones is but one of many fronts in the justice system’s struggle to keep pace with advancing technology. From locked smartphones to encrypted files and messaging apps, courts, prosecutors and law enforcement agencies have struggled with striking the appropriate balance between privacy and the government’s interest in gathering evidence of criminal activity; a struggle fought applying 18th Century language to 21st Century technology.

PASSCODES, ENCRYPTION AND THE CONSTITUTION

Despite the ubiquity of smartphones, few cases have addressed the most basic Constitutional issues arising when law enforcement seeks to secure electronic evidence. What legitimate expectations of privacy does one have in electronic data? What is protected, and does it matter where that data is stored? How can law enforcement lawfully secure encrypted or passcode protected data?

The issue of compelling disclosure of passcodes is rooted in the 5th Amendmentprotectionagainst self-incrimination.Is compelling persontohandover   a   passcode simply   a  physical  act  like standing  ina  line-upor giving a voice sample,which doesn’t implicate the 5th Amendment at all,or isit moreakin to providing the combination tolocked safe,which is considered an impermissible order to revealwhat is in one’s mind. Is it simply being compelled to hand over thekey to a locked box properly seized,or is the very act of providingthecodeincriminatingtestimony?

There is a conflict among the few courts deciding the issue, and some have even changed sides as more facts are developed. The analysis begins, as it must, with the basic proposition that the 5th Amendment doesn’t proscribe compelling a defendant to reveal all incriminating evidence, rather, it provides that a defendant cannot be "compelled to make a testimonial communication that is incriminating.Fisher v. United States, 425 U.S. 391, 408 (1976). A companion to this is the recognition that acts can be testimonial in nature if they imply assertions, or if the act of production compels the defendant to disclose “the contents of his own mind.” United States v. Hubbell, 530 U.S. 27, 43 (2000).

PASSCODES AS TESTIMONIAL

In the cases reported in Miami Herald the trial courts relied on Florida precedent, State v. Stahl, 206 So.3d 124 (Fla.App. 2 Dist. 2016) holding that a defendant can lawfully be compelled to unlock his iPhone to allow law enforcement to execute a search of its contents pursuant to a search warrant. Stahl was charged with video voyeurism for using his iPhone to take “up-skirt” photographs. Stahl turned his phone over but withdrew his consent to search its contents. Police got a search warrant but weren’t able to crack the passcode, which brought the issue of compelling Stahl to turn over the code to the court. Stahl argued that producing the passcode is a testimonial act and that compelling him to produce it violates his 5th Amendment privilege. The Florida Court of Appeals disagreed, likening turning over the passcode to surrendering the key to a strongbox and not a testimonial act. This decision looks like something of an outlier.  

In a line of cases beginning with United States v. Kirschner, 823 F.Supp.2d 665 (E.D.Mich. 2010), many other courts have found that compelling the production of a working passcode is a testimonial act protected by the 5th Amendment. In Kirschner, the defendant received a grand jury subpoena that required him to provide the passwords to encrypted files on a computer seized by the government. The defendant moved to quash the subpoena asserting his 5th Amendment privilege against self-incrimination. Relying on the principle articulated in Doe v. United States, 487 U.S. 201, 212, 108 S.Ct. 2341, 101 L.Ed.2d 184 (1987), that an act is testimonial when one is forced to reveal knowledge of facts relating him to the offense or from “having to share his thoughts and beliefs with the government”, the District Court quashed the subpoena, holding that forcing the defendant to reveal the password communicates a factual assertion and is testimonial.

Next in line is In re Grand Jury Subpoena Duces Tecum, 670 F.3d 1335 (11th Cir. 2012) This case is an appeal from a civil judgment of contempt for John Doe’s refusal to provide a grand jury with unencrypted contents of his computer and external hard drives. The government tried to grant Doe act-of‐production immunity, but he continued his objection out of fear of derivative use of the unencrypted files, arguing that the government intended to use any evidence of child porn in the files in a subsequent criminal case because of the limited grant of immunity. The district court agreed with the government that the production of the passcode to decrypt the data was not testimonial, and granted the limited immunity.

The 11th Circuit found both to be error. The government argued that it was doing nothing more than requiring Doe to produce documents, even though the content of them may be incriminating. Doe created the file and that creation was not compelled by the government. But that argument is wide of the point. Whether the computers files are testimonial is not at issue. What is at issue is whether the act of production is testimonial. Ultimately, "the Fifth Amendment privilege is not triggered where the Government merely compels some physical act, i.e. where the individual is not called upon to make use of the contents of his or her mind. The most famous example is the key to the lock of a strongbox containing documents, see Hubbell, 530 U.S. at 43, 120 S.Ct. at 2047 (citing Doe v. United States, 487 U.S. 201, 210 n. 9, 108 S.Ct. 2341, 2347 n. 9, 101 L.Ed.2d 184 (1988)).” In re Grand Jury Subpoena Duces Tecum, 670 F.3d at 1345. The 5th Amendment is implicated when the act of production compels one to disclose the contents of his own mind. To continue the analogy from Doe, compelling one to reveal the combination to a safe is a testimonial act, and compelling production of a password is likewise testimonial.

State courts generally seem to be following suit, finding that compelling production of a passcode or password is a testimonial act implicating the 5th Amendment’s privilege against self-incrimination. For example, in Commonwealth v. Gelfgatt, 468 Mass. 512, 11 N.E.3d 605 (2104), the Massachusetts Supreme Judicial Court acknowledged that by producing the password to encrypted computers seized by the Commonwealth the defendant implicitly admits he has ownership and control of the contents.

In State v. Trant, 102215 MESUP, 15-2389 (Oct. 22, 2015), the State could not execute a search warrant to search the contents of two iPhones without the passcodes. In an effort to avoid potential 5th Amendment problems, the State moved for an order requiring the Defendant to enter the passcodes and unlock the phones. The State reasoned that such an order did not compel the Defendant to reveal the passcode, rather it required only the physical act of entering the code. The court rejected the argument, quashing the order because the nature of the act compelled remained testimonial.

THE “FOREGONE CONCLUSION” EXCEPTION

As with so many issues, the analysis does not end there. The 5th Amendment protection rests upon the testimonial nature of the act of production. But what if the government already knows what’s on the iPhone or in the encrypted files, and the defendant admits he owns the device and has the passcode? Those facts, among others, may allow the government to invoke the “foregone conclusion” exception to the production as testimony rule. The exception will be successful if the government can establish that it (1) knew of the existence of the evidence demanded; (2) that defendant possessed and controlled it; and (3) that the government can establish the authenticity of the evidence. In such circumstances, the Amendments protection is not implicated. In Gelfgatt, above, the court upheld the order requiring disclosure of the password because the “facts that would be conveyed by the defendant through his act of decryption-his  ownership and  control of the computers and their contents, knowledge of the fact of encryption, and knowledge of the encryption key-­‐already are known to the government and, thus, are a 'foregone conclusion.’ The Commonwealth's motion to compel decryption does not violate the defendant's rights under the Fifth Amendment because the defendant is only telling the government what it already knows.” 11 N.E.3d 615-616.

The “foregone conclusion” doctrine was argued in In re Grand Jury Subpoena Duces Tecum, but failed because the government simply didn’t know what, if anything, was encrypted on the various computers or drives. Simply establishing that the drives are capable of storing files, and some of those may be incriminating, isn’t sufficient. In a sense, the demand for the encryption key was also a demand that the defendant provide the government with the keys to the jailhouse.

Obviously, the level of knowledge about what is on the computer or phone is key. For example, in a case like In re Grand Jury Subpoena to Boucher, 2007 WL 4246473 (D.Vt. Nov. 29, 2007) (Boucher I) ICE agents lawfully reviewed the unencrypted contents of files on a laptop and found animated child porn. The review also revealed the presence of encrypted files with suspicious names like “2yo getting raped during diaper change”, files that the agents could not open. Boucher admitted the computer was his and that he regularly downloaded pornographic images. However, Boucher told investigators that when he unknowingly downloaded child pornography he deleted them immediately. The computer was ultimately shut down, and Boucher was ordered to provide the password necessary to start it up again and view the suspect files. Boucher moved for and was granted an order to quash the subpoena on 5th Amendment grounds.

In response, the government refined its request to fall within the “foregone conclusion” doctrine. The government issued a new subpoena requiring Boucher to produce an unencrypted version of the Z drive, which was upheld. The government already knew with reasonable particularity the existence and location of the subpoenaed files, Boucher had shown the investigator files on the Z drive. Boucher admitted the laptop was his, and producing an unencrypted version was not necessary to authenticate the drive. In re Grand Jury Subpoena to Boucher, 2009 WL 424718 at *2 (D.Vt. Feb. 19, 2009) (Boucher II). Accord United States v. Fricosu, 841 F.Supp.2d 1232 (D.Colo. 2012).

PROTECTED OR NOT?

So, where do we stand? No question this issue will continue to vex law enforcement, prosecutors, and the courts. I think it’s safe to conclude that producing a passcode or password is a testimonial act in most circumstances. Investigators can ask nicely for the password, but it’s difficult to compel someone to produce it. Unless investigators are looking for specific documents they know exists and which can be authenticated apart from being in the defendant’s possession, establishing the “foregone conclusion” exception, it seems unlikely that a demand to produce a password will stand constitutional muster.

Print Email

What People are Saying about Herb's Trainings 

"Again, thank you for your time, knowledge, and efforts to share your experiences.  It was a great 2-days and I wish to learn much more."
Program Specialist assisting in Title IX investigations

"I just wanted to say thank you for such an excellent lecture. It was extremely insightful and definitely had me thinking about how I would begin to form how I would conduct interviews on such a difficult topic. It was nice for me (someone who's never interviewed a victim like that) to go in with no knowledge or bias and be able to completely absorb what you were teaching."
Law enforcement intern and future Law Enforcement Office
 

"Thank you so much for the really excellent presentation on Tuesday! Our entire team thought it was spot-on content-wise, and you offered it to the participants in a way that was easy for them to understand."
Program director, national TA provider