The 11th Circuit Court of Appeals has held that a criminal defendant is not required to reveal passwords which would decrypt (effectively unlock) data on his computer’s hard drive. To compel defendant John Doe to reveal his decryption password would violate his Fifth Amendment privilege against self incrimination. In re Grand Jury Subpoena, Case no. 11-12268 (11th Cir. Feb. 23, 2012) (available here) (herein “Doe’s Case”).
In Doe’s Case, a child pornography investigation was initiated after videos of underage girls were found on YouTube associated with Internet IP addresses ultimately linked to Doe. The officers thought Doe was sharing the pornography. Officers seized multiple external hard drives from Doe and determined that parts of them were encrypted using TrueCrypt, a free encryption program from the Internet. See www.TrueCrypt.org. A grand jury subpoena was issued to require production of an unencrypted copy, and Doe refused to comply and was held in civil contempt by the U.S. District Court.
In summary, the 11th Circuit Court of Appeals decided that compelling Doe to reveal, by testimony, the encryption passwords would be testimonial rather than “turning over a physical key” to unlock a physical lock. The Court said the issue is not whether the contents of the hard drive were testimonial content but whether the announcement of the passwords were testimonial in nature.
Two Supreme Court cases were critical. In Fisher v. United States, 425 U.S. 391, 410, 96 S. Ct. 1569, 1581, 48 L. Ed. 2d 39 (1976), a taxpayer’s production of the subpoenaed documents was held to be “not testimonial” because the Government knew of the existence of the documents, knew that the taxpayer possessed the documents, and could show their authenticity not through the use of the taxpayer’s mind, but rather through testimony from others. In United States v. Hubbell, 530 U.S. 27, 38, 120 S. Ct. 2037, 2044, 147 L. Ed. 2d 24 (2000) (the famous Whitewater case), the Court found that the Government could not show that it had knowledge of the contents of the subpoened documents from a source independent of the documents themselves, and dismissed the indictment. The Court held that Hubbell’s act of production was sufficiently testimonial to trigger Fifth Amendment protection, as knowledge of the implicit testimonial facts associated with his act of production was not a foregone conclusion.
In the Doe Case, “the Fifth Amendment privilege is not triggered where the Government merely compels some physical act, i.e. where the individual is not called upon to make use of the contents of his or her mind. The most famous example is the key to the lock of a strongbox containing documents,” where the defendant was compelled to produce the key. Slip Opn 20-21, citing Hubbell, 530 U.S. at 43, 120 S. Ct. at 2047.
“We hold that the act of Doe’s decryption and production of the contents of the hard drives would sufficiently implicate the Fifth Amendment privilege. We reach this holding by concluding that (1) Doe’s decryption and production of the contents of the drives would be testimonial, not merely a physical act; and (2) the explicit and implicit factual communications associated with the decryption and production are not foregone conclusions.” Opn. 21-22.
“First, the decryption and production of the hard drives would require the use of the contents of Doe’s mind and could not be fairly characterized as a physical act that would be nontestimonial in nature. We conclude that the decryption and production would be tantamount to testimony by Doe of his knowledge of the existence and location of potentially incriminating files; of his possession, control, and access to the encrypted portions of the drives; and of his capability to decrypt the files.” Opn. 22.
“We are unpersuaded by the Government’s derivation of the key/combination analogy in arguing that Doe’s production of the unencrypted files would be nothing more than a physical nontestimonial transfer. The Government attempts to avoid the analogy by arguing that it does not seek the combination or the key, but rather the contents. This argument badly misses the mark. In Fisher, where the analogy was born, and again in Hubbell, the Government never sought the “key” or the “combination” to the safe for its own sake; rather, the Government sought the files being withheld, just as the Government does here. Hubbell, 530 U.S. at 38, 120 S. Ct. at 2044 (trying to compel production of documents); Fisher v. United States, 425 U.S. at 394–95, 96 S. Ct. at 1572–73 (seeking to access contents possessed by attorneys).” Opn. 22-23.
“Requiring Doe to use a decryption password is most certainly more akin to requiring the production of a combination because both demand the use of the contents of the mind, and the production is accompanied by the implied factual statements noted above that could prove to be incriminatory. See Hubbell, 530 U.S. at 43, 120 S. Ct. at 2047. Hence, we conclude that what the Government seeks to compel in this case, the decryption and production of the contents of the hard drives, is testimonial in character.” Opn. 23.
“Moving to the second point, the question becomes whether the purported testimony was a ‘foregone conclusion.’ We think not. Nothing in the record before us reveals that the Government knew whether any files exist or the location of those files on the hard drives; what’s more, nothing in the record illustrates that the Government knew with reasonable particularity that Doe was even capable of accessing the encrypted portions of the drives…” Opn. 23.
“To be fair, the Government has shown that the combined storage space of the drives could contain files that number well into the millions. And the Government has also shown that the drives are encrypted. The Government has not shown, however, that the drives actually contain any files, nor has it shown which of the estimated twenty million files the drives are capable of holding may prove useful. The Government has emphasized at every stage of the proceedings in this case that the forensic analysis showed random characters. But random characters are not files; because the TrueCrypt program displays random characters if there are files and if there is empty space, we simply do not know what, if anything, was hidden based on the facts before us. It is not enough for the Government to argue that the encrypted drives are capable of storing vast amounts of data, some of which may be incriminating. In short, the Government physically possesses the media devices, but it does not know what, if anything, is held on the encrypted drives. Along the same lines, we are not persuaded by the suggestion that simply because the devices were encrypted necessarily means that Doe was trying to hide something. Just as a vault is capable of storing mountains of incriminating documents, that alone does not mean that it contains incriminating documents, or anything at all.” Opn. 24-25.
It seems in the Doe Case, the applicability of the Fifth Amendment turns on the question of what the government knew and how it knew it, that is, what is the contents of the Doe’s hard drive. Federal prosecutors admitted at trial that while the amount of storage encrypted exceeded 5TB, there was no way to determine what data was on the hard drive and whether there was any information at all on the hard drives. The government was forced to admit that there was no way to differentiate what might be legal or illegal material.
In closing, the Doe Case represents the first appellate court decision upholding a defendant’s right not to reveal a decryption password. Other lower court decisions were split on this issue.
As background, the Fifth Amendment provides: “No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.” U.S. Const. Amend. V.
