Federal Magistrate Rules That Fifth Amendment Applies To Encryption Keys 322
Virtucon writes "U.S. Magistrate William Callahan Jr. of Wisconsin has ruled in favor of the accused in that he should not have to decrypt his storage device. The U.S. Government had sought to compel Feldman to provide his password to obtain access to the data. Presumably the FBI has had no success in getting the data and had sought to have the judge compel Feldman to provide the decrypted contents of what they had seized. The Judge ruled (PDF): 'This is a close call, but I conclude that Feldman's act of production, which would necessarily require his using a password of some type to decrypt the storage device, would be
tantamount to telling the government something it does not already know with "reasonably particularity" — namely, that Feldman has personal access to and control over the encrypted storage devices. Accordingly, in my opinion, Fifth Amendment protection is available to Feldman. Stated another way, ordering Feldman to decrypt the storage devices would be in violation of his Fifth Amendment right against compelled self-incrimination.'"
If the government has reasonable suspicion that you have illicit data, they can still compel you to decrypt it.
Re:Last Sentence (Score:5, Informative)
This is a close call, but I conclude that Feldman's act of production, which would necessarily require his using a password of some type to decrypt the storage device, would be tantamount to telling the government something it does not already know with "reasonably particularity"
I'm guessing this is the trick. The government doesn't know there is evidence on the storage device. It sounds like they are making the argument that compelling a password for discovery purposes is a violation, but providing one to give them what they know you have is not. At least, that's what it seems like they are saying to me.
Re:Last Sentence (Score:5, Informative)
It came from the linked article that references a rejected appeal in a bank fraud case concerning turning over an encryption key.
Re:Last Sentence (Score:5, Informative)
It's a wink-wink that they have to add "possession of child pornography" to the charges also in order to compel the keys.
It has to do with foregone knowledge (Score:5, Informative)
It's a subtle point described in the judges decision.
If the government has knowledge of particular documents, they can force you to present them. This includes forcing you to open your safe or decrypting your hard drive.
If the government has no knowledge of the contents of the hard drive, no information from other sources that indicate that you have specific documents it wants, then it can't force you to decrypt your hard drive.
The judge's position was that since the government had no indication of whatever documents are on the hard drive, producing them tied the defendant to the documents - providing evidence of control and ownership. Since that evidence (control and ownership) was not available to the government beforehand, it would be compelled testimony.
I think this is also reasonable in light of the fourth amendment. If the government doesn't have knowledge of specific documents, it can't go "rummaging around" on your disk looking for things.
Comment removed (Score:5, Informative)
Re:Mountain out of a molehill (Score:5, Informative)
Re:Last Sentence (Score:5, Informative)
Not quite right.
The government is asking for information which would demonstrate that he had the capability to access the information in a device. Such an admission would be useful to the prosecution which must account for the custodial chain of the device and the data within it.
An example of a situation where you might require this sort of defense:
1. You buy a computer from Bob on Craigslist. You stick it in your garage to work on later.
2. Bob is busted for something, and when questioned about the computer, says he sold it to you.
3. The police arrive at your house, and with a warrant seize the computer from your garage.
4. It turns out that 'Bob' was selling CP or something similarly illegal. The prosecutor decides that YOU purchased the computer/HDD as part of a purchase of CP from Bob.
5. You claim that you have no idea what is on the machine, and the prosecutor demands that you provide the encryption key to decrypt the files for search.
At this point, if you were to provide the encryption keys, it would demonstrate that you DID have the ability to access the files on the computer, this would be providing evidence to the prosecution that you were part of the chain of custody.
In the case where the person WAS compelled to turn over the encryption key, the prosecution already had evidence that the person already could access the encrypted device/file. Therefore, by turning over the encryption key, the person was not providing any evidence that the prosecution did not already have.
So if in the example I provide above, you had made a statement that "Hey, Bob sold me a computer, and you wouldn't believe the nasty stuff he had on it in an encrypted file." That would mean that you could not plead the 5th as it would already be a fact that you could access the encrypted file, so providing the keys wouldn't be giving any evidence to the prosecution.
Re:Last Sentence (Score:5, Informative)
We have to pass the bill to know what's in it...
The argument I've heard is that, when information is at rest, it's not considered testimony for the information to be read (but some other form of discovery). Therefore if it can be shown that you're in a position to decrypt the drive, and the drive is admitted in discovery and you refuse to facilitate discovery, you are standing in the way of the discovery and can be held in contempt of court.
If it has not been shown that the drive can be decrypted with information you have, or could reasonably be expected to have (say, it can be shown by inductive reasoning that the drive contains the log of your activities), or if for example the ownership of the keys or the drive and the encrypted data is in question, it's not reasonable to compel you to decrypt it under penalty of contempt. It hasn't even been shown that it's in your power to facilitate the discovery.
You can be similarly compelled to provide paper documentation, even if it was sent through the mail. It's not testimony. It's facilitating (or obstructing) discovery.
Re:Last Sentence (Score:5, Informative)
Basically, it is a crime to withhold evidence that the government knows you have. But you can't be compelled to provide evidence against yourself that the government doesn't know you have.
Re:Last Sentence (Score:5, Informative)
"The argument I've heard is that, when information is at rest, it's not considered testimony for the information to be read (but some other form of discovery). Therefore if it can be shown that you're in a position to decrypt the drive, and the drive is admitted in discovery and you refuse to facilitate discovery, you are standing in the way of the discovery and can be held in contempt of court."
If it has not been shown that the drive can be decrypted with information you have, or could reasonably be expected to have (say, it can be shown by inductive reasoning that the drive contains the log of your activities), or if for example the ownership of the keys or the drive and the encrypted data is in question, it's not reasonable to compel you to decrypt it under penalty of contempt. It hasn't even been shown that it's in your power to facilitate the discovery.
You can be similarly compelled to provide paper documentation, even if it was sent through the mail. It's not testimony. It's facilitating (or obstructing) discovery.
This is COMPLETELY off the mark. Here's how it actually works. (I should add that there have been several other cases about this point recently, and none of them ruled that it was "a close call", as this judge seems to think.)
If the government does not know that there is illegal material, or evidence of illegality, in the encrypted material, it cannot compel you to give up the password because that would be testifying against yourself.
There are a couple of essential points here: first, it has to be "a product of your mind". Something you know. Not some kind of item that they know exists. For example, in many circumstances you can be compelled to turn over a key to a locked door, because a key is not testimony. (Other matters surrounding a search of a locked room are beyond the scope of this post.)
The second essential point is that the government has to KNOW there is something illegal in the encrypted data in order to compel you to give them the password. Not "reasonable suspicion" as OP states. It has to be known beyond reasonable doubt. Because -- and this is the big point -- if they already know it's there, then you aren't incriminating yourself... you have already been "incriminated". You aren't admitting to anything because the illegal material is already known to exist. So, since you can't be said to be incriminating yourself, they can compel you to give up the password.
So let me give you some examples from other recent court cases like this one:
Someone was suspected of fraud but the evidence was all encrypted. The government could not prove the fraud without that evidence, which they had good reason to believe ("reasonable suspicion" as OP described it) that the evidence was in that encrypted data. But because of that, the government could not compel the defendant to give them the password, because there was a real danger he would be incriminating himself, which the 5th Amendment says you can't compel.
In another case, a man was crossing the border with a laptop. At the time, customs was allowed to search at will. (A Federal court recently ruled that government needs probable cause to search even at borders. But at the time, it was considered kosher.)
The man's laptop was turned on but asleep. His encryption software was running, so an encrypted volume on his hard drive could be accessed. 2 customs agents saw child pornography in the encrypted part of the drive, before the man somehow managed to turn the computer off. When it was turned back on, of course the encrypted data was no longer accessible.
In this case, it was ruled that the government could compel him to produce the password, because the government already knew there was illegal material there. He could not be said to be incriminating himself, because they already knew it was illegal. The testimony of 2 customs agent was acceptable "k
Re:Last Sentence (Score:4, Informative)
They can, however, use it as probable cause to get a second warrant to collect the new evidence. If police bust into your house with a warrant to search the kitchen for marijuana, and notice you have polaroids of a recent unsolved murder victim taped to the fridge, then they don't have to say "oops, we didn't see that." They can't take the photos or go rooting around the house for other evidence related to the murder on the existing warrant, but they can go back to a judge and request a new warrant (based on probable cause from testimony about seeing the photos) with different scope.
In the article's court case, the defendant was allowed to refuse to disclose a password not because the contents of the drive could be incriminating, but because disclosing the password itself reveals previously unknown information: that you know the password. If the court already considers it a proven fact that you know a password, and has a warrant for searching the drive, then you don't get 5th-ammendment protection against revealing the password, no matter what incriminating stuff could be on the drive. The 5th Amendment is typically interpreted to only cover the "contents of your head": you can't be required to provide potentially self-incriminating info about were on the night of November 3rd from the contents of your memory. Your appointments calendar in your desk safe, however, is not 5th-ammendment protected, so you might be required to hand over that combination.
Re:Last Sentence (Score:3, Informative)
In the USA at least, if the police have a legal reason to enter your home, (even including you allowing them in through the front door for any reason), they can then seize anything they can see that is also known to be illegal from any vantage point they have that is legal. Standing outside your window and looking in is not a legal vantage point, but you opening the front door would create one at the entryway just as the warrant makes your entire kitchen one. If they respond to a noise complaint, which doesn't even require a warrant, then see a bag of weed on the table when you open the door, they absolutely can enter your home, seize the drugs and arrest you. Its called Plain View Doctrine and its irrelevant to the warrant in as far as the photo in your post is concerned. It definitely could result in a more inclusive warrant being issued to search for more evidence concerning the murder, but that still wouldn't negate the fact that the original warrant would allow them to seize the photo on the fridge, a gun with the serial number filed off or anything else illegal that is in plain view, or in any place they expected to find the marijuana they came for in your kitchen.
Re:Last Sentence (Score:4, Informative)
I was careful in my example with a photo, because a photo isn't something illegal. Maybe you were hanging out with the victim before they got killed by someone else? A bag of weed or a gun with the serial filed off are indeed illegal things, that the cops can seize "from plain view." A photo is (usually) a perfectly legal thing, that police probably can't seize without a specific warrant. However, they've likely got probable cause to detain you on the spot and assure you can't destroy the photos/evidence while they're requesting a new warrant.