NACDL Fourth Amendment Center Compelled Decryption Primer, 2019
Download original document:
This text is machine-read, and may contain errors. Check the original document to verify accuracy.
Reprinted With Permission from the National Association of Criminal Defense Lawyers, 2019. To download the original PDF of this primer, please visit www.nacdl.org/fourthamendment Compelled Decryption Primer The Supreme Court recognized in Riley v. California that cell phones The majority of Americans now own several devices that are encrypted are unlike other types of physical objects. 134 S.Ct. 2473 (2014). until unlocked by a passcode or biometric mechanism. Instead, the Court held, they are minicomputers that contain the passcode can be a secret number, pattern, or alphanumeric most intimate details of life. Due to their immense storage password. Biometric locks may use a fingerprint or face scan. capacity, combined with the many distinct types of private data These they contain, the Court held that the Fourth Amendment requires unreadable until unlocked and decrypted by an authorized user. locks serve to make their A contents inaccessible and law enforcement to get a warrant to search a cell phone, even While the lawfulness of a device search is a Fourth Amendment issue, incident to arrest. the Fifth Amendment privilege against self-incrimination is the But if a device is locked or encrypted, can law enforcement compel central a suspect to unlock or decrypt it? This primer outlines the state of successfully assert this right, the act of decryption must be the law on compelled decryption and offers a guide for defense compelled, incriminating, and “testimonial.” While the first two lawyers on this important emerging issue. safeguard against compelled decryption. To requirements are often easily met, the key question is whether decryption is testimonial. Is Compelling Decryption “Testimonial”? The act of decrypting a device may be “testimonial” under the Fifth Amendment if it explicitly or implicitly conveys the fact that certain data exists or is in the possession, custody, or control of an individual. See In Re Grand Jury Subpoena Duces Tecum, 670 F.3d 1335 (11th Cir. 2012). Such an “act of production” may itself be incriminating or effectively concede the “existence, possession and control, and authenticity” of potentially incriminating evidence on a device. Id. at 1343. This analysis often hinges on the type of lock employed. Numeric or Alphanumeric Locks: Courts have generally found that compelling individuals to provide their numeric Enter Passcode or alphanumeric passcode is potentially testimonial under the Fifth Amendment, as it forces the defendant to reveal “the contents of his own mind.” In Re Grand Jury Subpoena Duces Tecum 670 F.3d at 1345; see also U.S. v. Apple MacPro Computer, 851 F.3d 238 (3d Cir. 2017). It is analogous to compelling production of the combination to a wall safe, which is testimonial, as opposed to surrendering the key to a strongbox, which is not. See Doe v. U.S., 487 U.S. 201, 220 (1988). However, even if a court finds that providing the passcode is “testimonial,” it may still fall under the “foregone conclusion” exception, which is addressed on the next page. Biometric Locks: Some courts have found nothing testimonial under the Fifth Amendment about compelling the production of biometric keys, such as a fingerprint, similar to tests that gather physical evidence. See, e.g., State v. Diamond, 905 N.W.2d 870 (Minn. 2018); Matter of Search of [Redacted] Washington, D.C., 317 F. Supp. 3d 523 (D.D.C. 2018); Commonwealth v. Baust, 89 Va. Cir. 267 (Va. Cir. Ct. 2014). Recently, however, others have begun to hold that compelling the production of a biometric key is just as testimonial as a numeric one. See Matter of Residence in Oakland, California, 354 F. Supp. 3d 1010, 1016 (N.D. Cal. 2019); In Re Application for a Search Warrant, 236 F. Supp. 3d 1066 (N.D. Ill. 2017). From this perspective, “biometric features serve the same purpose of a passcode, which is to secure the owner's content, pragmatically rendering them functionally equivalent.” 354 F. Supp. 3d at 1015. Scanning... Is it a “Foregone Conclusion”? Even if the act of decryption is potentially testimonial, it may not violate the Fifth Amendment if the implicit facts conveyed by doing so would be a “foregone conclusion” that “adds little or nothing to the sum total of the government's information.” U.S. v. Hubbell, 530 U.S. 27, 45 (2000). As a general rule, the “foregone conclusion” exception applies if the government can show it knows the location, existence, and authenticity of the purported evidence with reasonable particularity. Id. at 27. But the Supreme Court has never applied the exception beyond business documents, indicating an unwillingness to do so where more private and personal documents, like a diary, are at issue. Fisher v. U.S., 425 U.S. 391, 401 & n.7 (1976) (citing U.S. v. Bennet, 409 F.2d 888, 897 (2d Cir. 1969)). It is therefore essential to challenge whether the doctrine applies at all in the digital context. The Court has repeatedly emphasized that cell phones are not like ordinary closed containers or physical objects. See Riley, 134 S. Ct. at 2491 (“[A] cell phone search would typically expose to the government far more than the most exhaustive search of a house”); Carpenter v. U.S., 138 S.Ct. 2206, 2220 (2018) (requiring a warrant for historical cell phone location information). Indeed, the breadth and depth of private information contained in modern electronic devices simply did not exist when the Court established the foregone conclusion rule. Defense counsel should argue that it does not apply in the context of digital devices, just as the Court declined to apply the search-incident-toarrest rule in Riley and the longstanding "third-party doctrine" in Carpenter. In the alternative, the critical question is whether the government already knows of the existence and location of relevant files and can show that the client can access them. In Re Grand Jury Subpoena Duces Tecum, 670 F.3d at 1346. Lower courts are currently split on the test for deciding this question in the context of digital devices. Each of the tests is addressed below: Reasonable Particularity Test: The Eleventh Circuit has held that the Clear & Convincing Evidence Test: Some courts have rejected the foregone conclusion rule applies only if the government can show with Eleventh Circuit’s “reasonable particularity” test. In U.S. v. Spencer, “reasonable particularity” that the purported evidence exists, is in a certain for example, the court instead required “clear and convincing location, and is authentic. By contrast, the rule does not apply if the evidence” that the defendant could unlock his phone. No. 17 CR government is unable to identify specific files or data that investigators 259, 2018 WL 1964588 (N.D. Cal. Apr. 26, 2018). This test shifts the expect to find. See In Re Grand Jury Subpoena 670 F.3d at 1346; see also goalposts in a way that is exceedingly unfavorable to the defense. Apple MacPro Computer, 851 F.3d at 248-49 (applying Eleventh Circuit’s Rather than needing to show that the files exist, are on the device, test, but finding a foregone conclusion where a family member saw the and are authentic, the Spencer court requires the government to defendant navigate to child pornography on the encrypted device). This show only that an individual can unlock his own phone, a low is a high bar to meet, consistent with the high degree of constitutional bar to clear in most cases. protection that the Supreme Court has afforded to modern cell phones. Other Potential Legal Arguments Is Compelled Decryption Necessary or Appropriate? Is the Search Warrant Overbroad? When a suspect does not provide a passcode to decrypt a device, the When presented with a warrant to search a device locked by a government may invoke the All Writs Act for a court order to compel biometric key, make sure to check that the warrant describes the decryption “in aid of” a valid search warrant. See U.S. v. Apple device to be searched, files expected to be found, and specific MacPro Computer, 851 F.3d at 241-42. But, if the government has the individuals law enforcement seek to compel to provide a technical capability to decrypt the device itself, or can reasonably biometric key. In In Re Application for a Search Warrant, 236 F. acquire that ability, then an order compelling decryption is improper. Supp. 3d 1066 (N.D. Ill. 2017), the court found that the search warrant application lacked enough detailed information about As private companies develop technologies that allow the government to unlock and decrypt devices, the government should be required to disclose any methods known or reasonably available to it that could be used instead of ordering a suspect to provide a passcode for an encrypted device or compelling a company the devices to be searched, and residents of the premises to be searched. The magistrate judge found that, in this case, the use of a fingerprint to unlock a device would be testimonial because it would communicate that the individual had accessed the device before and had control over its contents. Id. at 1073; see also In to assist in the search of a device. An All Writs Act order compelling the Matter of the Search of a Residence in Oakland, California, the suspect to decrypt a device is not “necessary or appropriate” if No. 4-19-70053, 2019 WL 176937, at *3-5 (N.D. Cal. Jan. 10, 2019) the government has other viable means of getting in. (finding that the warrant's language was overbroad, and that the use of a fingerprint to unlock the device was testimonial for Fifth Amendment purposes). State Jurisdictional Challenges State courts may lack jurisdiction to issue a compelled decryption order if there is no state law granting judges such authority. While state law may authorize courts to compel the production of evidence in certain circumstances, device decryption is likely not one of them, indicating that the legislature did not intend to vest courts with this power. Federal courts have the general authority to compel the production of evidence “in aid of their respective jurisdictions” under the All Writs Act, 28 U.S.C.A. § 1651, but similar provisions may not exist in state law. Consequently, any decryption order issued by a state court may be vulnerable to jurisdictional challenges as well as constitutional ones. Border Searches If an individual is entering the United States, the government’s stated interest in national security at the border will often outweigh an individual’s privacy rights. For more information on how your constitutional rights may be interpreted during a border search, please see NACDL’s primer “Protecting Your Digital Devices at the Border,” available at: https://www.nacdl.org/bordersearches. Case List Compelling A Passcode Is Testimonial: • In Re Grand Jury Subpoena Duces Tecum, 670 F.3d 1335 (11th Cir. 2012). • Passcode Is Testimonial, But The Foregone Conclusion Applies: • Seo v. State, 109 N.E.3d 418 (Ind. Ct. App.), transfer granted, opinion vacated, 119 • N.E.3d 90 (Ind. 2018). • U.S. v Kirschner, 823 F. Supp. 2d 665 (E.D. • Mich. 2010). • G.A.Q.L. v. State, 257 So.3d 1058 (Fla. Dist. • Ct. App. Oct. 24, 2018). • SEC v. Bonan Huang, 2015 WL 5611644 (E.D. Pa. 2015). Compelling Biometric Decryption Is Testimonial: • • In Re Application for a Search Warrant, 236 F. Supp. 3d 1066 (N.D. Ill. 2017). Matter of Residence in Oakland, California, 354 F. Supp. 3d 1010 (N.D. Cal. 2019). Biometric Decryption Is Not Testimonial: • State v. Diamond, 905 N.W.2d 870 • (Minn. 2018). Matter of Search of [Redacted] Washington, D.C., 317 F. Supp. 3d 523 (D.D.C. 2018). • • U.S. v. Spencer, No. 17-cr-00259-CRB-1, 2018 WL 1964588 (N.D. Cal. April 26, 2018). Commonwealth v. Baust, 89 Va. Cir. 267 (Va. Cir. Ct. 2014). Commonwealth v. Jones, 481 Mass. 540 (2019). U.S. v. Friscosu, 841 F. Supp. 2d 1232 (D. Colo. 2012). State v. Stahl, 206 So. 3d 124 (Fla. Dist. Ct. App. 2016). U.S. v. Apple MacPro Computer, 851 F.3d 238 (3d Cir. 2017). Fifth Amendment Privilege Against Self-Incrimination Generally: • • • • • • U.S. v. Hubbell, 530 U.S. 27 (2000). Fisher v. U.S., 425 U.S. 391 (1976). U.S. v. Doe, 465 U.S. 605 (1984). Hoffman v. U.S., 341 U.S. 479 (1951). Doe v. U.S., 487 U.S. 201, 220 (1988). Additional Resources Stephanie the Digital Password Electronic 2017. • Aloni Cohen and Sunoo Park, Compelled Decryption and the Fifth Amendment: Exploring the Technical Boundaries, 32 HARV. J.L. & TECH. 169 (2018). • Efren Lemus, When Fingerprints Are Key: Reinstating Privacy to the Privilege Against Self-Incrimination in Light of Fingerprint Encryption in Smartphones, 70 SMU L. REV. 533 (2017). • Laurent Sacharoff, Unlocking the Fifth Amendment: Passwords and Encrypted Devices, 87 FORDHAM L. REV. 203 (2018). • Jason Wareham, Cracking the Code: The Enigma of the Self-Incrimination Clause and Compulsory Decryption of Encrypted Media, 1 GEO. L. TECH. REV. 247 (2017). • Hanni Fakhoury, A Combination or a Key? The Fifth Amendment and Privilege Against Compelled Decryption, 9 DIGITAL EVIDENCE & ELECTRONIC SIGNATURE L. REV. 81 (2012). U.S. v. Patane, 542 U.S. 630 (2004). Other: • • U.S. v. Djibo, 151 F. Supp. 3d 297 (E.D. N.Y. 2015) (passcode suppressed as an un-Mirandized statement). U.S. v. Gavegnano, 305 Fed. App'x. 954 (4th Cir. 2009) (no expectation of privacy in a gov't-issued computer). Lacambra, Defending Against Dragnet: Fighting Compelled Disclosure and Decryption, Frontier Foundation, Oct. 31, • For litigation assistance and other resources, contact 4AC@nacdl.org