COMPELLED DECRYPTION AND THE FIFTH AMENDMENT: EXPLORING THE TECHNICAL BOUNDARIES.

• Author: Cohen, Aloni

TABLE OF CONTENTS I. INTRODUCTION 170 II. BRIEF BACKGROUND ON ENCRYPTION 176 III. THE FIFTH AMENDMENT AND THE NATURE OF TESTIMONY 179 A. The Nature of Testimony 180 B. Act-of-Production Testimony 181 IV. ENCRYPTION AND SELF-INCRIMINATION: REVIEW OF CASES 184 A. Reveal-the-Password Cases 185 B. Produce-the-Decrypted-Contents Cases 187 C. Enter-the-Password Cases 191 D. Enter-the-Password Versus Produce-the-Decrypted-Contents 192 E. Use-a-Fingerprint Cases 194 F. Overlapping Categories 196 V. TECHNOLOGICAL HYPOTHETICALS 198 A. Random Data May Just Be Random Data 199 B. Authenticity and Deniable Encryption 201 C. Data Persistence and Kill Switches 205 D. Testimonial Aspects of Biometric-Based Encryption 208 1. Choosing Between Multiple Possible Biometrics 209 2. Location-Based Decryption 209 3. Situation-Dependent Decryption 210 4. Voice Recognition for Commands 210 E. Possession of Encrypted Data Without the Ability To Decrypt 211 F. Keystroke Logging Revealing the Contents of the Mind 212 G. Decryption and the Use of the Contents of the Mind 215 VI. REFLECTIONS 217 A. The Importance of Detailed Protocols 218 B. On Applying Fisher to Compelled Decryption 219 C. Alternative Doctrinal Proposals and a Critique of Their Technological Robustness 222 VII. ON EXISTENCE 224 A. Physical and Conceptual Existence 226 B. Existence and the Fifth Amendment 228 C. Existence and Encryption 228 D. Information-Theoretic Encryption 230 VIII. CONCLUSION 232 I. INTRODUCTION

More than seventy five percent of Americans own smartphones today, and that percentage has more than doubled in the last seven years. (1) Passcode- and fingerprint-based encryption are common measures to shield one's device data from prying eyes, whether on a smartphone or on other popular devices such as tablets and laptops. An average user will likely face a short menu of choices during device setup, which offers to protect their phone with a passcode, or with a fingerprint, or not at all. (2) Among the encryption options available, many users may make their choice based largely on convenience, little surmising their decisions' potential implications on their legal rights.

However, the legal ramifications of this choice are significant: in many cases, courts have held that the government may compel finger-print-based device unlocking in the course of a criminal investigation, but whether the government may compel password-based unlocking has been more dependent on the specific circumstances of the case. (3) A legally significant distinction is that unlocking a phone with a fingerprint is a physical, rather than a mental, act. (4)

The extent of an individual's protection against government access to her encrypted data has become rapidly more relevant of late--to both device users and governmental authorities--with the increasing use not only of devices that store large amounts of data, but also of encryption of data stored on and communicated between devices. (5) Over the last decade, digital information storage and encryption have become far more common, and in many settings, ubiquitous. Encryption of digital data has gone from being used only by the technically expert to secure especially sensitive information, to being used routinely (and often, unwittingly) by ordinary people to protect the contents of their computers, tablets, communications, and--especially--smartphones. (6) Naturally, in the course of these developments, encrypted digital information has become an item of increasingly frequent interest to law enforcement during investigations. (7)

The use of encryption has been portrayed by governmental authorities as particularly problematic for law enforcement because, depending on the encryption method used, it may be infeasible for law enforcement to obtain desired data pursuant to a warrant or other authorization, even when its agents have access to an encrypted version of that data--whether a digital copy of an encrypted file or physical possession of a device on which encrypted data is stored. (8) In the context of more traditional physical measures such as safes and bank vaults, the government has the capability, at least in principle, to break in by force in the case of non-compliance by the safe owner (provided that the government knows of the safe's existence and location). In contrast, a "brute force" approach to decryption would, if the encryption were configured appropriately, take far longer than a human lifetime, even using the best technology available today. (9)

The issue of encryption was brought rather dramatically into the public limelight in early 2016, when the FBI sought to access the encrypted phone of one of the culprits of the December 2015 San Bernardino shooting, who was killed during the attack. (10) In order to retrieve the contents of the phone, the FBI wanted Apple to create or to enable installation of bespoke software to circumvent the security protections built into all of its iPhones. (11) Central to the publicity around that case were the government's stirring motive of investigating the nation's deadliest mass shooting in three years and Apple's impassioned public rebuttal of what it argued was a demand too sweeping to be compatible with responsible security practices and individual privacy rights. (12)

The FBI-Apple conflict has, for better or for worse, become a cornerstone of the public's familiarity with the debate over government access to encrypted data. This Article examines a legally very different scenario, in which the owner of some data, rather than the device manufacturer, is the target of government compulsion.

The focus of this Article is compelled decryption: the decryption of--or provision of the means to decrypt--encrypted data by a person having control thereof, in response to a governmental demand pursuant to a criminal investigation. Specifically, this Article examines the Fifth Amendment protection against compelled self-incrimination, as it applies to governmental orders compelling a target of an investigation to assist in the decryption of specific encrypted data. (13)

Unlike prior work, this Article presents a wide variety of technological variations that could further complicate the compelled decryption doctrine. Each technology presented in the Article challenges a different facet of the doctrine, highlighting the sometimes fragile technological assumptions that courts have made. The type of anticipatory approach to technological changes that this Article takes--including preemptive consideration of the implications that plausible technological variations would have on case analyses--is essential in order to develop robust doctrine that will remain unequivocal and relevant over time. While technical considerations contribute only so much to a real case's eventual outcome, a nuanced understanding of the interplay between technology and legal doctrine is integral to arriving at robust decisions going forward.

This Article begins by establishing the relevant technical and legal foundations. It starts with a brief overview of encryption in Part II, and then describes the relevant legal doctrine including act-of-production testimony and the related foregone conclusion analysis in Part III.

Part IV reviews the patchwork of court decisions regarding compelled decryption, and presents the cases according to a new taxonomy that identifies four archetypal categories that depend on the nature of the compelled act. In "reveal-the-password cases," the target must reveal a password. In "use-a-fingerprint cases," the target must use a fingerprint (e.g., by placing it on a device). In "enter-the-password cases," the target must enter the password into a device. Finally, in "produce-the-decrypted-contents cases," the target must furnish some data in unencrypted form. Each of these types of compelled act aims ultimately to gain the government access to data it seeks, in unencrypted form.

The circumstances under which decryption can be compelled have been broached by various courts as cases have arisen, but the precedent to date does not give rise to a consistent unified theory, and legal scholars are not in agreement about how these cases should be decided. To better focus on technological aspects of compelled decryption, this Article presents the authors' view of the evolving doctrine and omits much of the ongoing legal debate.

Part V turns from the factual variations of past cases and examines a number of technological variations that may, in principle or in practice, present themselves in the future. This Part explains a number of technologies and discusses their interaction with the compelled decryption doctrine. Part V is both technical and legal, concerning both the limits of technology and the foregone conclusion doctrine.

Part VI reflects on the compelled decryption doctrine and the collection of technological variations taken as a whole. Together, they suggest that while the doctrine sometimes turns on non-obvious technological details in surprising ways, with careful consideration of both technology and precedent it can be applied in a consistent manner. Consistency is but one requirement of a desirable doctrine, and is necessary, but not sufficient, to support coherence or desirability in a normative sense. By focusing on consistency, the Article's analysis establishes a baseline and leaves open a number of questions about the desirability of the compelled decryption doctrine more broadly.

Part VII discusses existence, a concept central to the foregone conclusion doctrine as applied to compelled decryption cases to date. The nature of existence of digital data is meaningfully different from the nature of existence of a physical document or object, and this distinction becomes even more nuanced when encryption is involved. The goal of Part VII is to provide a precise but accessible description of encryption technology as it relates to the notion of existence, and it may also serve...