In Defense of Encryption: the Conflict Between Law Enforcement and the First Amendment Right to Secure Communications

• Jurisdiction: United States,Federal
• Citation: Vol. 16 No. 3
• Publication year: 2016
• Author: by Molly Ruiz
• topic: Constitutional Law,Criminal Law,Technology

IN DEFENSE OF ENCRYPTION: THE CONFLICT BETWEEN LAW ENFORCEMENT AND THE FIRST AMENDMENT RIGHT TO SECURE COMMUNICATIONS

by Molly Ruiz^*

I. INTRODUCTION

Over the past two decades, the Internet has transformed from a novelty to a modern-world necessity, producing technological innovation to digitize almost every aspect of human life. As of 2015, nearly two-thirds of Americans owned smartphones,¹ utilizing a range of messaging services, from applications enabling quick connection with family and friends to platforms securing content with multiple layers of encryption. Unfortunately, while developers churn out new products as fast as they can be conceived, legislators and policymakers operate at a much slower pace.

Consequently, current statutes enacted more than ten years ago to regulate the privacy, use, and accessibility of digital communications cannot possibly address the realities of the modern technological landscape. This disparity between legislation and technology has received particular attention with respect to encryption. Following recent brutal acts of violence and terrorism, both in the United States and globally, law enforcement has investigated whether perpetrators used encryption to evade detection. The extent to which encryption should be regulated to facilitate law enforcement access to coded communications has been hotly contested, but the national discourse has largely focused on policy and legislation, with little attention to the role of the judicial system. This missing dimension—the constitutionality of regulating encryption—is examined in this paper.

Two conflicting cases involving Apple, Inc. are now drawing attention to the extent to which the Constitution protects secure digital communications. In New York, a federal judge refused to order Apple to bypass the lock screen of a phone seized in a drug possession case.² By contrast, a California federal magistrate has ordered Apple to disable a feature that automatically erases content, after a certain number of incorrect passcode entries, on an iPhone used by San Bernardino shooter Syed Farook.³ Apple CEO Tim Cook responded with an open letter to Apple's customers opposing the court's order as a threat to digital security.⁴ Both cases delineate a sharp conflict between law enforcement and the technology industry, and have set the stage for an appellate court to review whether regulating encrypted private communications is constitutional.

This paper applies First Amendment jurisprudence to conclude that government interference with encryption is unconstitutional. The Background section explains the technology and controlling statutes at issue and frames the conflicting positions by examining the New York case in more detail. The Argument section then applies traditional First Amendment analysis to conclude that government-mandated access to encrypted content is an invalid time, place, and manner restriction on secure communication.

II. BACKGROUND: THE PROBLEM OF "GOING DARK"

A basic understanding of the technology at issue is key to examining both sides of the encryption regulation debate. Encryption is a method of coding communications with a mathematical algorithm so that only the intended recipient can read the message.⁵ Interception of an encrypted message by someone who does not hold the decryption "key" reveals only a scrambled, nonsensical jumble of characters.⁶ Certain forms of encryption protect communications and entire devices from review, even by the communications server or device manufacturer. In particular, "end-to-end encryption" uses decryption keys that are only available to the sender and recipient,⁷ and "device" or "full-disk" encryption locks an entire device with a user-controlled passcode.⁸

End-to-end encryption and device encryption safeguard the content of private communications from interception both by cybercriminals and government surveillance. Consequently, law enforcement cannot demand content from a server or manufacturer with a traditional search warrant, since only the consumer has the decryption keys. Concern about law enforcement's ability to collect evidence against suspects using encryption intensified in 2014, when Apple launched a new operating system with default device encryption secured by a passcode known only to the phone's user.⁹ With the launch, Apple expressly rejected building a "backdoor" into the iPhone's encryption system.¹⁰ "Backdoor" refers to designing a vulnerability into encryption software so that encrypted content can be accessed without the user's knowledge.¹¹ Although advocated for use by law enforcement to conduct targeted surveillance, backdoors have been rejected by industry leaders due to the potential entry points they provide for cybercriminals to intercept all user communications.

[Page 12]

In response to the technology industry's increasing adoption of encryption and disapproval of backdoors, FBI Director James Comey has argued that law enforcement is facing the threat of "going dark." During a 2014 speech, Comey described "going dark" as the situation in which law enforcement has the legal authority to seize evidence, but lacks the technical ability to read encrypted communications.¹² While an existing statute, the Communications Assistance for Law Enforcement Act (CALEA),¹³ requires telecommunications carriers to build in backdoor capabilities enabling wiretaps of digital telephone calls,¹⁴ CALEA has never been interpreted to apply to instant messaging and email.¹⁵

According to Comey, CALEA's narrow application enables default encryption services while preventing law enforcement from executing valid search warrants to access evidence that could help apprehend criminals and prevent future terrorist activity.¹⁶ Comey noted that critical evidence is commonly stored on cellphones and computers, since criminals use the same devices the law-abiding public does and terrorists are known to use popular social networking sites to communicate and seek recruits.¹⁷ When layers of encryption prevent even the server from examining user communications, the threat of "going dark" substantially interferes with law enforcement's investigative capabilities to the point of compromising national security and public safety.¹⁸

This division between law enforcement and technology companies regarding encryption regulation has prompted a flurry of legislative activity. On one side, several senators have voiced support for requiring backdoor access to the content of encrypted communications,¹⁹ and California²⁰ and New York²¹ have both introduced proposals requiring smartphone manufacturers to provide decryption capabilities. A more neutral federal bipartisan bill has been proposed that would create a commission of representatives from the technology industry, academia, and law enforcement to discuss government and private sector interests.²² On the other side of the debate, federal legislation has been proposed that would prevent states and municipalities from requiring manufacturers to build backdoors.²³

The New York case against Apple adds a judicial dimension to the tension regarding law enforcement's entitlement to secure communications in the New York case. In this case, Apple refused to comply with a government request to bypass the lock screen of an iPhone obtained pursuant to a search warrant, even though the particular phone ran an older operating system that Apple could technically bypass (unlike devices running Apple's current operating system).²⁴

The government petitioned the court for an order requiring Apple to unlock the phone under the All Writs Act (AWA),²⁵ originally passed in 1789, which empowers federal courts to compel a particular form of relief that is not available by statute, so long as it is not unduly burdensome.²⁶ The court noted that in light of CALEA's limited scope and repeated (but failed) attempts in Congress to amend CALEA to apply to electronic communications platforms, the AWA might not apply.²⁷

The court ordered further briefing from Apple examining the burden of complying with the government's search warrant.²⁸ Apple's supplemental brief explained that although Apple could technically unlock the particular phone at issue, compliance with future requests to unlock phones running iOS 8 or higher would be impossible.²⁹ Beyond technical feasibility, public sentiment regarding digital privacy and security had positioned Apple as a leader in protecting consumer data, implicating economic in addition to physical burdens should Apple be forced to breach public trust by breaking the security of its own software.³⁰ On February 29, 2016, the court denied the government's motion, finding that relief under the AWA is "unavailable because Congress has considered legislation that would achieve the same result but has not adopted it."³¹ In addition to other discretionary factors, the court noted that Apple's refusal to provide technical support did not "thwart" the government's investigation in such a way as to justify compelled assistance.³²

The arguments raised by the technology industry, law enforcement, legislators, and litigants—whether in favor of or in opposition to regulating encryption— illuminate a new dimension of criminal law analysis. Whereas traditional issues of criminal procedure have largely focused on the constitutionality of a particular type of investigative procedure—when suspects may be arrested and how they should be treated in custody, for example—access to encrypted content raises the issue not of how law enforcement can seek information, but whether it is constitutionally entitled to certain private communications at the risk of exposing all user communications to interception. In answering this question, the remainder of this paper applies First Amendment jurisprudence to the conflicting positions of the technology industry and law enforcement to conclude that requiring decryption capabilities would constitute an invalid regulation of the time, place, and manner...