Password protection and self-incrimination: applying the Fifth Amendment privilege in the technological era.

AuthorWinkler, Andrew T.
  1. INTRODUCTION II. THE FIFTH AMENDMENT'S SELF-INCRIMINATION CLAUSE, THE ACT OF PRODUCTION DOCTRINE, AND THE FOREGONE CONCLUSION DOCTRINE III. REVIEWING THE SMALL UNIVERSE OF TECHNOLOGICAL CASES A. TESTIFYING ABOUT PASSWORDS 1. UNITED STATES V. KIRSCHNER B. ENTERING PASSWORDS 1. IN RE GRAND JURY SUBPOENA TO SEBASTIEN BOUCHER 2. UNITED STATES V. FRICOSU 3. IN RE GRAND JURY SUBPOENA DUCES TECUM DATED MARCH 25,2011 (UNITED STATES V. DOE) IV. PASSWORDS AND DECRYPTION: REVEALING THE CONTENTS OF ONE'S MIND A. THE ACT OF DECRYPTION IS A TESTIMONIAL COMMUNICATION B. THE FOREGONE CONCLUSION DOCTRINE DOES NOT APPLY TO THE PRODCUTION OF NON-PHYSICAL EVIDENCE C. LIMITED ACT-OF-PRODUCTION IMMUNITY IS INSUFFICIENT TO PROTECT AGAINST SELF-INCRIMINATION V. CONCLUSION I. INTRODUCTION

    A computer is the technological equivalent of a safe, protecting undisclosed documents that the owner wishes to remain private. Computer privacy is neither new nor unique. This article was written on a password protected laptop computer. Computer passwords, like safe combinations, protect the private contents contained therein; including potentially incriminating content. When the government compels an individual to provide the contents of his or her computer, either by testifying to the password or entering the password itself, does the Constitution provide any level of protection?

    This article contends that the Fifth Amendment's privilege against self-incrimination protects an individual from being compelled to enter a computer password, or otherwise decrypt the contents of a computer. The government may still require the defendant to enter a computer password, but only if the defendant is granted both use and derivative-use immunity.

    Part II of this article provides a brief overview of the Self-Incrimination Clause, as well as two related legal doctrines that often come into play when courts examine the Self-Incrimination Clause. The first being the act-of-production doctrine, which serves to protect a defendant's production of incriminating evidence that implies statements of fact; the other being the foregone conclusion doctrine, which provides that where the location, existence, and authenticity of the purported evidence is already known to the government, the contents of the individual's mind are not used against him, and the privilege does not apply.

    Part III analyzes the relatively small number of cases that address computer passwords and the Fifth Amendment. First, this section addresses whether the privilege against self-incrimination applies when a defendant is compelled to testify about his password. This section then reviews three cases in which a defendant is compelled to enter a password, or otherwise decrypt a computer's contents.

    Part IV of this article contends that the act of decryption is a testimonial communication deserving the full protections guaranteed by the Fifth Amendment. Much like entering a combination into a wall safe, entering a password into a computer necessarily reveals the contents of the defendant's mind. And while the voluntarily provided contents of the computer may not receive protection, the foregone conclusion doctrine does not apply to the production of non-physical evidence existing only in the mind of the defendant. This section concludes that the only way around the privilege against self-incrimination is to provide the defendant with both use and derivative-use immunity.

    The Constitution must keep pace with society's interest in keeping computer contents private. While our Founding Fathers could not have contemplated the existence of computers while drafting the Constitution, they surely envisioned the importance of protecting individuals from government compelled production of incriminating evidence.

  2. THE FIFTH AMENDMENT'S SELF-INCRIMINATION CLAUSE, THE ACT-OF-PRODUCTION DOCTRINE, AND THE FOREGONE CONCLUSION DOCTRINE

    The Self-Incrimination Clause of the Fifth Amendment guarantees that "[n]o person ... shall be compelled in any criminal case to be a witness against himself[.]" (1) However, this privilege "does not independently proscribe the compelled production of every sort of incriminating evidence." (2) Rather, "the privilege protects a person only against being incriminated by his own compelled testimonial communications." (3) If the communication is not testimonial, it is not protected. For example, documents voluntarily prepared by the defendant are not testimonial. (4) Thus, for the privilege to apply, the communication must be compelled, incriminating in nature, and testimonial. (5)

    In Fisher v. United States, the U.S. Supreme Court extended the reach of the Fifth Amendment privilege to situations where a defendant is compelled to produce incriminating evidence. (6) This is often referred to as the act-of-production doctrine. Furthermore, the Court has held that the act of producing even unprivileged evidence can have communicative aspects itself and may be testimonial, entitling it to Fifth Amendment protection. (7) For an act of production to be testimonial, it must implicitly convey statements of fact, such as admitting that evidence exists, is authentic, or is within a suspect's control. (8)

    However, where the location, existence, and authenticity of the purported evidence is known to the government, and the contents of the individual's mind are not used against him, no Fifth Amendment protection is available. (9) This is referred to as the "foregone conclusion" doctrine. (10) The foregone conclusion doctrine has been typically applied to the production of physical documents. (11)

  3. REVIEWING THE SMALL UNIVERSE OF TECHNOLOGICAL CASES

    The following section surveys the relatively small number of cases addressing the disclosure of computer passwords and the Fifth Amendment implications. This section begins by examining a case where a defendant is compelled to testify about his computer password. This section then reviews three cases in which a defendant is compelled to either enter a password or otherwise provide access to a computer's encrypted contents.

    1. TESTIFYING ABOUT PASSWORDS

      1. United States v. Kirschner (12)

      On March 30, 2010, the United States District Court for the Eastern District of Michigan held that the Fifth Amendment protects a defendant from testifying about his computer password before a grand jury. (13) In United States v. Kirschner, the government issued a subpoena compelling the defendant "to provide all passwords used or associated with the ... computer ... and any files." (14) The purpose of the subpoena was to secure evidence of child pornography allegedly contained in encrypted files on the defendant's computer. (15) The defendant, asserting his Fifth Amendment privilege against self-incrimination, moved to quash the subpoena. (16)

      The Kirschner court was deciding whether requiring the defendant to testify about the password was a testimonial communication. (17) The court began its inquiry by reviewing relevant Supreme Court precedent, which has held that "[a]n act is testimonial when the accused if forced to reveal his knowledge of facts relating him to the offense or from having to share his thoughts and beliefs with the government." (18) Quoting the Supreme Court's decision in Doe II, the court wrote that "it is the 'extortion of information from the accused,' the attempt to force him to 'disclose the contents of his own mind' that implicates the Self-Incrimination Clause." (19) Unlike a handwriting sample or a voice exemplar, a subpoena requiring the defendant to reveal the computer password communicates "knowledge." (20) By referencing Justice Stevens' wall safe analogy, (21) the court concluded that the Self-Incrimination Clause protected the defendant from divulging, through his mental processes, his computer password. (22)

    2. ENTERING PASSWORDS

      1. In re Grand Jury Subpoena to Sebastien Boucher (23),

        On December 17, 2006, Sebastien Boucher and his father were crossing the Canadian border into Vermont when they were stopped by customs officials. (24) At a secondary inspection, a customs agent found a laptop computer in the back seat of the car. (25) Without using a password, the agent gained access to approximately 40,000 images. (26) During this initial investigation, the agent noticed several file names that referenced child pornography. (27) An Immigration and Customs Enforcement special agent with experience in recognizing child pornography was then called to continue the investigation. (28) The special agent subsequently discovered "thousands of images of adult pornography and animation depicting adult and child pornography," including one file named "2yo getting raped during diaper change." (29)

        After being read his Miranda rights, Boucher acquiesced to the agent's request to view the location of the downloaded pornographic material; the agent did not observe Boucher enter a password while accessing files maintained on a location designated as "drive Z." (30) Boucher was then asked to leave the room while the agent continued to examine drive Z. (31) Once the agent found several images and videos of child pornography, the laptop was shutdown and seized, and Boucher was arrested. (32)

        Although able to create a mirror image of the laptop's contents, the government has been unable to view the images and videos on drive Z because of an encryption algorithm, which requires a password to obtain access to its files. (33) Despite the government's best efforts in decryption, it could take years to unlock the laptop's contents. (34) In fact, a computer forensics expert from the Secret Service "testified that it is nearly impossible to access these encrypted files without knowing the password." (35)

        In order to gain access to drive Z, the grand jury issued a subpoena requiring Boucher to "provide all documents, whether in electronic or paper form, reflecting any passwords used or associated with the [seized computer]." (36) Boucher moved to quash...

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT