Law enforcement officials have long been wary of the spread of encryption technologies, fearing that they could provide an impenetrable cloak for criminal activity. For individuals, though, encryption offers perhaps the only means for keeping private information private in an age of digital communication. As the Washington Post reports today, the encryption conflict is now coming to a head. A guy in Vermont, accused of storing child pornography on his computer, has refused to provide police with the password required to unlock the encrypted files on his hard drive. He claims that disclosing the password would violate his Fifth Amendment right to avoid self-incrimination. A judge backed his claim, and the government is now appealing that ruling in the federal courts.
The outcome of the court battle could have broad implications. A former federal prosecutor makes the anti-encryption case: “If [the ruling] stands, it means that if you encrypt your documents, the government cannot force you to decrypt them … So you’re going to see drug dealers and pedophiles encrypting their documents, secure in the knowledge that the police can’t get at them.” But a privacy advocate sees the ruling as essential to protecting people from governmental snooping: “The last line of defense really is you holding your own password … That’s what’s at stake here.”
Given the power that governments and other organizations now have to monitor communications, I would err on the side of protecting individual rights. But I can certainly see how encryption could be abused. The Post is correct in saying the case “raises a uniquely digital-age question about how to balance privacy and civil liberties against the government’s responsibility to protect the public.” It’s worth watching.
The government will win this case.
The fifth amendment is about not compelling self-incriminating testimony. A suspect can be compelled to produce other forms of incriminating evidence such as fingerprints, blood and hair samples. That’s what this is.
“The last line of defense really is you holding your own password … That’s what’s at stake here.”
Even if the government wins the appeal and gets the hypothetical power to require this guy to give up his password, if he’s really hiding child porn on his computer that requirement will need to be backed with a penalty at least as severe as the penalty for storing child pornography before he heeds it. I’m more than a little alarmed by the prospect of the government pursuing not only a right to force disclosure of passwords but penalties for not doing so harsher than those reserved for child pornographers.
It may be a little more complicated than that, Swashbuckler… while what you say is true, it’s also true that courts have sometimes ruled that the 5th can protect against the compulsion to produce documents, particularly documents which may or may not exist and the very fact of their existence would be incriminating. Without knowing the particulars of the encryption scheme or the subpoena it’s hard to say, but if one imagines an encrypted archive within which individual files are not discernable (rather than just individual files whose contents have been encrypted) then there may be a legitimate argument to be made for 5th Amendment protections here.
This issue should be approached in a more traditional manner, I think. In the old 3D world everybody is entitled to have their privacy and can lock away their belongings with traditional keys, let’s say in a safe. If police officials suspect you are keeping illegal stuff in your safe they can try to obtain the right to force access, for instance in court. When there is no reasonable suspicion, access is denied. There are procedures for this.
Why wouldn’t the same rules and procedures apply here?
Scott,
I’m aware of that. However, that standard would not be applicable in this case. That’s more along the lines of “Do you have any records of your illegal transactions?” What the government is asking for in this case is the digital equivalent of demanding a defendent turn over the key to a safe.
The one thing that could save this guy is if the password were something like “I-like-child-porn.” Even if that were the case, I suspect a court would rule that the suspect had to turn over the password, but that the password could not be admitted as evidence at trial.
Here’s the complex part. Fifth amendment jurisprudence says, essentially, that you can be forced to turn over the keys to a safe, but not the combination to a safe — that is a physical object, but not the contents of your mind.
As a practical matter, this matters more as a matter of law than as a matter of practice, since the stress of a trial would tend to make it very difficult for people to remember complex passphrases…. Personally, though, I think that the judge got this one right.
you can be forced to turn over the keys to a safe, but not the combination to a safe
That’s fascinating.
Nick, this issue actually goes back more than decade, to the “crypto wars”. I could dig up some old legal writing if anyone cares.
A basic practical US legal problem is this:
Judge: What’s the password?
Defendant: I forgot it.
Judge: I can find you in contempt of court.
Defendant: I don’t remember! I can’t tell you! I’m sick, I’m under terrible stress, I can’t remember something I don’t remember.
Now, what then? This starts to look very much like classic self-incrimination situation.
Moreover, if you can ask someone their passphrase , why can’t you ask them where the gun is, or what they did with the body, etc.?
Once you strip away the scary “cyber“, I’d assert it’s actually not all that hard in traditional US jurisprudence.
Ah, found it – 1995.
Cryptography and the Fifth Amendment
Mark Eckenwiler
http://www.panix.com/~eck/5th-amdt.html
” If the password is in your head, the answer is easy: the Fifth Amendment protects you. As the Supreme Court made clear in Curcio v. United States (1957), the government cannot force someone “to disclose the contents of his own mind” if that information is incriminatory.”
I draw the following analogy:
Imagine that you are one of two people in the world who understand and speak a language called Secretish. This language has no connection to any other language. No linguist has any clue how to translate it. You and your fellow Secritish-speaker have a conversation that is lawfully recorded by authorities who are investigating your friend’s affairs. The authorities demand that you provide them with a translation, but you believe that you may be a target of investigation yourself, so you invoke your rights under the Fifth Amendment. The authorities then petition the courts to compel you to them with a dictionary and grammar for Secretish so that they can translate the conversation into English themselves. I think (and hope) that every court in the land would recognize that the Fifth Amendment obviously must apply in this scenario. And I think that even the most dim-witted luddite court would understand how well this analogy fits for encryption keys.
Note that in the UK, however, things are different: http://www.schneier.com/blog/archives/2007/10/uk_police_can_n.html
What are they going to do? Waterboard him?
Greetings Seth, I wonder just how much governments attitudes have changed in relationship to the 5th amendment since 95-97.
Looking at what has been going on in recent years, I have serious doubts that the example you dug out would hold water today. I would suggest that the situation has become so dire,
“Violent Radicalization and Homegrown Terrorism Prevention Act of 2007, “the Act does not make certain forms of thought a crime itself, however, it does mean that a commission would be established, as well as a broad network of academics and researchers, specifically for the purpose of identifying ideologies that somehow can be considered to be a cause of terrorism, a premise accepted as fact by the language of the bill. This is “pre-crime” and “thought crime” all packed into a predetermination set by this bill to bias any research done for and accepted by the commission created by the bill, which could logically lead to changes in interpretations of legalese and possibly more legislation that would directly criminalize ideologies that can be considered by whoever ends up doing the research as terrorism prone. It is a small but dangerous step toward a terrifying Orwellian scenario becoming reality.”
It looks like the thought police” are already honing their abilities. So much for the 5th amendment!
Warm regards, Alan.