With the increasing use of encryption, on computers and mobile devices, law enforcement agencies often face challenges when accessing information during criminal investigations. This raises a significant question: When can law enforcement require you to surrender an encryption code to access data? At the core of this issue is the Fifth Amendment’s protection against self-incrimination. This blog post delves into the legal landscape surrounding encryption, its relationship to the Fifth Amendment, and key case law shaping this debate.

The Legal Foundation to Encryption Codes: The Fifth Amendment.

The Fifth Amendment to the U.S. Constitution provides individuals with a crucial right: protection against self-incrimination. It states that no person shall be compelled in any criminal case to be a witness against himself. This right is often invoked when someone refuses to answer questions that could reveal incriminating information. But how does this apply when the government demands access to your encrypted files? Does revealing your encryption code constitute self-incrimination?

To answer these questions, it’s essential to distinguish between two key legal concepts:

1. Testimonial Communication: Information that directly or indirectly conveys a fact, like speaking or writing something that shows guilt or knowledge.
2. Non-Testimonial Communication: Physical actions or objects that do not communicate knowledge, such as providing fingerprints, blood samples, or handwriting samples.

The crux of the issue is determining whether providing an encryption code is more like revealing testimony (protected by the Fifth Amendment), or providing physical evidence (not protected by the Fifth Amendment).

Encryption Codes and Self-Incrimination: Case Law Overview

Over the past decade, U.S. Courts have grappled with whether compelling someone to surrender an encryption code violates the Fifth Amendment. While no Supreme Court case has definitively resolved this issue, lower courts have ruled in several key cases:

In re Boucher (2009)

The case of In re Boucher, 2009 WL 424718 (D. Vt. 2009), involved a laptop seized at the U.S. border. Customs officials found part of the drive unencrypted, containing incriminating images. When officers rebooted the laptop, they found an encrypted portion they could not access. The government sought Boucher to decrypt the files.

The court addressed whether requiring the respondent to produce an unencrypted version of his laptop’s Z drive would constitute compelled testimonial communication. Here, the respondent had already accessed the Z drive at the request of a government agent, and the agent had already viewed the contents of the Z drive and ascertained that they may have included child pornography. The Government thus knew of the existence and location of the Z drive and its files and providing access to the unencrypted Z drive added little or nothing to the sum total of the Government’s information about the existence and location of files that may contain incriminating information.

The court ruled allowing the government to compel Boucher to produce the unencrypted files, reasoning that the existence and location of the files were already known to law enforcement. Since Boucher’s act of decrypting the files did not constitute testimony in this context, it was not protected.

United States v. Fricosu (2012)

In United States v. Fricosu, 844 F.Supp.2d 1201 (2012), the FBI seized a computer during the investigation of a mortgage fraud scheme. The computer was encrypted, and the government sought to compel the defendant, Ramona Fricosu, to provide the password. Fricosu argued that surrendering the password would violate her Fifth Amendment rights because it would force her to testify about her knowledge and control of the contents of the computer.

The court disagreed, ruling that the act of decrypting the computer did not constitute testimonial self-incrimination because it was a “foregone conclusion” that she had control over the computer and its contents. The government already knew the files existed, so compelling her to unlock them was not considered testimonial.

United States v. Doe (11th Cir. 2012)

In United States v. Doe, 670 F.3d 1335 (11th Cir. 2012), the government subpoenaed a defendant to decrypt multiple hard drives suspected of containing incriminating evidence. The defendant invoked the Fifth Amendment and refused to decrypt the hard drives. Unlike the Fricosu case, the court found that the Fifth Amendment applied because the government could not prove the existence or location of the specific files they sought.

The court ruled that compelling Doe to provide the decryption code would force him to communicate information (i.e., knowledge of the files), which was protected by the Fifth Amendment. Thus, under this ruling, a defendant cannot be compelled to decrypt hard drives the government suspects contain incriminating evidence (in this case child pornography), because decryption would be “testimonial” where the government lacks specific knowledge that the hard drives contain such evidence.

State v. Stahl (Fla. 2nd DCA 2016)

A Florida case, State v. Stahl, 206 So.3d 124 (Fla. 2nd DCA 2016), presented another twist on the issue. Law enforcement sought to compel Stahl to provide the password to his phone, which was believed to contain evidence of voyeurism. Stahl argued that providing the password would violate his Fifth Amendment rights.

The Florida appellate court ruled that the act of providing the password was not testimonial because the government was not asking for the contents of the phone but rather the key to unlock it. The court found that the government already had enough evidence to support a “foregone conclusion” that Stahl’s phone contained incriminating material, making the act of providing the password non-testimonial.

Stahl viewed the forced disclosure of the password as non-testimonial because the existence, custody, and authenticity of the password were a “foregone conclusion” under the facts of the case. No one disputed that the cellphone was the defendant’s and that he put it under a customer’s skirt with its flash enabled and appeared to take pictures that would be accessible in the cellphone’s memory (or via cloud storage).

The testimonial value of compelling the cellphone’s password was negligible under the circumstances: it was Stahl’s phone, evidence established his use of the phone during the incident for flash-photography, and he initially agreed to allow police to search the phone, thereby inferring his knowledge of the passcode and its authenticity. By its holding, Stahl stands for the proposition that where the state establishes factually that it knows that a password existed, that the suspect possesses or controls the password, and that the suspect’s actions disclosed or authenticated the password sought (here by Stahl initially agreeing to allow police to access the phone), it is a foregone conclusion to force its disclosure.

The “Foregone Conclusion” Doctrine

A common thread in many of these cases is the “foregone conclusion” doctrine. This legal principle states that if the government can show with reasonable certainty that it already knows the existence, location, and authenticity of the sought-after evidence, compelling someone to produce that evidence does not violate the Fifth Amendment.

For example, if law enforcement can demonstrate that they already know specific incriminating files exist on a device, compelling a suspect to decrypt the device is more akin to surrendering physical evidence (like handing over a safe key) rather than providing testimonial evidence. However, if law enforcement is using the encryption code to discover unknown information, the act of decryption could be considered testimonial and protected by the Fifth Amendment.

The Role of Immunity When Surrendering an Encryption Code

Even if surrendering an encryption code is considered testimonial, the government can sometimes compel a suspect to provide the code by offering immunity. This immunity must be broad enough to protect the individual from any future prosecution based on the act of producing the evidence.

For instance, in In re Boucher, the court allowed the government to compel Boucher to produce unencrypted files after granting him immunity for the act of production. The immunity only covered the act of producing the files, not any future prosecution based on the content of the files.

What Courts Have Not Decided About Surrendering an Encryption Code

While the courts have issued various rulings on this issue, they have not always been consistent, leaving several questions unresolved:

1. Supreme Court Precedent: The U.S. Supreme Court has not yet directly ruled on whether surrendering an encryption code constitutes testimonial communication protected by the Fifth Amendment.
2. Differences Between Passwords and Biometrics: Courts have drawn distinctions between passwords and biometric authentication (e.g., fingerprint or face unlock). Generally, courts have found that compelling biometric authentication is non-testimonial because it involves a physical act rather than revealing knowledge. See: Matter of Search of [Redacted] Washington, D.C., 317 F.Supp.3d 523 (D.D.C. 2018). However, compelling someone to provide a password involves revealing something they know, which may be protected under the Fifth Amendment.

Practical Considerations to Providing Your Encryption Code

The legal landscape regarding encryption and the Fifth Amendment remains unsettled, but based on the cases discussed, several factors can determine whether you are required to provide your encryption code to law enforcement:

1. Foregone Conclusion Doctrine: If law enforcement already knows the existence and location of specific files or data, compelling you to decrypt your device may not violate the Fifth Amendment.
2. Testimonial Nature: If providing the encryption code reveals something only you know, such as knowledge or control of incriminating files, the Fifth Amendment may protect you from being compelled to provide the code.
3. State vs. Federal Court Differences: State courts and federal courts have reached different conclusions in similar cases, which can affect whether you are compelled to provide your encryption code depending on jurisdiction.
4. Immunity: If granted immunity, you may be compelled to provide your encryption code without fear of the act of providing it being used against you in a criminal case.

My Final Thoughts

The question of whether and when you are required to surrender your encryption code to law enforcement is complex and highly fact-specific. While the Fifth Amendment offers protection against self-incrimination, the application of this protection in the context of encrypted data depends on whether providing the code is deemed testimonial and whether the “foregone conclusion” doctrine applies. Until the U.S. Supreme Court addresses this issue directly, the legal landscape will remain uncertain, and individuals facing this dilemma should seek legal counsel to navigate their specific situation.

If you, or someone you know, will be proceeding to trial, challenging an imposed sentence or pursuing any type of post-conviction relief, our book, The Colossal Book of Criminal Citations, is a crucial resource in the pursuit of justice. Our books are soft cover, institution friendly, in stock, and ready for immediate shipping. Order your copy today, or on behalf of someone incarcerated.