Pennsylvania Supreme Court Says Compelled Password Production Violates The Fifth Amendment
from the so-it's-back-to-beating-arrestees-with-phonebooks-I-guess dept
The Fifth Amendment prevents compelled production of passwords, the top court in Pennsylvania has ruled. (h/t ACLU) It joins a handful of other state courts finding passwords to be testimonial, including Indiana, Illinois, and Florida. Unfortunately, there's no SCOTUS opinion uniting the states, so Fifth Amendment coverage remains spotty.
Securing rights remains the job of unsympathetic defendants. The state's child porn prosecution is likely to stall out with its main supply of potential evidence inaccessible. Despite the defendant basically admitting the computer law enforcement seized contained other child porn images ("we both know what's on there") and that he alone used the computer and could decrypt it, the court says [PDF] the state's foregone conclusion assertions aren't enough to render the Fifth Amendment useless.
That was the state's argument: the seized computer likely has child porn on it, based on the defendant's admissions and the investigative work that tracked porn downloads/uploads to his address. The state's Superior Court found the government's arguments persuasive, but only by drastically narrowing the scope of its focus.
Applying the foregone conclusion exception, the Superior Court, contrary to the trial court, focused on the password itself, and reasoned that the Commonwealth established the computer could not be opened without the password, that the computer belonged to Appellant and the password was in his possession, and that this information was “self-authenticating” ― i.e., if the computer was accessible upon entry of the password, the password was authentic.
While the government would like the court to believe that the compelled production of passwords is like demanding a key to a locked box, the court disagrees. There is Supreme Court precedent that guides this analysis, even if the Supreme Court has yet to rule on compelled password production.
First, the Supreme Court has made, and continues to make, a distinction between physical production and testimonial production. As made clear by the Court, where the government compels a physical act, such production is not testimonial, and the privilege is not recognized. See Holt; Doe II. Second, an act of production, however, may be testimonial when the act expresses some explicit or implicit statement of fact that certain materials exist, are in the defendant’s custody or control, or are authentic. See Fisher; Hubbell. The crux of whether an act of production is testimonial is whether the government compels the defendant to use the “contents of his own mind” in explicitly or implicitly communicating a fact.
Fifth Amendment protections may be limited in cases like these, but they're not nonexistent. The government has an evidentiary burden to meet before it can demand production of passwords.
[U]nder a foregone conclusion analysis, the Supreme Court has reasoned that an act of production does not render communication testimonial where the facts conveyed already are known to the government such that the evidence sought “adds little or nothing to the sum total of the Government’s information.” Fisher, 425 U.S. at 411. Thus, what is otherwise testimonial in nature is rendered nontestimonial, as the facts sought to be compelled are a foregone conclusion. As described above, for the exception to apply, the government must establish its knowledge of: (1) the existence of the evidence demanded; (2) the possession or control of the evidence by the defendant; and (3) the authenticity of the evidence.
The state simply doesn't have it here. It has a computer that, if unlocked by a compelled password, would become "self-authenticating." The defendant's assertions about his control of the computer isn't enough to clear these hurdles. Most of the state's "foregone conclusion" about available evidence (with the exception of a single, verified child porn image transferred from the defendant's IP address to investigators during the investigation) is nothing more than a strong hunch. That's not enough.
In sum, because the Commonwealth has failed to establish that its search is limited to the single previously identified file, and has not asserted that it is a foregone conclusion as to the existence of additional files that may be on the computer, which would be accessible to the Commonwealth upon Appellant’s compelled disclosure of the password, we find the Commonwealth has not satisfied the foregone conclusion exception.
This ruling does not go so far as to cover compelled production of biometric features, however.
Because we are dealing with a motion to require an individual to recall and disclose a memorized password to a computer, in essence, revealing the contents of one’s own mind, we need not address the related, but distinct, area involving biometric features like fingerprints, thumbprints, iris scanning, and facial recognition, or whether the foregone conclusion rationale would be appropriate in these circumstances.
But the court hints it would likely find in the state's favor if the decryption key was a fingerprint.
[N]ot only are these communications not before our Court, it is the United States Supreme Court that long ago has created the dichotomy between physical and mental communication.
Also of note is this: supporting briefs filed on behalf of the government by other state governments appear to contain threats of anti-encryption legislation if courts continue to allow the Constitution to protect defendants from self-incrimination.
In a joint amicus brief in support of the Commonwealth, various states provide an interesting history of modern encryption, press the troubling consequences of Appellant’s position ― including the altering of the balance of power, rendering law enforcement incapable of accessing large amounts of relevant evidence ― and warn that adopting Appellant’s position could result in less privacy, not more, in the form of draconian anti-privacy legislation.
There's nothing quite like multiple state governments claiming they'll strip away privacy protections if they can't ignore Constitutional protections. When it comes to weighing the interests of all involved stakeholders, it appears the government's interests weigh the most.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: 5th amendment, compelled speech, passwords, pennsylvania, self-incrimination
Reader Comments
Subscribe: RSS
View by: Time | Thread
A telling, and worrying, argument
In a joint amicus brief in support of the Commonwealth, various states provide an interesting history of modern encryption, press the troubling consequences of Appellant’s position ― including the altering of the balance of power, rendering law enforcement incapable of accessing large amounts of relevant evidence ― and warn that adopting Appellant’s position could result in less privacy, not more, in the form of draconian anti-privacy legislation.
'If you don't let us violate constitutional rights we'll pass unconstitutional laws in order to let us do so' is really not the sort of thing you want multiple states arguing, as that shows a mindset that considers constitutional protections and privacy of the public not limits to be respected and something to uphold respectively, but obstacles to be worked around and/or undermined.
Law enforcement has never had access to all of the evidence they've wanted, and the fact that there are more ways for people to protect their privacy, even if that includes really terrible people, is not grounds to start giving them that which they have never had and never will have, especially when it will come at such a great cost to the general public.
[ link to this | view in chronology ]
Re: A telling, and worrying, argument
Law enforcement has never had access to all of the evidence they've wanted, and the fact that there are more ways for people to protect their privacy, even if that includes really terrible people, is not grounds to start giving them that which they have never had and never will have, especially when it will come at such a great cost to the general public.
As opposed to protecting the privacy of horrible criminals at NO cost to the public?
[ link to this | view in chronology ]
Re: Re: A telling, and worrying, argument
Can you guarantee that a future government will not persecute you because of your beliefs and opinions? While strong privacy protections may allow a few criminals to escape justice, it protects even more people from a tyrannical government, and so is a price worth paying.
[ link to this | view in chronology ]
Everyone who offers a legal product or service with a generally beneficial use to society runs the risk of having it used by criminals. That doesn’t seem to stop car makers, gun manufacturers, Internet access providers, and super PACs.
[ link to this | view in chronology ]
Protecting the guilty to protect the innocent
The exact same legal rights and protections that shield the absolute worst of the worst from government intrusion and overreach are the ones that protect you and everyone else from the same, such that eroding their rights and protections erodes yours right alongside them.
If they don't have legal protections then neither do you, as the only thing preventing you from suffering the same fate of 'provide us access to everything we want to see or else' at that point is the whim of a prosecutor, and all your protestations of innocence and how it's a violation of your rights and privacy will be for naught, because after all 'the guilty don't have rights', and having been accused... well, you might as well be guilty.
[ link to this | view in chronology ]
Hell, this logic is basically the prime directive of the First Amendment: The worst speech must remain protected from government interference so all speech can remain protected.
[ link to this | view in chronology ]
Re: Protecting the guilty to protect the innocent
Not to mention it leading to Color of Law abuses like the post-revolution French agency for 'Public Safety' and Soviet political officer were infamous for. See also: Driving while black
[ link to this | view in chronology ]
Re: Re: A telling, and worrying, argument
"As opposed to protecting the privacy of horrible criminals at NO cost to the public?"
There is no protection of the privacy of criminals that doesn't also protect the innocent (which includes "horrible criminals" until they're found guilty in a court of law).
There is no abuse of of the privacy of "horrible criminals" that doesn't also infringe on the privacy of the innocent.
[ link to this | view in chronology ]
Re: Re: A telling, and worrying, argument
When the government crosses the line of protecting the innocent until proven guilty by a jury of their peers with trampling those rights to clamp down on criminals, I would rather the criminals be protected than a rogue government trampling everyone's rights.
[ link to this | view in chronology ]
Re: Re: Re: A telling, and worrying, argument
Hell, I'd take it further, and rather be a criminal, George Washington-style. XD
[ link to this | view in chronology ]
Re: Re: A telling, and worrying, argument
Nothing to hide? Then you won't mind me rifling through your stuff every day.
[ link to this | view in chronology ]
Re: A telling, and worrying, argument
I already knew compelling someone to produce passwords to their personal devices that might incriminate them or allow someone to place unlawful material on their devices was unconstitutional. How do we live with such a usurped government?
[ link to this | view in chronology ]
Re: A telling, and worrying, argument
It's especially absurd when you consider the twin facts that state officials -- even judges and legislators -- are not immune to prosecution under Title 18, Sections 241 & 242 of the US Code... and that those federal statutes criminalize violations of constitutional rights under color of law.
https://www.justice.gov/crt/statutes-enforced-criminal-section
[ link to this | view in chronology ]
One more reason to not use biometrics for anything.
Actually if the child abuse people keep using biometrics it's fine but it is a stupid way to protect your stuff.
I read the first amendment as giving the right to encrypt things if you want to.
[ link to this | view in chronology ]
So an IP address is sufficient to establish probable cause for child porn and defamation but not copyright infringement?
[ link to this | view in chronology ]
Re:
Probable cause isn't enough for a conviction or final civil judgement.
[ link to this | view in chronology ]
Re: Re:
Final civil judgements are an expensive proposition if you have to pay for a lawyer through to the end of a matter.
[ link to this | view in chronology ]
I love how you lump those two together as if they’re similarly horrible crimes, Jhon.
[ link to this | view in chronology ]
Re:
No.
You are welcome bro.
[ link to this | view in chronology ]
Compelling
I've always found it troubling that someone can be compelled to produce a password, or else get sent to jail. What if the subject being compelled does not know the password? Although this case does not involve that element, any protections against compelled production of information is a step in the right direction against false accusations.
[ link to this | view in chronology ]
Re: Compelling
You can sit in jail without a conviction indefinitely until you provide passwords unless you have the most expensive lawyers in town.
[ link to this | view in chronology ]
Re: Compelling
For some reason, while courts will come down with both boots on someone being sent to prison for an excessive time for a minor crime, they usually have no problems with a judge sending someone to prison for life for exercising a constitutional right the judge disagrees with.
[ link to this | view in chronology ]
Physical keys versus mental keys
This is one reason I don't use facial recognition or a fingerprint to unlock my devices. Providing a biometric key is a physical act. Remembering a password is a product of the mind, and speaking or writing it is testimonial.
I don't intentionally break laws, but there are so many covering so many things that even federal judges can't definitively tell whether any given act is lawful or not, nor can they tell anyone how many federal laws there are. And then you have state, county and city laws as well, plus the odd contractual requirement you may have misread or just plain missed in a contract somewhere.
It's safer to keep your keys in your mind alone.
[ link to this | view in chronology ]
Re: Physical keys versus mental keys
Did you know that keys are just like written passwords? Hypothetically (but not practically) you can recut a key every time you use it, then destroy it. In fact, physical keys usually only have about 30 bits of entropy, but since it's impractical to make billions of them, they're considered moderately secure against 'guessing' the secret. On the other hand, locksmiths and pickers have long figured out how to attack them a few bits at a time...
[ link to this | view in chronology ]
Electronic items
Buy amazing electronic items here with 50%
<a href="https://www.enrgtech.co.uk/">Buy Electronic items in UK </a>
[ link to this | view in chronology ]