Indiana Supreme Court Says Compelled Decryption Of Smartphones Violates The Fifth Amendment
from the maybe-some-federal-legislation-will-make-this-all-irrelevant dept
Two years ago, the Indiana state Appeals Court ruled residents could not be compelled to unlock devices by law enforcement -- not at the drop of a warrant. To compel the production of a password, law enforcement needs to have a certain amount of information in hand before it can ask courts to hit uncooperative criminal suspects with contempt charges.
The Appeals Court decision raised an interesting point about device encryption. Without decryption, the alleged criminal evidence is nothing more than a scramble of bits and bytes of no use to anyone. With the correct password in place, the data is reintegrated into something usable -- which turns the production of a password into a testimonial act.
In a very real sense, the files do not exist on the phone in any meaningful way until the passcode is entered and the files sought are decrypted. Thus, compelling Seo to unlock her phone goes far beyond the mere production of paper documents at issue in Fisher, Doe, or Hubbell. Because compelling Seo to unlock her phone compels her to literally recreate the information the State is seeking, we consider this recreation of digital information to be more testimonial in nature than the mere production of paper documents.
The state appealed the decision but there's nothing positive waiting for it at Indiana's top court. (via EPIC)
The state Supreme Court says compelling production of passwords violates the Fifth Amendment. The state wanted to rely on the "foregone conclusion" exception, but the court says [PDF] it doesn't have enough information on hand to start bypassing Constitutional protections.
[A] suspect surrendering an unlocked smartphone implicitly communicates, at a minimum, three things: (1) the suspect knows the password; (2) the files on the device exist; and (3) the suspect possessed those files. And, unless the State can show it already knows this information, the communicative aspects of the production fall within the Fifth Amendment’s protection. Otherwise, the suspect’s compelled act will communicate to the State information it did not previously know— precisely what the privilege against self-incrimination is designed to prevent.
The state doesn't have this information. In fact, an investigator admitted during testimony he was hoping to find evidence on the seized phone -- which definitely isn't the same thing as knowing what's contained in the device.
Even if we assume the State has shown that [Katelin] Seo knows the password to her smartphone, the State has failed to demonstrate that any particular files on the device exist or that she possessed those files. Detective Inglis simply confirmed that he would be fishing for “incriminating evidence” from the device. He believed Seo—to carry out the alleged crimes—was using an application or internet program to disguise her phone number. Yet, the detective’s own testimony confirms that he didn’t know which applications or files he was searching for:
"There are numerous, and there’s probably some that I’m not even aware of, numerous entities out there like Google Voice and Pinger and Text Now and Text Me, and I don’t know, I don’t have an all-encompassing list of them, however if I had the phone I could see which ones she had accessed through Google."
Compelling production of passwords without these conclusions in place is pretty much the equivalent of beating a confession out of a suspect. It forces someone to produce testimonial evidence to be used against them in court -- evidence still unknown to investigators.
In sum, law enforcement sought to compel Seo to unlock her iPhone so that it could then scour the device for incriminating information. And Seo’s act of producing her unlocked smartphone would provide the State with information that it does not already know.
The court goes on to explain why compelling phone passwords is not comparable to more analog versions of evidence gathering, much of which revolves around limited sets of paper documents targeted with subpoenas. The quantity of information the average smartphone contains makes these Constitutional protections even more crucial.
Smartphones are everywhere and contain everything. They have become such “a pervasive and insistent part of daily life that the proverbial visitor from Mars might conclude they were an important feature of human anatomy.” Riley v. California, 573 U.S. 373, 385 (2014)...
Citing a prior compelled production case, the state court says this about the increasing irrelevance of analog comparisons.
Hubbell further illustrates the considerable difference between complying with a court order to produce an unlocked smartphone and complying with a documentary summons. Recall that, in Hubbell, the Government had not shown that it had any prior knowledge of either the existence or location of 13,120 pages of documents. Though not an insignificant amount of information, it pales in comparison to what can be stored on today’s smartphones. Indeed, the cheapest model of last year’s top-selling smartphone, with a capacity of 64 gigabytes of data, can hold over 4,000,000 pages of documents—more than 300 times the number of pages produced in Hubbell. It is no exaggeration to describe a smartphone’s passcode as “the proverbial ‘key to a man’s kingdom.’”
The court then goes further, suggesting the "foregone conclusion" doctrine may be completely unworkable when applied to smartphones.
Such unbridled access to potential evidence on her iPhone—or any smartphone—raises several complex questions. For example, if officers searching a suspect’s smartphone encounter an application or website protected by another password, will they need a separate motion to compel the suspect to unlock that application or website? And would the foregone conclusion exception apply to that act of production as well? Suppose law enforcement opens an application or website and the password populates automatically. Can officers legally access that information? Or what if a suspect has a cloud-storage service—like iCloud or Dropbox—installed on the device, which could contain hundreds of thousands of files. Can law enforcement look at those documents, even though this windfall would be equivalent to identifying the location of a locked storage facility that officers did not already know existed? Such complexity is neither necessary nor surprising: the foregone conclusion exception is, in this context, a low-tech peg in a cutting-edge hole.
The court says cops have other options -- options that don't bypass Constitutional protections.
At the same time, we emphasize that there are several ways law enforcement can procure evidence from smartphones without infringing on an individual’s Fifth Amendment rights. For example, officers could try to obtain information from third parties under the Stored Communications Act. Alternatively, two companies—Cellebrite and Grayshift—offer law enforcement agencies affordable products that provide access to a locked smartphone. Or officers could seek an order compelling the smartphone’s manufacturer to help bypass the lock screen. And if law enforcement wants to get into a smartphone for reasons other than prosecution, they can offer immunity to the device’s owner. But the State cannot fish for incriminating evidence by forcing Seo to give unfettered access to her iPhone when it has failed to show that any files on Seo’s smartphone exist or that she possessed those files.
This pretty much ends compelled encryption of smartphones in this state. The reasoning delivered here by the state's top court makes it almost impossible to satisfy the "foregone conclusion" standard needed to avoid violating the Fifth Amendment. Law enforcement agencies will have to seek other routes into locked devices. They'll no longer have the threat of indefinite jailing for contempt charges to hold over uncooperative suspects.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: 5th amendment, compelled decryption, indiana, smartphones
Reader Comments
Subscribe: RSS
View by: Time | Thread
Last para "compelled encryption of smartphones " >> "decryption?"
(compelled encryption would be an interesting concept though)
[ link to this | view in chronology ]
compelled encryption: a responsible government would require it
Encryption is not just a luxury that only criminals can afford. We now have enough computing power to safely bank, order things, and pay bills online. Doing so without encryption is irresponsible, and an NSA that actually cared about national security, an FBI that actually cared about reducing crime, would push for the strongest possible backdoor-free encryption to protect the country's citizens.
Vault 7 was a good demonstration of the stupidity required to believe that keeping vulnerabilities unpatched and 'secret' helps our national security. Vulnerabilities and backdoors make everyone less secure, and there are thousands more law-abiding citizens than there are criminals where the only evidence they leave is on their smartphones.
[ link to this | view in chronology ]
Re: compelled encryption: a responsible government would requir
The NSA seems to have the same definition of "United States" that the US military did during the Cold War - the country consists solely of the government and the citizens are not part of the country.
They could lose 100% of the civilian population to nuclear strikes but if they preserved the elected officials and bureaucrats they would consider the USA intact.
In the same way, the modern NSA can consider the US data infrastructure 100% secure if they only guard the government while throwing the citizens to the wolves.
[ link to this | view in chronology ]
Hard cases ...
The defendant cell-phone owner is vile, having officially accused an innocent man of rape. If her criminal conviction is not feasible without decryption, perhaps her victim could be aided and encouraged to file a civil lawsuit, where privileges against self-incrimination do not apply. It would be a social good to have a public legal record somewhere of this woman's malignant and untrustworthy character, lest she try to abuse the legal system again.
.
[ link to this | view in chronology ]
Re: Hard cases ...
Funny, it sounds like the person you're talking about has already been convicted. Defendants are supposed innocent until convicted.
[ link to this | view in chronology ]
Re: Re: Hard cases ...
This. A trial is how you find out if someone is guilty or not. Trials are not privileges that bad people don't deserve.
[ link to this | view in chronology ]
Re: Hard cases ...
It is a sad indictment of society that this woman already does have a public legal record that will be used against her: for a large portion of society, it is sufficient to be branded by accusation.
For entirely too many people, simply being accused of a crime is sufficient to ruin lives and livelihoods, no proof or conviction required.
[ link to this | view in chronology ]
Re: Hard cases ...
Everyone is the bad guy in someone elses story.
While I can understand the whole she is a bad person thing...
If we break the rules to "get" her, we're the ones who will lose.
"It would be a social good to have a public legal record somewhere of this woman's malignant and untrustworthy character, lest she try to abuse the legal system again."
My friend is a sex worker.
My freind is raped.
Because she is a sex worker she isn't entitled to be treated as anyone else should be after such a horrific act?
Justice works because even the assholes have rights & if you cheer for chipping away at their rights you might wanna look underneath the ground you are standing on... you're chipping away your rights too.
[ link to this | view in chronology ]
Nothing like keeping the All Writs Act alive and well. :S
[ link to this | view in chronology ]
Foregone conclusion
The whole "forgone conclusion" thing is bullshit and needs to go. If a prosecutor could prove what they were going to find, why not show that proof to a jury and forget about getting help from the suspect? But if they can't prove it, they're making the suspect provide new incriminating information, which is what the Fifth Amendment is supposed to prevent.
[ link to this | view in chronology ]
Re: Foregone conclusion
You can prove a document with information on X exists. You can't necessarily prove the detailed contents of that document.
I think it should go. They should have to get a locksmith to crack it. But the ability to prove a document's existence is wholly separate from proving the document's detailed contents.
[ link to this | view in chronology ]
Re: Re: Foregone conclusion
OK. So, how does forcing someone to provide such a document square with: "nor shall be compelled in any criminal case to be a witness against himself"? They'd be providing evidence that the prosecution doesn't already have.
[ link to this | view in chronology ]
Re: Re: Foregone conclusion
Quite true. Someone might be able to prove that the 15th text file saved on my iPad exists. But if they don't know the contents, how can they say it contains my lasagna recipe instead of my hardware store shopping list, without inadmissible speculation?
[ link to this | view in chronology ]
I think the best/scariest parts of this ruling have nothing to do with the cell phone aspect but rather highlight 2 problems in the legal system. One is specific, the way the standards on the forgone conclusion doctrine slipped. Prosecutors admit they didn't know what they were looking for and they didn't know if what they were looking for was on the phone. As the court highlights, that definitionally can't be a forgone conclusion. But lower courts have accepted that reasoning. This is legal creep in action - and it shows the same issues with qualified immunity. The FCD (Forgone Conclusion Doctrine) is a creation of fourth and fifth amendment jurisprudence. If the criminal investigators can show that documents exist and that those documents exist in a secure location and we can prove that access is controlled by a specific individual, then forcing access to the secure location is not considered testimonial and the documents are left to speak for themselves. But that logic is traditionally, as the court highlighted, self limiting in scope. Literally, the safe can only be so big. And as the court noted, the more unknown documents that probably exist, the greater the burden on the 4th and 5th amendments. Not only does this decision severely limit the doctrine for cell phones, it also highlights the way prosecutors have been lowering the standards for years.
But it more broadly highlights the willingness of judges to rubber stamp fishing expeditions. The prosecutor admitted he was fishing, and it took the state supreme court to rule that the forgone conclusion was bunk on its face. The appeals court noted the issues with scope, it took the state supreme court to note that it shouldn't have even gotten that far. Most defendants would not have the resources to appeal that far.
[ link to this | view in chronology ]
I admittedly skimmed... but my brain hit a hiccup.
She willingly gave the detective the phone for a forensic download.
Did they just lose that?
She provided an unencrypted (at a basic level) copy of her phone.
Because evidence gathered to pursue the person she made claims against lead to them discovering she was a bad actor does that magically reseal that image?
Did they just want to get new evidence?
I'm sorta lost here b/c a forensic image of a computer doesn't just get 1 part of the storage, it produces a full copy of the device as it was at the time it was imaged (including slack space). The image is kept frozen & devices are permitted read only access to it to make sure nothing is changed.
Surely it would be easier to compel unlocking if the original image contained bread crumbs supporting that she was the bad guy wouldn't it?
Why would a newer image reveal more, the events in question happened & she willingly gave them the phone to be used as evidence bolstering her claims.
Does she magically gain new rights to say oh that evidence I gave you, don't look in the folder that says 'Master Plan to Ruin Dudes Life'??
Not getting this... I like the idea forcing the production of the password for a fishing trip is wrong... but when they had in their possession a forensic image of the device they could have said what fish they were after...
My head hurts.
[ link to this | view in chronology ]
Re:
You're assuming the neo-Luddites at the police station can read the file image, and that they didn't delete it immediately after the first read.
I read a story on a weird news site about a guy who threw away his install disks after installing software on his computer, because as he put it 'the disks were empty' after he installed the software.
I could totally see someone like that reading the file image and then throwing away the SD card it was on.
[ link to this | view in chronology ]
Re: Re:
So they destroyed evidence in a current investigation??
[ link to this | view in chronology ]
Cloud access
If the phone provided access to cloud services (lockers, Gmail, etc.), they might be able to see FAT tables without retaining access to the data itself.
A folder shortcut labeled Crunch's Big Folder of Child Porn whose path led to an encrypted cloud server might leave the officers feeling curious but thwarted.
I think it might have to be child porn. Police aren't very excited about Mr. Smither's Slush Fund for Bribing City Officials unless they already think their suspect is already a black perp from the projects.
[ link to this | view in chronology ]
A court shouldn't be needed to state the obvious. But it will keep having to as long as law enforcement keeps thinking they are above the law. The most important law in this matter, the Constitution. Those defund police movements are wrong in one aspect, cops need more budget to teach basic law to their ranks.
[ link to this | view in chronology ]
1 down, 49 to go
Nice to see not just a court getting this one right but no less than a state supreme court, even if it's more than a little insane that it needs to be ruled on.
The fifth amendment protects against self-incrimination.
Before decryption investigators/prosecutors do not have the evidence to use against the accused.
After decryption investigators/prosecutors do have evidence to be used against the accused.
It seems pretty clear that forcing someone to decrypt a device is forcing them to provide evidence to be used against them and creating a solid link between them and the evidence in question, violating the fifth.
[ link to this | view in chronology ]
I take this only affects literal passwords...
...and other means to unlock a person's cellphone (say a biometric scan like a fingerprint) would not be considered a violation the fifth amendment, yes?
I'm assuming it's still a good idea to use long passwords for my devices.
[ link to this | view in chronology ]
... maybe?
The wording in a few of the quotes would seem to indicate a wider range than just passwords and encompass anything that would unlock a device, but barring a ruling specifically calling out biometrics that might still be up in the air, so a password is still the better option with regards to playing it safe and in general.
In sum, law enforcement sought to compel Seo to unlock her iPhone so that it could then scour the device for incriminating information. And Seo’s act of producing her unlocked smartphone would provide the State with information that it does not already know.
But the State cannot fish for incriminating evidence by forcing Seo to give unfettered access to her iPhone when it has failed to show that any files on Seo’s smartphone exist or that she possessed those files.
[ link to this | view in chronology ]