Illinois Appeals Court Says Fifth Amendment Protections Apply To Cellphone Passwords

from the reel-those-rods-back-in,-boys dept

The key to determining Fifth Amendment protections against compelled production of passwords appears to be a court's definition of the term "foregone conclusion." In many cases, courts have decided the government only has to clear a very low bar to meet this demand. In those cases, the only "foregone conclusion" the government needs to prove is that the person being compelled to provide a password knows the password. Once the government has linked the person to the locked device, it can get on with the compelling.

If a court decides to raise the bar, it gets far more difficult for the government. In a few cases, the government has been asked to show it knows the evidence it seeks can be found in the locked device. Even if it meets this requirement, it can't just start throwing court orders at the criminal suspect. This "foregone conclusion" directly implicates the Fifth Amendment. The government is no longer simply asking someone to unlock a device. It's asking them to directly provide them with evidence that could be used against them.

An Illinois state appeals court has decided the Fifth Amendment protects defendants from producing evidence to be used against them. (via FourthAmendment.com) In this case, the defendant was a passenger in a car stopped by law enforcement. A drug dog alerted on a leather bag belonging to the defendant. The ensuing search uncovered a prescription pill bottle containing cocaine, resulting in a charge of possession with intent to distribute.

That's not all the cops found. They also found the suspect's cellphone, which he refused to unlock for them. The prosecution asked the court to force the defendant to provide the password. The trial court declined to do so, saying compelled production of evidence violated the Fifth Amendment. The appeal followed, and the government has now been told twice [PDF] there will be no compelled password production. First, it explains this exception to the Fifth Amendment, which is now enjoying its heyday (so to speak):

The foregone conclusion doctrine is an exception to the fifth amendment privilege. Fisher, 425 U.S. at 411. Per the doctrine, where the existence, location and authenticity of the evidence is a foregone conclusion, that is, it “adds little or nothing to the sum total of the Government’s information,” the fifth amendment does not protect the act of production. Id. The exception applies when the State demonstrates with “reasonable particularity” that when it sought the act of production, the State knew the evidence existed, the evidence was in the defendant’s possession and it was authentic. United States v. Greenfield, 831 F.3d 106, 116 (2d Cir. 2016).

The court then points out what the government ultimately wants is what lies beyond the password, not the password itself.

Here, the State is not seeking the passcode per se but the information it will decrypt. The cases that declare the passcode to be a nontestimonial communication operate under the framework that the passcode is the testimonial communication and that it falls under the foregone conclusion exception to the fifth amendment privilege. We consider that the proper focus is not on the passcode but on the information the passcode protects. The State claims it sustained its burden of proving with reasonable particularity that it knew the passcode existed, that Spicer knew the passcode and that it would be authenticated by entering it into Spicer’s phone. However, what the State actually needed to establish with reasonable particularity was the contents of the phone, which it did not do.

If the state wants to satisfy this requirement, it needs to do far more than it has. So far, all that's been shown is that the officer seeking the search warrant imagines the cellphone will contain plenty of information relevant to the distribution charges, like… um… pretty much the phone's entire contents. The appeals court doesn't care for the breadth of the government's supposition.

The State does not know what information might be on Spicer’s phone but surmises that cell phones are often used in unlawful drug distribution and such information would be available on Spicer’s phone. The State has not provided a particularized description of that information or even evidence that any useful information exists on the phone. The State sought and was granted in the search warrant access to most of the information in Spicer’s phone, including call logs, text messages, multimedia messages, instant messaging communications, voicemail, e-mail, all messaging applications, phonebook contacts, videos, photographs, Internet browsing and mapping history and GPS data between May 24 and June 24, 2017. The State does not identify any documents or specific information it seeks with reasonable particularity. The State is engaging in a fishing expedition and the foregone conclusion exception does not apply here.

The foregone conclusion the government has to work with is far smaller than the foregone conclusion it thought it had:

While the State is aware that the passcode existed and that Spicer knew it, the State could not know that the passcode was authentic until after it was used to decrypt Spicer’s phone. Moreover, the production of Spicer’s passcode would provide the State more information than what it already knew. Although the focus of the foregone conclusion is on the passcode, in our view, it properly should be placed on the information the State is ultimately seeking, which is not the passcode but everything on Spicer’s phone.

The court's decision isn't a blanket statement saying compelled password production will always violate the Fifth Amendment. But it should serve as a warning to law enforcement officers who think they should be able to dig through every phone they seize, no matter how weak their affidavit rationalizations or how tangential the supposed evidence might be to the filed charges.

Filed Under: 5th amendment, illinois, mobile phones, passwords

Federal Judge Says Compelling People To Unlock Phones With Their Fingerprints/Faces Violates The 5th Amendment

from the surprising-turn-of-events dept

The advent of biometric "passcodes" -- fingerprints and facial recognition -- appear to be leaving those who choose these methods with fewer Fifth Amendment protections. A handful of courts have ruled fingerprints and faces aren't "testimony." Much as officers can collect fingerprints and mugshots without a warrant following an arrest, they can also apply fingers and faces to locked phones to get to the data inside.

But it's not as simple as some court decisions make it appear. Even passwords can be considered testimonial, as they may indicate ownership of a locked device or compel production of evidence to be used against the device's owner. The passcode argument has gone both ways in court, which usually comes down to the individual judge's definition of "foregone conclusion." Does the foregone conclusion refer to the device's ownership or the evidence contained in it? The latter is harder to prove, and raising the burden of proof to this level tends to result in courts finding the compelled production of passwords to be a Fifth Amendment violation.

Via Thomas Brewster at Forbes, there's finally some good news on the biometric security front. A federal judge in California has ruled forcing people to unlock phones using biometric measures is a Fifth Amendment violation.

[I]n a more significant part of the ruling, Judge Westmore declared that the government did not have the right, even with a warrant, to force suspects to incriminate themselves by unlocking their devices with their biological features.

As the court points out [PDF], when the fingerprint IS the password, the Fifth Amendment is implicated despite these features normally being considered non-testimonial.

The Court finds that utilizing a biometric feature to unlock an electronic device is not akin to submitting to fingerprinting or a DNA swab, because it differs in two fundamental ways. First, the Government concedes that a finger, thumb, or other biometric feature may be used to unlock a device in lieu of a passcode. In this context, biometric features serve the same purpose of a passcode, which is to secure the owner's content, pragmatically rendering them functionally equivalent.

The court notes law enforcement is well aware of jurisprudence surrounding device security. In this case, the more time that passed between the seizure of the devices and their compelled unlocking, the less likely law enforcement would be able to evade the Fifth Amendment. Judge Westmore doesn't find this reasoning acceptable.

[A] passcode is generally required "when a device has been restarted, inactive, or has not been unlocked for a certain period of time." This is, no doubt, a security feature to ensure that someone without the passcode cannot readily access the contents of the phone. Indeed, the Government expresses some urgency with the need to compel the use of the biometric features to bypass the need to enter a passcode. This urgency appears to be rooted in the Government's inability to compel the production of the passcode under the current jurisprudence. It follows, however, that if a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one's finger, thumb, iris, face, or other biometric feature to unlock that same device.

The court goes on to say the government had other options to access messages -- like approaching Facebook with a warrant -- rather than intrude on the Fifth Amendment (and the Fourth Amendment -- more on that in a moment), but it chose to do it this way. Just because it's easier and faster to do it via compelled production doesn't make it right. In fact, in the court's eyes, all this effort did was violate the Constitution in multiple ways.

An attempted assault on the Fourth Amendment also occurred in this case. Investigators looking for evidence of extortion via Facebook sought to have every device and person at a residence seized and searched, with every resident compelled to unlock devices found during the search. As the judge points out in the rejection of the search warrant application, the Fourth Amendment requires far more specificity.

This request is overbroad. There are two suspects identified in the affidavit, but the request is neither limited to a particular person nor a particular device.

Thus, the Court finds that the Application does not establish sufficient probable cause to compel any person who happens to be at the Subject Premises at the time of the search to provide a finger, thumb or other biometric feature to potentially unlock any unspecified digital device that may be seized during the otherwise lawful search.

This is a far better answer to this sort of request than others we've seen. Searching someone's home and digging through their electronics is one of the scariest powers the government has. The Fourth Amendment is in place to limit these exercises of immense government power to those that are justifiable and necessary. When judges grant overbroad orders, they're doing more than failing to act as a check against government abuse. They're normalizing abuse of citizens' rights via judicial precedent.

Filed Under: 5th amendment, compelled speech, facial recognition, fingerprints, locked phones, passwords, testimony, unlocking phones

Florida Appeals Court Says Producing Passwords Is Testimonial And Protected By The Fifth Amendment

from the A-CHALLENGER-APPEARS dept

The Florida State Appeals Court is bucking the trend on compelled decryption. While most courts have held forcing someone to relinquish the password to a locked device does not raise Fifth Amendment issues, this court has decided that act is testimonial in and of itself. This makes the state's demand unconstitutional and sends it up the ladder to the state's highest court. (via FourthAmendment.com)

The facts of the case may play a role in future deliberations. It involves a drunk driving accident. Phones belonging to the driver and passenger were were taken from the crashed car. The search of the driver's phone didn't go far, thanks to it being locked with a password. Prosecutors sought an order compelling password production but were met with arguments from the driver's lawyer claiming this would violate his Fifth Amendment rights. The appellate court agrees. From the decision [PDF]:

[R]evealing one’s password requires more than just a physical act; instead, it probes into the contents of an individual’s mind and therefore implicates the Fifth Amendment. The very act of revealing a password asserts a fact: that the defendant knows the password.

This is normally where the "foregone conclusion" standard is set -- the one that allows the government to bypass Fifth Amendment protections if it can show it knows the defendant knows the password to unlock a device. That's (usually) the only conclusion the government needs to reach. It does not need to show that it knows evidence needed to prosecute the case resides on the device. It only needs to tie the device to the defendant and show that there's a reasonable certainty the device can be unlocked by the person targeted by the order.

When applying this standard, courts usually don't consider production of passwords testimonial. And if it is, it's only verifying a fact the government has already shown it knows. Often, the government is forbidden to use this particular evidence -- that the defendant unlocked the phone -- against the person in court.

This court goes a different direction. It says, foregone conclusion or no, the production of passwords is testimonial and has the potential to harm the defendant just like any other Fifth Amendment violation would. The court notes the government gains nothing by obtaining a password. It wants what the password provides: access to information that might be used as evidence against the person supplying the password.

Here, the state seeks the phone passcode not because it wants the passcode itself, but because it wants to know what communications lie beyond the passcode wall. If the minor were to reveal this passcode, he would be engaging in a testimonial act utilizing the “contents of his mind” and demonstrating as a factual matter that he knows how to access the phone. As such, the compelled production of the phone passcode or the iTunes password here would be testimonial and covered by the Fifth Amendment.

Rather than use a standard used elsewhere, the court demands more from the government than a reasonable certainty the phone's owner knows how to unlock the phone. It needs to show the evidence it seeks can be found on the device.

Below and on appeal, the state’s argument has incorrectly focused on the passcode as the target of the foregone conclusion exception rather than the data shielded by the passcode, arguing that “because the State has established the existence of the passcode and iTunes password, evidence on the Petitioner’s cell phone, and that he can access the content of his phone,” the compelled search was acceptable. Similarly, the trial court specifically held that the “existence, custody, and authenticity of the passcodes are a foregone conclusion” in the order appealed. This holding, which focuses on the passcodes rather than the data behind the wall, misses the mark.

On this subject, we again disagree with the Second District. In Stahl, the court focused on the “reasonable particularity that the passcode exists,” a fact that the state had established. 206 So. 3d at 136 (emphasis in original). However, this is not the proper focus of the inquiry—it is not enough to know that a passcode wall exists, but rather, the state must demonstrate with reasonable particularity that what it is looking for is in fact located behind that wall. Contrary to the Stahl court’s conclusion, which the trial court adopted, the “evidence sought” in a password production case such as this is not the password itself; rather, it is the actual files or evidence on the locked phone. Without reasonable particularity as to the documents sought behind the passcode wall, the facts of this case “plainly fall outside” of the foregone conclusion exception and amount to a mere fishing expedition.

This is where the facts of the case may result in a ruling that aligns with the trial court's take on the "forgone conclusion" exception, but still denies access to the phone's contents. Everyone carries a phone. Drunk drivers are like sober drivers. That a drunk driver was carrying a phone at the time of an accident does not make it likely that evidence of the crime -- drunk driving -- will be found on the driver's phone. The court goes back to its "fishing expedition" comment, pointing out the state barely has any reason to search the phone at all, much less attempt to weaken Fifth Amendment protections in the process.

Here, the state’s subpoena fails to identify any specific file locations or even name particular files that it seeks from the encrypted, passcode-protected phone. Instead, it generally seeks essentially all communications, data, and images on the locked iPhone. The only possible indication that the state might be seeking anything more specific was the prosecutor’s statement at the hearing that the surviving passenger had been communicating with the minor via Snapchat and text message on the day of the accident and after the accident, a fact that the trial court briefly mentioned in its order but did not appear to rely on in reaching its conclusion.

The concurring opinion raises another issue seldom touched on in other password-related rulings. The "foregone conclusion" exception to the Fifth Amendment is, like the "good faith" exception, something fabricated by courts rather than by laws or Constitutional amendments. As such, it cannot be applied to oral testimony -- such as the relinquishment of passwords to law enforcement.

[H]ere, the State sought to compel the oral production of the requested information. The foregone conclusion exception has not been applied to oral testimony, and for good reason. In Fisher, the court explained that compelling a taxpayer to produce documents “involves substantial compulsion. But it does not compel oral testimony; nor would it ordinarily compel the taxpayer to restate, repeat, or affirm the truth of the contents of the documents sought.” Based on what the production in Fisher would not do, the Supreme Court allowed the government to compel the production of documents. Requiring the accused to orally communicate to the government information maintained only in his mind would certainly compel oral testimony. So, in my view, the basis for granting the petition is not that the State failed to satisfy the requirements of the foregone conclusion exception. Rather, the petition should be granted because the foregone conclusion exception is inapplicable to the compelled oral testimony sought in this case.

Of course, the workaround here is to have defendants punch in the passwords themselves or write them down. The latter would produce more issues than having them punch in the codes, but either way, it should be apparent -- at least in Florida -- that these alternate methods are being deployed to sidestep a precedential Fifth Amendment decision by the court.

The "foregone conclusion" exception is rarely applied in this fashion. A state-level appeals court decision isn't going to change things in the rest of the nation. But it does give defendants something to refer to when challenging compelled password production. And it also suggests the exception itself is being rethought in light of tech advancements that have made it possible for people to carry several houses-worth of documents with them at all times, protected only by a password the government can almost always obtain -- either through use of the exception or with indefinite jailing on contempt charges.

Fourth Amendment protections have undergone several adjustments over the past decade as courts seek to catch up with technology. The Fifth Amendment is due for the same overhaul.

Filed Under: 5th amendment, compelled decryption, encryption, florida, passwords, self incrimination

Massachusetts Supreme Court Looking To Define Where The Fifth Amendment Ends And Compelled Decryption Begins

from the let-a-new-wave-of-'wall-safe'-analogies-wash-over-this-land dept

Another case attempting to define the contours of the Fifth Amendment as it pertains to cellphones and passwords has arrived in the Massachusetts Supreme Judicial Court. The case involves sex trafficking allegations and a phone seized from the defendant at the time of his arrest. Testimony from a person who said she was trafficked suggested the phone seized belonged to the defendant Dennis Lee Jones. The state sought to compel Jones to unlock the seized phone, but this motion was denied by the trial court, resulting in the state's appeal.

While the lower court did express some concern that unlocking devices can result in the production of evidence to be used against the person unlocking it, the standard for compelled password production has nothing to do with the eventual recovery of evidence. All the state* needs to reach is a reasonable certainty the defendant knows the password to the seized device. This is called a "foregone conclusion" -- the defendant "telling" the state what it already "knows:" that the phone belongs to him and he can unlock it. The potential evidence held inside the phone may eventually be used against the defendant, but the Fifth Amendment question isn't about this evidence, but rather the simple act of producing a password, which isn't considered testimonial if the government can tie the phone to the accused.

*Yes, I realize Massachusetts is technically a commonwealth. There's no need to point this out in the comments.

In this case, it appears the state failed to meet that standard. The opinion being appealed says the government hasn't been able to conclusively show the phone belongs to Jones or that he knows the password. It may have shown evidence relevant to the case resides on the device, but that's not enough to move forward with compelled decryption.

In this case, the Commonwealth has established with reasonable particularity that information relevant to the charges against Mr. Jones exists on the LG Phone, and that it is authentic, satisfying two of the three elements of the “foregone conclusion” analysis. For example, the 7119 Number is linked to the LG Phone; online listings for alleged prostitution reference the 7119 Number; and police have possession of text messages from the 7119 Number related to commercial sex acts. In short, the Commonwealth has established independently that information connected to the charged sex trafficking activity is on the LG Phone.

The Commonwealth, however, has not demonstrated with reasonable particularity that Mr. Jones possesses the PIN number for the LG Phone or has access to what that phone contains.

[...]

The phone is not registered to Mr. Jones or to his address. A female voice (McNeill’s) answers voice calls to the 7119 Number. The Commonwealth has provided no evidence of Mr. Jones accessing or entering the PIN number into the LG Phone. The Commonwealth does not suggest that any law enforcement officer called the LG Phone and heard Mr. Jones answer the phone. In addition, Mr. Jones has not admitted to owning or controlling the phone. In short, the Commonwealth has offered no evidence akin to the strong evidence offered in Gelfgatt, where the defendant admitted to encrypting (and being able to decrypt) the computers at his home office.

The Commonwealth relies mainly on statements from Ms. Fortin, who lists the 7119 Number in her phone’s contact list as “Dennis,” and claims the 7119 Number belongs to Mr. Jones. I have not seen a statement from Ms. Fortin that shows she witnessed Mr. Jones using the LG Phone, nor did she describe the physical characteristics of the phone (such as model, color, or general appearance) in a way to suggest she has seen Mr. Jones physically use or enter a PIN into the phone. Defendant challenges Ms. Fortin’s credibility. The Commonwealth seems tacitly to acknowledge Ms. Fortin’s credibility issues, indicating in its search warrant affidavit that it seeks access to the contents of the LG Phone to “corroborate or fail to corroborate” the “key aspects of Ms. Fortin’s statement.”

Because it hasn't reached the "foregone conclusion" standard, the state's demand for a password makes this act testimonial.

In seeking to compel Mr. Jones to provide the PIN for the LG Phone, the Commonwealth is asking Mr. Jones to admit that he owns and/or controls the LG Phone, a fact the Commonwealth believes to be true, but does not know, and has been unable to establish independently.

Law prof Orin Kerr, who has written volumes on Fourth and Fifth Amendment issues, has filed an amicus brief [PDF] in this case. Citing his own draft paper [PDF] on the Fifth Amendment and compelled decryption, Kerr's argument mainly focuses on setting the confines of the "foregone conclusion" standard. His brief rejects both the stricter standard suggested by the defendant and lower standard asked for by the government. (h/t ReleasetheKraken)

The defendant argued for "proof beyond a reasonable doubt" he knew the password to the phone. But Kerr points out that's a standard for convictions, not accessing potential evidence.

Due process requires that the government must prove every element of a crime beyond a reasonable doubt because an individual’s freedom is at stake. Assigning such a high burden acts as “a prime instrument for reducing the risk of convictions resting on factual error.”

In contrast, “the basic purposes that lie behind the privilege against self-incrimination do not relate to protecting the innocent from conviction, but rather to preserving the integrity of a judicial system[.]” The individual must plead the Fifth and have a court assess the privilege before (often long before) any trial might occur. Although the individual must show that an answer would be incriminating, the individual may not even be a criminal suspect at that time. The Commonwealth could reasonably know only a small part of the evidence that it would later learn before deciding to bring a criminal case against the individual. For these reasons, the trial standard of proof beyond a reasonable doubt standard is not well-suited for the foregone conclusion doctrine.

According to Kerr, obtaining a password only ties the accused to the unlocked device. Whatever is on the phone may help the government prove its case, but it would not be able to use the suspect's compelled cooperation against him in court. It's not much of a protection, but it's something. It would prevent the government from making inferences about the phone's ownership and instead have to rely solely on the evidence found on the phone. The evidence must make the connection on its own without the government's help.

The government argued for a lower standard, one that would allow it to get its motion to compel granted. It wants a "preponderance of evidence" standard applied to "subsidiary facts." With this, the government could use the evidence provided by the victim to meet the standard needed to compel password production without having to prove on its own that Jones owned the phone it's seeking to unlock. Kerr rejects this as well, saying it introduces an evidentiary standard not needed when evidence is still being sought.

Identifying a standard for “subsidiary facts” arises when a trial court must determine what facts to consider to assess whether evidence is admissible at trial. But as explained above, Gelfgatt motions do not involve trial evidence. The only question is whether the Commonwealth can show by clear and convincing evidence that the subject of the order knows the passcode needed to unlock the device. There are no subsidiary facts to consider.

[...]

Adopting the Commonwealth’s preponderance standard for “subsidiary facts” would only water down the clear and convincing evidence standard. To see why, imagine a reliable informant previously told an officer that a criminal suspect regularly used one of two phones found in an abandoned car. But there’s a catch: The officer’s memory is hazy about which phone the informant identified. Based on the officer’s uncertain testimony, the trial court concludes that there is a 51% chance that the informant identified a particular phone as the one the suspect regularly used.

Now imagine the Commonwealth obtains a Gelfgatt order, the suspect pleads the Fifth, and the reviewing judge must determine if the Commonwealth has proven the suspect’s knowledge of that phone’s password by clear and convincing evidence. How should the court treat the officer’s uncertain testimony? Under the Commonwealth’s approach, the judge must treat as 100% certain that the informant identified that particular phone as the one regularly used by the suspect. Because the Commonwealth established the identification of that phone by a preponderance of the evidence, the judge would have to assume it as a true “subsidiary fact” and consider whether the identification showed by clear and convincing evidence that the suspect knew the phone’s password. That would make little sense.

Doubt about the existence of subsidiary facts should not be ignored simply because the existence of those facts is more likely than not.

Here's what Kerr believes the standard should be for compelled decryption:

A clear and convincing evidence standard strikes me as a fair approximation of a burden needed to eliminate that advantage. When the government can show by clear and convincing evidence that it already knows the facts implicit in the suspect’s testimonial acts, it is highly unlikely that the government will obtain any trial advantage from the testimony implicit in that act. The clear and convincing standard is sufficient to be confident that the government need not and will not rely on the testimonial act at trial to prove its case.

If that's the standard, it's unlikely the government has met it. It is lacking several establishing facts tying Jones to the phone seized from him during his arrest. If so, it cannot compel decryption.

The standard for compelled decryption is continually shifting. There's no on-point precedent from the US Supreme Court standardizing this across federal courts and every state has its own Constitution to consider as well during state-level prosecutions.

This will have to be taken up by the Supreme Court at some point, because producing passwords may not be technically testimonial if the government can meet the "foregone conclusion" standard, but it does lead to the production of evidence the government would have had access to otherwise. Analogies about wall safes and combinations only go so far when phones contain far more potential evidence than could possibly fit into a physical hole in the wall.

Then again, the Fifth Amendment only guards against self-incrimination. What's on locked devices may be incriminating, but unlocking a device only proves you can unlock it. If this element can't be used against a person in court, the government must still link evidence found to the criminal charges sought without drawing inferences from the compelled decryption itself. In many cases, this act won't prove essential to the government's case, even if the wealth of information unveiled ultimately helps secure a conviction.

Since the lines are still muddy, it may be in law enforcement's best interest to seek outside help cracking cellphones, rather than relying on something some courts may find testimonial, or otherwise determine the government hasn't met its burden to compel decryption. The future is going to filled with cases like these, and there's a good chance courts will need to spend more time discussing the implications of other security measures -- like fingerprints and facial recognition -- in terms of Fifth Amendment protections. For now, though, there's a poorly-defined standard making life more difficult for everyone involved in the judicial process to determine what can or can't be done without violating rights.

Filed Under: 5th amendment, compelled decryption, dennis lee jones, encryption, massachusetts, passwords

Indiana Appeals Court Says Forcing Someone To Unlock Their Phone Violates The 5th Amendment

from the we'll-take-a-win,-no-matter-how-small dept

Passwords and PINs still beat fingerprints when it comes to the Fifth Amendment. But just barely. Nothing about the issue is settled, but far more cases have been handed down declaring fingerprints to be non-testimonial. Fingerprints are obtained during the booking process -- a physical, traceable representation of the suspect. If they can be obtained during booking, they can certainly be obtained again to unlock a device. A physical aspect of a human being can't be considered "testimonial" as far as courts have interpreted the Fifth Amendment.

Passwords are a different story, but not by much. In a handful of cases, courts have said the compelled production of passwords and PINs has no Fifth Amendment implications. Defendants, conversely, have argued compelled password production forces them to testify against themselves by facilitating the production of evidence to be used against them.

This argument hasn't had much success. Judges have frequently found password production to be just as non-testimonial as a person's fingerprint. The argument here is that all law enforcement wants is a password, not the production of evidence. Under the "foregone conclusion" theory, all the government has to prove is that the person being asked to unlock a device can unlock the device.

This decouples password production from its consequences: the production of evidence by defendants that the government will use against them in court. When this theory is applied, the Fifth Amendment is sidelined and replaced with the ultra-low bar of foregone conclusion.

But passwords aren't fingerprints and can be testimonial. Unlocking a device law enforcement is going to search for evidence states clearly that a person owns or controls the device and its contents. That makes it very easy for the government to link a device's illicit contents to the person who was ordered to unlock it.

A case from Indiana's Court of Appeals -- via FourthAmendment.com -- addresses these arguments with a bit more sympathy for compelled testimony arguments. The government argued there's nothing testimonial about a password. The court, in a lengthy decision [PDF], disagrees.

[W]e consider [Kaitlin] Seo’s act of unlocking, and therefore decrypting the contents of her phone, to be testimonial not simply because the passcode is akin to the combination to a wall safe as discussed in Doe. We also consider it testimonial because her act of unlocking, and thereby decrypting, her phone effectively recreates the files sought by the State. As discussed above, when the contents of a phone, or any other storage device, are encrypted, the cyphertext is unintelligible, indistinguishable from random noise. In a very real sense, the files do not exist on the phone in any meaningful way until the passcode is entered and the files sought are decrypted. Thus, compelling Seo to unlock her phone goes far beyond the mere production of paper documents at issue in Fisher, Doe, or Hubbell. Because compelling Seo to unlock her phone compels her to literally recreate the information the State is seeking, we consider this recreation of digital information to be more testimonial in nature than the mere production of paper documents.

The court also says there's nothing to the government's argument that unlocking a phone for police is somehow different -- and less of a Fifth Amendment issue -- than turning over a password to police.

[B]ecause we believe that electronic data and the devices that contain it are fundamentally different than paper documents and paper storage, we reject the State’s attempt to distinguish between compelling Seo to convey her passcode to the State and compelling Seo to simply unlock her phone by entering the passcode itself. It is a distinction without a difference because the end result is the same: the State is compelling Seo to divulge the contents of her mind to obtain incriminating evidence.

This decision shores up Fifth Amendment arguments against compelled decryption and password production. The state appeals court then goes further, instructing state judges and law enforcement agencies to seek less invasive -- and less constitutionally-problematic -- methods of obtaining evidence.

Going forward, we ask reviewing courts of last resort to consider the following structure for resolving decryption requests from law enforcement authorities:

1. Requiring a defendant to decrypt digital data should be legally recognized for what it is—coerced recreation of incriminating evidence— and compulsory process for that purpose should be strictly limited for precisely that reason.

2. In some instances, law enforcement officials will have legitimate need of digital information that is protected by encryption.

3. If the law enforcement request is a bona fide emergency, with verified concern about the possibility of further and immediate serious criminal acts, a warrant that describes the other imminent crime(s) suspected and the relevant information sought through a warrant, both with reasonable particularity, will likely satisfy Fourth and Fifth Amendment requirements.

4. In non-emergency situations, law enforcement should be required to first seek the digital data it wants from third parties, such as internet “cloud” sources, cellphone companies, or internet providers (ISPs), where a defendant has practically, if not explicitly, consented to production upon legal process from a court of competent jurisdiction.

5. Exceptions to the Fourth Amendment and its state analogues, such as the plain view doctrine and the good faith exception, should be inapplicable to, or strictly limited in, the search and seizure of digital data stored on devices owned or controlled by that defendant, or from “Cloud” subscriptions that defendant owns or uses.

It's a thoughtful decision that runs contrary to many rulings covering the same subject. But it is limited to the state of Indiana, so it's not going to undo any federal precedent. But it does give those representing clients facing demands for password production another citation in their favor. More importantly, it sets a new baseline for lawful demands for data production, wresting control away from law enforcement agencies unlikely to impose these constraints of their own.

Filed Under: 4th amendment, 5th amendment, indiana, kaitlin seo, phone unlocking

Another Federal Court Says Compelled Decryption Doesn't Raise Fifth Amendment Issues

from the not-a-blanket-statement,-but-more-often-than-not dept

Another federal court is wrestling with compelled decryption and it appears the Fifth Amendment will be no better off by the time it's all over. A federal judge in North Carolina has decided compelling decryption of devices is only a small Fifth Amendment problem -- one that can be overlooked if the government already possesses certain knowledge. [h/t Orin Kerr]

The defendant facing child porn charges requested relief from a magistrate's order to compel decryption. The government isn't asking Ryan Spencer to turn over his passwords. But it wants exactly the same result: decrypted devices. The government's All Writs Order demands Spencer unlock the devices so law enforcement can search their contents. As the court notes in the denial of Spencer's request, the Fifth Amendment doesn't come into play unless the act of production -- in this case, turning over unlocked devices -- is both "testimonial" and "incriminating."

Spencer argued both acts are the same. The government may not ask him directly for his passwords, but a demand he produce unlocked devices accomplishes the same ends. As the court notes, the argument holds "superficial appeal." It actually holds a bit more than that. A previous dissenting opinion on the same topic said the government cannot compel safe combinations by "either word or deed."

This opinion [PDF], however, goes the other way. Judge Breyer likes the wall safe analogy, but arrives at a different conclusion than Justice Stevens did in an earlier dissent. The court finds drawing a Fifth Amendment line at password protection would produce a dichotomy it's not willing to accommodate.

[A] rule that the government can never compel decryption of a password-protected device would lead to absurd results. Whether a defendant would be required to produce a decrypted drive would hinge on whether he protected that drive using a fingerprint key or a password composed of symbols.

The refusal to craft this bright line ultimately makes little difference. The line already exists. Almost no courts have said the compelled production of fingerprints is a Fifth Amendment violation. Producing passwords, however, is an issue that's far from settled. In the cases that have gone the government's way, the key appears to be what the government already knows: the "foregone conclusions." The same goes here.

The court admits producing unlocked devices strengthens the government's case even before any searches take place.

So: the government’s request for the decrypted devices requires an act of production. Nevertheless, this act may represent incriminating testimony within the meaning of the Fifth Amendment because it would amount to a representation that Spencer has the ability to decrypt the devices. See Fisher, 425 U.S. at 410. Such a statement would potentially be incriminating because having that ability makes it more likely that Spencer encrypted the devices, which in turn makes it more likely that he himself put the sought-after material on the devices.

But that only deals with the incrimination side. Is it testimonial? The court thinks it isn't. Or at least, it believes whatever testimonial value it adds is almost nonexistent. All the government needs to show is that the defendant has the ability to unlock the devices.

Turning over the decrypted devices would not be tantamount to an admission that specific files, or any files for that matter, are stored on the devices, because the government has not asked for any specific files. Accordingly, the government need only show it is a foregone conclusion that Spencer has the ability to decrypt the devices.

It's a low bar but one that's sometimes difficult to reach if the government can't clearly link the defendant to the locked devices obtained during the search of a residence or business. As the court notes, it requires more than a reasonable assumption that files the government seeks might reside on the locked devices.

But it is nonsensical to ask whether the government has established with “reasonable particularity” that the defendant is able to decrypt a device. While physical evidence may be described with more or less specificity with respect to both appearance and location, a defendant’s ability to decrypt is not subject to the same sliding scale. He is either able to do so, or he is not. Accordingly, the reasonable particularity standard cannot apply to a defendant’s ability to decrypt a device.

The government needs far more if it seeks to compel decryption.

The appropriate standard is instead clear and convincing evidence. This places a high burden on the government to demonstrate that the defendant’s ability to decrypt the device at issue is a foregone conclusion. But a high burden is appropriate given that the “foregone conclusion” rule is an exception to the Fifth Amendment’s otherwise jealous protection of the privilege against giving self-incriminating testimony.

And the court finds the government does possess clear, convincing evidence.

All three devices were found in Spencer’s residence. Spencer has conceded that he owns the phone and laptop, and has provided the login passwords to both. Moreover, he has conceded that he purchased and encrypted an external hard drive matching the description of the one found by the government. This is sufficient for the government to meet its evidentiary burden. The government may therefore compel Spencer to decrypt the devices.

There is one caveat, however.

Once Spencer decrypts the devices, however, the government may not make direct use of the evidence that he has done so.

As the court points out, if the government's foregone conclusion is the correct conclusion, additional evidence linking Spencer to the locked devices will be unnecessary. The government should have no use for the testimony inherent in the act -- the concession that Spencer owned and controlled the now-unlocked devices, making him ultimately criminally responsible for any evidence located in them.

In terms of compelled production, passwords continue to beat fingerprints for device security, but only barely.

Filed Under: 5th amendment, all writs act, decryption, due process, encryption, north carolina, passwords, ryan spencer

Device Detects Drug Use Through Fingerprints, Raising A Host Of Constitutional Questions

from the defendant-has-indicated-gov't-will-receive-'two-fingers-while-he's-s dept

If this tech becomes a routine part of law enforcement loadouts, judicial Fourth and Fifth Amendment findings are going to be upended. Or, at least, they should be. I guess citizens will just have to see how this all shakes out.

A raft of sensitive new fingerprint-analysis techniques is proving to be a potentially powerful, and in some cases worrying, new avenue for extracting intimate personal information—including what drugs a person has used.

[...]

The new methods use biometrics to analyze biochemical traces in sweat found along the ridges of a fingerprint. And those trace chemicals can quickly reveal whether you have ingested cocaine, opiates, marijuana, or other drugs. One novel, noninvasive forensic technique developed by researchers at the University of Surrey in the United Kingdom can detect cocaine and opiate use from a fingerprint in as little as 30 seconds. The team collected 160 fingerprint samples from 16 individuals at a drug-treatment center who had used cocaine within the past 24 hours—confirmed by saliva testing—along with 80 samples from non-users. The assay—which was so sensitive that it could still detect trace amounts of cocaine after subjects washed their hands with soap—correctly identified 99 percent of the users, and gave false positive results for just 2.5 percent of the nonusers, according to a paper published in Clinical Chemistry.

Let's discuss the phrase "non-invasive." It was relatively non-invasive when fingerprints were simply used to identify people. (That science isn't exactly settled, but we'll set that aside for now.) When smartphones and other devices used fingerprint scanners for ID, the "non-invasive" application of fingerprints was no longer non-invasive. An identifying mark, possessing no Fifth Amendment protection, gave law enforcement and prosecutors the option of using something deemed "non-testimonial" to obtain plenty of evidence to be used against the fingerprinted.

This opens up a whole new Constitutional Pandora's Box by giving officers the potential to apply fingerprints during traffic stops to see if they can't generate enough probable cause to perform a warrantless search of the car and everyone in it. It's generally criminal to possess drugs. Evidence of ingested drugs means suspects possessed them at some point in time, but evidence of drug use is generally only useful in driving under the influence cases. That's in terms of prosecutions, though. For roadside searches -- where officers so very frequently "smell marijuana" -- evidence of drug use is a free pass for warrantless searches.

That's just the Fourth Amendment side. The Fifth Amendment side is its own animal. Evidence obtained through fingerprints would seemingly make the production of fingerprints subject to Fifth Amendment protections. It should at least rise to the level of blood draws and breath tests, even though this is far more intrusive (in terms of evidence obtained) than tech normally deployed at DUI checkpoints. Blood draws often require warrants. Breath tests, depending on surrounding circumstances, aren't nearly as settled, with courts often finding obtaining carbon dioxide from breathing humans to be minimally testimonial.

As Scott Greenfield points out, the first tests of constitutionality will occur at street level. Cops will deploy the tech, hoping to good faith their way past constitutional challenges.

Precedent holds that the police are authorized to seize people’s fingerprints upon arrest, as the Fifth Amendment does not apply to physical characteristics. But the rubric is “fingerprints can be seized” based on their limited utility as physical characteristics used for identification purposes.

If they should be used for entirely different purposes, for the ascertainment of whether a person ingested drugs, then the rationale allowing the seizure of prints under the Fifth Amendment no longer applies. It certainly won’t be in the cops’ best interests to draw this distinction, to limit their use of prints to the purpose for which they’re allowed and to demonstrate constitutional restraint by not exceeding that purpose.

This means everything will get much worse for drivers and other recipients of law enforcement attention in the short-term. When the challenges to searches and seizures filter their way up through the court system, things might improve. But it won't happen rapidly and any judges leaning towards redefining the scope of fingerprint use will face strong government challenges.

It will probably be argued evidence of drug use obtained through these devices is no different than a cop catching a whiff of marijuana. On one hand, no cop could credibly claim to be able to detect drug use simply by touching someone's fingers. On the other hand, the reasonable reliability of the tech makes challenges more difficult than arguing against an officer's claim they smelled drugs during the traffic stop. The key may be predicating a challenge on the fact that the device actually tests sweat, not fingerprints, making it an issue of bodily fluids again and (slightly) raising the bar for law enforcement.

This news isn't disturbing for what it is. The obvious initial application is in workplaces, where random drug tests are standard policies for many companies. That tech advancements would progress to this point -- a 10-minute test that requires only the momentary placement of a finger on a test strip -- was inevitable. It's what comes after that will be significant. Courts have often cut law enforcement a lot of slack and tend to lag far behind tech developments and their implications on Constitutional rights. A new way to obtain evidence using something courts generally don't consider to be testimonial is going to disrupt the Constitution. Hopefully, the courts will recognize the distinction between identification and evidence and rule appropriately.

Filed Under: 4th amendment, 5th amendment, biometrics, drugs, fingerprints, forensics, law enforcement

Another Court Says Compelled Password Production Doesn't Violate The Fifth Amendment

from the another-option-that-isn't-an-encryption-backdoor dept

Another court has decided compelled password production isn't a violation of the Fifth Amendment. The Massachusetts case [PDF], titled "In the Matter of a Grand Jury Investigation," concerns allegations of child abuse. The grand jury requested access to the contents of the suspect's phone. The government obtained a warrant but sought a court order compelling the suspect to produce a password to unlock it. The court granted it and the suspect challenged the order after being hit with contempt charges for failing to turn over the password. (via FourthAmendment.com)

The court finds no problem with the government's reasoning. According to the court, the ownership of the phone is the only "foregone conclusion" the government needs to reach.

Here, the Commonwealth demonstrated sufficient knowledge to show that the factual statements that the petitioner's act of entering his PIN code would convey are foregone conclusions. As summarized in the grand jury materials submitted to the judge under seal, the Commonwealth already knew that the iPhone contained files that were relevant to its investigation based, in part, on information provided by the petitioner. In addition, the Commonwealth knew that a PIN code was necessary to access the iPhone, that the petitioner possessed and controlled the iPhone, and that the petitioner knows the PIN code and is able to enter it. Accordingly, the Commonwealth established independently and with specificity the authenticity, existence, and possession of the compelled information.

Because of this low bar, the government can seek compelled access, even if the production of the password might result in evidence the government can use against the suspect.

Thus, the order does not require the petitioner to communicate information that would fall within constitutional self-incrimination protection. The affidavit in support of the search warrant application established that the Commonwealth had probable cause to believe that the iPhone contained evidence of the crimes that are the subject of the grand jury investigation. The order simply allows execution of that warrant.

This result is unsurprising, considering the only thing the government must prove is the locked device is owned or controlled by the person refusing to provide a password. There's a little variance between courts on the subject of "foregone conclusion," but the bar remains low enough most prosecutors and law enforcement agencies should be able to hit it. Of course, there's always a chance a person would rather spend an indefinite amount of time in jail on contempt charges rather than grant access to evidence to be used against them in a criminal trial.

This gives the government a considerable amount of leverage in cases like these. Considering courts are routinely sympathetic to "foregone conclusion" arguments, it's odd the courts haven't been hit with a massive influx of cases like these since the 2015 switch to default device encryption.

We hear from the FBI and prosecutors like Cy Vance that thousands of locked phones are sitting around law enforcement offices with no options for accessing their contents. It would seem compelled production is a pretty safe bet. Even if it doesn't result in device access, it would at least result in contempt charges, which would probably motivate more people into allowing access. But we just haven't seen that happen, which suggests the entities make the loudest noises about encryption aren't making a good faith effort to use every option available to them.

Filed Under: 5th amendment, compelled password production, passwords