Another Illinois Appeals Court Handles Compelled Password Production, Says There's No Fifth Amendment Issue Here

from the residents'-rights-are-now-determined-by-where-they-reside-in-the-state dept

The Fifth Amendment implications of compelled password production has reverted from "somewhat settled" to "not settled at all" in the state of Illinois.

In 2019, an Illinois appellate court said the Fifth Amendment protects people against compelled password production to unlock devices. As the court pointed out in that decision, investigators had zero interest in the password itself. They were interested in what it would give them access to, which was all the evidence allegedly on the locked phone.

The state relied on the "foregone conclusion" theory. In the government's view, the only information it needed to know with certainty is that the phone belonged to the suspect and that the suspect knew the passcode to unlock it. But the appellate court said that wasn't the right conclusion. What investigators wanted was access to the phone's contents, and it could not compel production of a passcode just to see if its guess about evidence contained in the phone was correct.

Here, the State is not seeking the passcode per se but the information it will decrypt. The cases that declare the passcode to be a nontestimonial communication operate under the framework that the passcode is the testimonial communication and that it falls under the foregone conclusion exception to the fifth amendment privilege. We consider that the proper focus is not on the passcode but on the information the passcode protects. The State claims it sustained its burden of proving with reasonable particularity that it knew the passcode existed, that Spicer knew the passcode and that it would be authenticated by entering it into Spicer’s phone. However, what the State actually needed to establish with reasonable particularity was the contents of the phone, which it did not do.

That decision didn't settle every open question about the Fifth Amendment's application to locked devices and compelled production, but it did set a baseline for law enforcement to reach if it expected courts in this district to ask for orders demanding the surrender of passcodes.

But that was the Third District. The Fourth District Appellate Court has a different set of standards and it has sided [PDF] with the state, finding that the Fifth Amendment doesn't apply to compelled production. (via FourthAmendment.com)

The trial court sided with the defendant, saying the state had not met its "foregone conclusion" burden and recognizing the constitutional implications of, in essence, forcing someone to testify against themselves by compelling access to possibly incriminating evidence. It specifically cited the 2019 Third District Appeals Court decision in its opinion.

[R]elying on Spicer, the court found that, for the doctrine to apply, the State must show with reasonable particularity that, when it sought the act of production, it “knew the evidence existed, the evidence was in the [d]efendant’s possession and it was authentic.” The court noted (1) a valid search warrant had issued for the phone’s contents, which defendant did not challenge, and (2) law enforcement has a right to access the contents of the cell phone. The court concluded, however, that it “would be speculation to presume at this point that the photograph would still be on the phone,” and it “[could not] find here that it’s more likely to be found on the [d]efendant’s phone any more than it might be on the [co-defendant’s] phone.” Accordingly, the court found that the State did not show the foregone conclusion doctrine applied and denied the State’s motion to compel defendant to provide access to his cell phone.

The Appellate Court disagrees with this assessment. It sets the "foregone conclusion" bar much lower than the Third District did, saying the only thing the government needs to know is whether or not the phone likely belongs to the defendant and that they likely have the ability to unlock it.

Investigators obtained phone records linking the seized phone to the defendant and double-checked this by calling the number listed on the phone records. The lockscreen showed the incoming call from the police station phone, adding more evidence that the phone held by investigators belonged to the suspect facing fraud charges.

To reach this conclusion, the court considers -- and discards -- rulings from the state and federal level that found that compelled production is a form of testimony. Instead, it decides that punching in a passcode is an effort so free of mental effort it's no different than a fingerprint or a blood sample.

The questions raised in Stahl and Andrews regarding the continued viability of the key/combination analogy (i.e., mental/physical dichotomy) in the digital age deserve consideration. We, too, observe that a cell phone passcode is a string of letters or numbers that an individual habitually enters into his electronic device throughout the day. A passcode may be used so habitually that its retrieval is a function of muscle memory rather than an exercise of conscious thought. A fair question that arises, then, is whether the rote application of a series of numbers should be treated the same as the Hubbell respondent’s “exhaustive use of the ‘contents of his mind’ ” to produce hundreds of pages of responsive documents. The two scenarios appear to bear no resemblance to each other.

Going further, the court says the defendant isn't actually going to be telling investigators anything. He is not being ordered to turn over his passcode, but rather enter it to unlock the phone investigators have a warrant to search. While the lower court was correct to rely on precedent set in 2019, the precedent doesn't make any difference in this district.

After comparing conflicting opinions from across the nation on what "foregone conclusion" needs to be reached (a. phone can be unlocked by the defendant, or b. phone contains evidence relevant to the case), the court decides it's the former.

Placing the focus of the foregone conclusion doctrine on the passcode rather than the documents or evidence contained on the phone appears to strike the most appropriate balance between fifth amendment concerns and fourth amendment concerns. In this case, the State’s motion seeks the compelled production of the passcode. The production of the passcode will lead to the contents of the phone, for which the State has obtained a valid search warrant that defendant does not challenge.

According to this appeals court, finding otherwise would allow defendants to hide behind the Fifth Amendment even when the Fourth Amendment has been satisfied.

[H]e seeks to utilize the fifth amendment to prevent the operation of the fourth amendment, which authorizes (as here) the issuance of a search warrant based upon a verified complaint showing probable cause for the presence of evidence of a crime in the premises (here, the cell phone) to be searched.

By focusing (1) the fifth amendment analysis on the production of the passcode and (2) the fourth amendment analysis on the evidence contained on the phone, one constitutional provision does not become either superior or subservient to the other. Further, doing so ensures that the protection against compelled self-incrimination and the interests of law enforcement in executing a valid search warrant are both respected.

That's how it stands in the Fourth District. Even though it disagrees with the Third District's conclusions, it can't actually override that precedent. So, the Fifth Amendment has differing levels of protections depending on which district is handling criminal cases involving compelled production of passwords. Sooner or later, the state's top court is going to need to step in and reconcile these differences.

Filed Under: 5th amendment, compelled password production, illinois, passwords, self-incrimination

DOJ Asks DC Court To Compel Decryption Of Device Seized In A Capitol Raid Case

from the be-careful-what-you-ask-for dept

The DOJ is testing some waters it may not want to be troubling, not with hundreds of prosecutions stemming from the January 6 Capitol raid on the docket. It has asked the DC court to compel a defendant to decrypt his laptop so the FBI can search it for evidence. (h/t Marcy Wheeler)

The government is seeking an All Writs Act order [PDF] forcing the alleged device owner to unlock the device using either his face or his passcode.

The government respectfully moves for an order compelling the defendant to produce a critical piece of evidence – his Microsoft Surface Pro laptop computer – in an unencrypted state. The government proposes a two-step process: First, the defendant should be ordered to place his face in front of the computer’s camera, so that the computer can be biometrically unlocked. Second, if the biometric attempt does not unlock the computer, the defendant should be ordered to type his passcode or PIN into the computer.

Having failed to obtain consent, the government is now hoping to achieve this by force. This isn't a particularly wise idea considering how many cases it's currently juggling in this circuit. If the court decides this violates the Fifth Amendment, it may negatively affect other prosecutions involving secured devices.

The government argues there's no Fifth Amendment issue here.

The requested relief would not violate the defendant’s Fourth or Fifth Amendment rights. With respect to the Fourth Amendment, there is only minimal intrusion on the defendant’s privacy, and there is probable cause that the defendant’s face can unlock the Subject Device (and lead to the recovery of relevant evidence). With respect to the Fifth Amendment, Reffitt’s entering his password into the Subject Device does not violate his privilege against self-incrimination, because his act of production would not be testimonial, since the only potentially testimonial component implicit in his act of producing the unlocked/unencrypted device is a foregone conclusion.

This will come down to what the court feels the phrase "foregone conclusion" actually means. While the act itself (either presenting biometrics or providing a passcode) isn't necessarily testimonial, it does give the government access to evidence that might be used against the person being compelled to grant access to this information. At least one court has found that entering passwords and providing evidence are basically the same thing, since the first naturally leads to the latter. The government has no interest in the password, even though that's what it is seeking to compel. It's interested in what having that password entered will provide.

If the only foregone conclusion the government needs to have in its possession is who owns the computer, obviously compelled decryption will help establish ownership. The government appears to know whose computer it is. The Surface Pro targeted by the proposed order displays the name of the defendant (Guy Reffitt) on the screen when opened. And, despite Reffitt (initially) telling investigators otherwise, one of Reffitt's family members confirmed it belonged to the defendant.

Having that much information on hand might be enough to compel decryption if the court decides the only foregone conclusion the government needs to reach is the most likely owner of the device it's seeking to unlock. But if the foregone conclusion bar is set higher -- a likely source of criminal evidence -- things will get much more difficult for the government.

The government is basing this request on the theory that recordings captured at the Capitol by the suspect's helmet-mounted camera were moved to the laptop for storage prior to their deletion from the camera. However, the government seized multiple devices from the defendant's home, including three phones, two other laptops, and one desktop computer. Most of those have been searched already and determined they don't hold any relevant data.

The government is assuming -- based on statements by family members who viewed recordings on that device -- that's where the recordings it is seeking are now located. But it won't know this until after it performs a search. And it can't perform a search until the device is unlocked. This assumption is credible, but the files could have been uploaded to the cloud and viewed on the device, which means the files the government concludes (in a foregone way) must reside on the laptop possibly aren't actually there.

If the court decides the government doesn't have more than a hunch at this point, it may deny this order. And it may decide to lay down some Fifth Amendment ground rules that eliminate compelled production as an option. This is a roll of the Constitutional dice the government may later regret -- a rerun of its failure to compel decryption assistance in the San Bernardino case. But if it goes the other way, it will become that much easier for the government to pursue prosecutions in a district that handles an outsized portion of the DOJ's cases.

Filed Under: 4th amendment, 5th amendment, all writs act, decryption, doj, encryption, facial recognition, january 6th, unlocking

Another Florida Appeals Court Says Compelled Passcode Production Violates The Fifth Amendment

from the brace-yourself-for-a-whole-new-wave-of-anti-encryption-bitching dept

Things are getting pretty unsettled in Florida in terms of compelling the production of phone passcodes. Less than a half-decade ago, refusing to produce passwords netted people contempt charges. As these cases moved forward through the court system, the legal calculus changed. As it stands now, state appeals courts in two Florida districts have found that forcing people to give up passcodes violates the Fifth Amendment. But there's still some settling left to do and the First District has asked the state's top court to take a look at the issue.

The latest development comes from Florida's Fifth District, where another state appeals court has reached the same conclusion as the others: passcodes are testimonial, and forcing people to turn them over implicates the Fifth Amendment. (via FourthAmendment.com)

The case deals with some targeted vandalism and alleged stalking. Investigators feel the phone they found at the crime scene belongs to the suspect and contains evidence to support the aggravated stalking charges. (The victim also apparently found a GPS device attached to her car, presumably placed there by the suspect.)

The decision [PDF] recounts the state's bizarre argument at the trial court level -- one that claimed demanding a passcode from the suspect was not an "intrusion."

Because Garcia’s smartphone was passcode protected, law enforcement was unable to unlock the phone to conduct the search. The State then moved to compel Garcia to provide the passcode, alleging in its motion that the contents of Garcia’s phone “are relevant to how the events occurred and whether [Garcia] is guilty,” and that providing the passcode would “involve no unreasonable intrusions upon the body of [Garcia].”

The trial court bought the state's arguments and its "foregone conclusion" assumption and granted the motion to compel.

It orally found that providing the passcode was non-testimonial and thus, “the Stahl decision is controlling here.”

The decision the trial court cited (but didn't discuss in its ruling) was handed down by the Second District Appeals Court in 2016. In that case, the court decided a passcode was non-testimonial because the passcode itself didn't give the state anything it didn't already possess. But, as was pointed out by the Fourth District in its decision in favor of the Fifth Amendment, the Stahl decision misses the point:

Contrary to the Stahl court’s conclusion, which the trial court adopted, the “evidence sought” in a password production case such as this is not the password itself; rather, it is the actual files or evidence on the locked phone.

But that's all the trial court used here and it did so without explaining any of its reasoning in a written order. The appeals court says Stahl controls nothing because the Stahl decision did not correctly address the issue.

In Stahl, law enforcement obtained a warrant to search the defendant’s locked phone, but the defendant refused to provide them with his passcode. The State filed a motion to compel production of the passcode, which the trial court denied, finding the production of the passcode to be testimonial. The Second District Court quashed the order, holding that compelling the defendant to reveal his passcode was not testimonial because the passcode was “sought only for its content and the content has no other value or significance.”

We respectfully disagree with the Second District Court. Distilled to its essence, the revealing of the passcode is a verbal communication of the contents of one’s mind. (“As a passcode is necessarily memorized, one cannot reveal a passcode without revealing the contents of one’s mind.”). We agree with Garcia that the order under review requires that he utilize the contents of his mind and disclose specific information regarding the passcode that will likely lead to incriminating information that the State will then use against him at trial. We therefore conclude that the compelled disclosure of his passcode is testimonial and is protected by the Fifth Amendment.

The "foregone conclusion" exception doesn't work here either. The court says US Supreme Court precedent deals with the production of documents, not oral testimony. Since the court considers oral revelation of a passcode "testimonial," it's unwilling to extend this exception to cover it. Doing so would "narrow" a right without adequate justification.

In summary, we hold that compelling a defendant, such as Garcia, to provide orally the passcode to his smartphone is a testimonial communication protected under the Fifth Amendment and that the foregone conclusion exception or doctrine does not apply to compelled oral testimony.

This decision also asks the Florida Supreme Court to weigh in on this issue and hand down precedent for the state. The appellate level appears to lean heavily towards recognizing compelled production to be a Fifth Amendment violation. Meanwhile, trial courts are acting as though the question was already settled by a single 2016 decision handed down by a single appellate district, ignoring every ruling that's been handed down since then. This should happen sooner rather than later. The issue is too big to ignore.

Filed Under: 5th amendment, compelled production, florida, passcodes

New Jersey Supreme Court Says 'Forgone Conclusion' Trumps Fifth Amendment In Crooked Cop Case

from the tired:-4th-Amendment-exceptions-wired:-Fifth-Amendment-exceptions dept

The New Jersey Supreme Court has made the Fifth Amendment discussion surrounding compelled production of passwords/passcodes more interesting. And by interesting, I mean frustrating. (h/t Orin Kerr)

The issue is far from settled and the nation's top court hasn't felt like settling it yet. Precedent continues to accumulate, but it's contradictory and tends to hinge on each court's interpretation of the "foregone conclusion" concept.

If the only conclusion that needs to be reached by investigators is that the suspect owns the device and knows the password, it often results in a ruling that says compelled decryption doesn't violate the Fifth Amendment, even if it forces the suspect to produce evidence that could be used against them. Less charitable readings of this concept recognize that "admitting" to ownership of a device is admitting to ownership of everything in it, and view the demand for passcodes as violating Fifth Amendment protections against self-incrimination. The stronger the link between the suspect and the phone, the less Fifth Amendment there is to go around.

This decision [PDF] deals with a crooked cop. Sheriff's officer Robert Andrews apparently tipped off a drug dealer who was being investigated. The dealer tipped off law enforcement about Andrews' assistance with avoiding police surveillance -- something that involved Officer Andrews telling the drug suspect to ditch phones he knew were being tapped and giving him information about vehicles being used by undercover officers.

Two iPhones were seized from Andrews who refused to unlock them for investigators. Investigators claimed they had no other option but force Andrews to unlock them. According to the decision, there was no workaround available at that time (at some point in late 2015 or early 2016).

According to the State, its Telephone Intelligence Unit was unable to search Andrews’s iPhones -- an iPhone 6 Plus and an iPhone 5s -- because they “had iOS systems greater [than] 8.1, making them extremely difficult to access without the owner/subscriber’s pass code.” A State detective contacted and conferred with the New York Police Department’s (NYPD) Technical Services unit, as well as a technology company called Cellebrite, both of which concluded that the cellphones’ technology made them inaccessible to law enforcement agencies. The detective also consulted the Federal Bureau of Investigation’s Regional Computer Forensics Laboratory, which advised that it employed “essentially the same equipment used by” the State and NYPD and would be unable to access the phones’ contents. The State therefore moved to compel Andrews to disclose the passcodes to his two iPhones.

Apple implemented encryption-by-default in September 2014. Andrews was arrested in July 2015. This would be about the same time the DOJ was trying to force Apple to crack open an iPhone for it in the San Bernardino shooting case. This was ultimately resolved by an outside contractor (most likely Cellebrite), but it appears that no one had a workable solution when investigators in this case attempted to crack the seized phones.

Andrews challenged the compelled production of passcodes, claiming this violated his Fifth Amendment rights. The trial court disagreed, as did the state appeals court. The state's top court arrives at the same conclusion.

The state argued it actually knew far more than what's needed to clear the "foregone conclusion" bar.

[T]he State argues that communication between co-conspirators has no special privacy status, that the State “has established . . . that it already knows what is on the phone[s],” and that the State has a superior right to the contents of the phones because of the unchallenged search warrant.

The court finds in favor of the state, but it does recognize that passcodes are more testimonial than fingerprints or other biometric features used to unlock devices.

A cellphone’s passcode is analogous to the combination to a safe, not a key. Communicating or entering a passcode requires facts contained within the holder’s mind -- the numbers, letters, or symbols composing the passcode. It is a testimonial act of production.

It also recognizes there may be no clear way to distinguish between passcodes and biometrics when dealing with compelled production.

We also share the concerns voiced by other courts that holding passcodes exempt from production whereas biometric device locks may be subject to compulsion creates inconsistent approaches based on form rather than substance. The distinction becomes even more problematic when considering that, at least in some cases, a biometric device lock can be established only after a passcode is created, calling into question the testimonial/non-testimonial distinction in this context.

The court says the state has proven enough to be granted the "foregone conclusion" exception to the Fifth Amendment.

The State’s demonstration of the passcodes’ existence, Andrews’s previous possession and operation of the cellphones, and the passcodes’ self-authenticating nature render the issue here one of surrender, not testimony, and the foregone conclusion exception to the Fifth Amendment privilege against self-incrimination thus applies. Therefore, the Fifth Amendment does not protect Andrews from compelled disclosure of the passcodes to his cellphones.

The dissent disagrees. It says that although the tech has changed, the underlying principles of the Fifth Amendment haven't. And it's not just the dissent saying this. It's also the nation's top court, which has never held that the compelled production of incriminating testimony complies with the Constitution.

In a world where the right to privacy is constantly shrinking, the Constitution provides shelter to our innermost thoughts -- the contents of our minds -- from the prying eyes of the government. The right of individuals to be free from the forced disclosure of the contents of their minds to assist law enforcement in a criminal investigation, until now, has been an inviolate principle of our law, protected by the Fifth Amendment and our state common law. No United States Supreme Court case presently requires otherwise. No case from this Court has held otherwise. That protection deserves utmost respect and should not be lessened to authorize courts to compel a defendant to reveal the passcode to a smartphone so law enforcement can access its secured contents.

Given the current split in both federal district courts and state courts on the issue, the dissent says the New Jersey Supreme Court shouldn't be an enabler of potential Fifth Amendment violations in the absence of US Supreme Court precedent.

Until the Court clarifies its intentions about application of the act of production doctrine in this setting, I would follow the only sure directional signs the Court has given…

Things may be slightly harder for investigators at the moment, but it's not the court's role to make things easier for the government. They're supposed to be a check against government power grabs, not an ally in its attempts to limit the protections it supposedly granted to its citizens. We live in a "golden age of surveillance." There's more information available in unencrypted form than there's ever been. And the arms race between device makers and encryption crackers is ongoing. It hasn't ended and device encryption has not been declared the winner.

Law enforcement must find another means of obtaining access to the encrypted substantive information on two cell phones whose contents it wishes to search and for which the government has a search warrant. Technological barriers must be overcome without sacrificing constitutional, deep-seated historical protections against governmental intrusions forcing individuals to become assistants in their own prosecutions. Modern technology continues to evolve, bringing new problems; but it also may bring new solutions.

But that's just the dissent. The majority says the Fifth Amendment can be bypassed if the state can find enough connective tissue between the locked device and the person who refuses to unlock it.

Filed Under: 5th amendment, compelled production, encryption, new jersey, new jersey supreme court, passwords, robert andrews

Indiana Supreme Court Says Compelled Decryption Of Smartphones Violates The Fifth Amendment

from the maybe-some-federal-legislation-will-make-this-all-irrelevant dept

Two years ago, the Indiana state Appeals Court ruled residents could not be compelled to unlock devices by law enforcement -- not at the drop of a warrant. To compel the production of a password, law enforcement needs to have a certain amount of information in hand before it can ask courts to hit uncooperative criminal suspects with contempt charges.

The Appeals Court decision raised an interesting point about device encryption. Without decryption, the alleged criminal evidence is nothing more than a scramble of bits and bytes of no use to anyone. With the correct password in place, the data is reintegrated into something usable -- which turns the production of a password into a testimonial act.

In a very real sense, the files do not exist on the phone in any meaningful way until the passcode is entered and the files sought are decrypted. Thus, compelling Seo to unlock her phone goes far beyond the mere production of paper documents at issue in Fisher, Doe, or Hubbell. Because compelling Seo to unlock her phone compels her to literally recreate the information the State is seeking, we consider this recreation of digital information to be more testimonial in nature than the mere production of paper documents.

The state appealed the decision but there's nothing positive waiting for it at Indiana's top court. (via EPIC)

The state Supreme Court says compelling production of passwords violates the Fifth Amendment. The state wanted to rely on the "foregone conclusion" exception, but the court says [PDF] it doesn't have enough information on hand to start bypassing Constitutional protections.

[A] suspect surrendering an unlocked smartphone implicitly communicates, at a minimum, three things: (1) the suspect knows the password; (2) the files on the device exist; and (3) the suspect possessed those files. And, unless the State can show it already knows this information, the communicative aspects of the production fall within the Fifth Amendment’s protection. Otherwise, the suspect’s compelled act will communicate to the State information it did not previously know— precisely what the privilege against self-incrimination is designed to prevent.

The state doesn't have this information. In fact, an investigator admitted during testimony he was hoping to find evidence on the seized phone -- which definitely isn't the same thing as knowing what's contained in the device.

Even if we assume the State has shown that [Katelin] Seo knows the password to her smartphone, the State has failed to demonstrate that any particular files on the device exist or that she possessed those files. Detective Inglis simply confirmed that he would be fishing for “incriminating evidence” from the device. He believed Seo—to carry out the alleged crimes—was using an application or internet program to disguise her phone number. Yet, the detective’s own testimony confirms that he didn’t know which applications or files he was searching for:

"There are numerous, and there’s probably some that I’m not even aware of, numerous entities out there like Google Voice and Pinger and Text Now and Text Me, and I don’t know, I don’t have an all-encompassing list of them, however if I had the phone I could see which ones she had accessed through Google."

Compelling production of passwords without these conclusions in place is pretty much the equivalent of beating a confession out of a suspect. It forces someone to produce testimonial evidence to be used against them in court -- evidence still unknown to investigators.

In sum, law enforcement sought to compel Seo to unlock her iPhone so that it could then scour the device for incriminating information. And Seo’s act of producing her unlocked smartphone would provide the State with information that it does not already know.

The court goes on to explain why compelling phone passwords is not comparable to more analog versions of evidence gathering, much of which revolves around limited sets of paper documents targeted with subpoenas. The quantity of information the average smartphone contains makes these Constitutional protections even more crucial.

Smartphones are everywhere and contain everything. They have become such “a pervasive and insistent part of daily life that the proverbial visitor from Mars might conclude they were an important feature of human anatomy.” Riley v. California, 573 U.S. 373, 385 (2014)...

Citing a prior compelled production case, the state court says this about the increasing irrelevance of analog comparisons.

Hubbell further illustrates the considerable difference between complying with a court order to produce an unlocked smartphone and complying with a documentary summons. Recall that, in Hubbell, the Government had not shown that it had any prior knowledge of either the existence or location of 13,120 pages of documents. Though not an insignificant amount of information, it pales in comparison to what can be stored on today’s smartphones. Indeed, the cheapest model of last year’s top-selling smartphone, with a capacity of 64 gigabytes of data, can hold over 4,000,000 pages of documents—more than 300 times the number of pages produced in Hubbell. It is no exaggeration to describe a smartphone’s passcode as “the proverbial ‘key to a man’s kingdom.’”

The court then goes further, suggesting the "foregone conclusion" doctrine may be completely unworkable when applied to smartphones.

Such unbridled access to potential evidence on her iPhone—or any smartphone—raises several complex questions. For example, if officers searching a suspect’s smartphone encounter an application or website protected by another password, will they need a separate motion to compel the suspect to unlock that application or website? And would the foregone conclusion exception apply to that act of production as well? Suppose law enforcement opens an application or website and the password populates automatically. Can officers legally access that information? Or what if a suspect has a cloud-storage service—like iCloud or Dropbox—installed on the device, which could contain hundreds of thousands of files. Can law enforcement look at those documents, even though this windfall would be equivalent to identifying the location of a locked storage facility that officers did not already know existed? Such complexity is neither necessary nor surprising: the foregone conclusion exception is, in this context, a low-tech peg in a cutting-edge hole.

The court says cops have other options -- options that don't bypass Constitutional protections.

At the same time, we emphasize that there are several ways law enforcement can procure evidence from smartphones without infringing on an individual’s Fifth Amendment rights. For example, officers could try to obtain information from third parties under the Stored Communications Act. Alternatively, two companies—Cellebrite and Grayshift—offer law enforcement agencies affordable products that provide access to a locked smartphone. Or officers could seek an order compelling the smartphone’s manufacturer to help bypass the lock screen. And if law enforcement wants to get into a smartphone for reasons other than prosecution, they can offer immunity to the device’s owner. But the State cannot fish for incriminating evidence by forcing Seo to give unfettered access to her iPhone when it has failed to show that any files on Seo’s smartphone exist or that she possessed those files.

This pretty much ends compelled encryption of smartphones in this state. The reasoning delivered here by the state's top court makes it almost impossible to satisfy the "foregone conclusion" standard needed to avoid violating the Fifth Amendment. Law enforcement agencies will have to seek other routes into locked devices. They'll no longer have the threat of indefinite jailing for contempt charges to hold over uncooperative suspects.

Filed Under: 5th amendment, compelled decryption, indiana, smartphones

Appeals Court Again Says That The White House Can't Just Remove A Press Pass Because It Didn't Like A Reporter Mocking Seb Gorka

from the not-how-it-works dept

Last summer we explained why it was a clear 1st Amendment and 5th Amendment violation for the White House to remove Playboy reporter Brian Karem's press pass, with no warning, after he got into a small verbal tiff with former White House employee Seb Gorka. Lots of Trump supporting people, who seem wholly ignorant of how the Constitution actually works, were very mad at us for reporting on that, and insisted that it was somehow obvious that the White House could revoke a press pass like that, even in retaliation for a reporter's statements. And yet, just as we predicted, the district court quickly ruled that the White House needed to restore Karem's pass.

Now, nearly a year later, the DC Appeals court has affirmed that decision and made it quite clear that the White House's removal of Karem's pass was unconstitutional. The full ruling is worth reading, and, as with the district court, focuses more on the 5th Amendment due process problems, rather than the 1st Amendment retaliation problems. And just to respond to the same comment that came up multiple times in our comments, no, no one is saying that the White House has to automatically let anyone in to press events. Instead, as the court explains, if the White House is opening up an event to the press, it cannot bar people for "arbitrary" reasons (or for any reasons that violate the 1st Amendment, regarding retaliation for speech).

We began by emphasizing that Sherrill’s claim “[wa]s not premised upon the assertion that the White House must open its doors to the press, conduct press conferences, or operate press facilities.” Id. at 129. But given that “the White House has voluntarily decided to establish press facilities for correspondents who need to report therefrom” and given that “[t]hese press facilities are perceived as being open to all bona fide Washington-based journalists,” we held that “the protection afforded newsgathering under the first amendment . . . requires that this access not be denied arbitrarily or for less than compelling reasons.” Id. at 129 (internal citations omitted). Moreover, “the interest of a bona fide Washington correspondent in obtaining a White House press pass” is not only “protected by the first amendment” but also “undoubtedly qualifies as [a] liberty [interest] which may not be denied without due process of law under the fifth amendment.”

After reciting the details of the verbal encounter between Karem and Gorka, the court notes delves into the 5th Amendment due process problems with Karem's suspension:

Applying that test, we think Karem’s due process claim is likely to succeed because, on this record, nothing put him on notice of “the magnitude of the sanction”—a month-long loss of his White House access, an eon in today’s news business—that the White House “might impose” for his purportedly unprofessional conduct at the non-press-conference event. Gore, 517 U.S. at 574. True, the Acosta Letter set forth “rules governing future press conferences,” but in that very same letter, the White House expressly declined to adopt “specific provisions for journalist conduct in the open (non-press room) areas of the White House” “in the hope that professional journalistic norms” would “suffice to regulate conduct in those places.” Acosta Letter 1, J.A. 693 (emphasis added). What’s more, although the White House made clear that “failure to abide by” the newly articulated press-conference rules “may result in suspension or revocation of the journalist’s hard pass,” it declined to adopt analogous sanctions for unprofessional conduct at non-press-conference events. Id. Instead, the White House stated that “[i]f unprofessional behavior occur[red] in those settings,” then it would “reconsider this decision”—that is, the lack of formally articulated standards and sanctions—not that it would suspend journalists’ hard passes.

Even assuming the Acosta Letter provided Karem some notice of behavioral expectations “in the open . . . areas of the White House,” id., it failed to put him on notice of “the magnitude of the sanction that [the White House] might impose” for his purported failure to heed any such expectations, Gore, 517 U.S. at 574. To the extent Karem’s “irreverent, caustic” attempts at humor (to use the district court’s language) crossed some line in the White House’s view, those transgressions were at least arguably similar to previous journalistic misbehavior that elicited no punishment at all, let alone a month’s exile. Karem, 404 F. Supp. 3d at 215. In the context of a White House press corps described as an “unruly mob,” id. at 214 (internal quotation marks omitted), Karem’s behavior was not so outrageous as to bring into fair contemplation the unprecedented sanction visited on him.

The White House’s arguments to the contrary are without merit.

In rejecting each of the White House's arguments, the appeals court even calls one such argument "absurd."

Finally, raising the specter of the absurd, the White House argues that it cannot be the case that “the Press Secretary would be powerless to take action even were a reporter to ‘moon’ the President, shout racial epithets at a foreign dignitary, or sexually harass another member of the press corps.” Appellants’ Reply Br. 4. But just as “[a] plaintiff who engages in some conduct that is clearly proscribed cannot complain of the vagueness of the law as applied to the conduct of others,” Hoffman Estates, 455 U.S. at 495, the White House cannot defend the thirty-day suspension here on the ground that some other, egregious conduct might justify the same sanction. And even if the White House could impose that sanction for such egregious conduct consistent with due process, Karem’s behavior as reflected in the preliminary injunction record fell below that threshold. Notions of professionalism are, after all, context-dependent. Cf. Strickland v. Washington, 466 U.S. 668, 693 (1984) (“[A]n act or omission that is unprofessional in one case may be sound or even brilliant in another.”). “[W]ithin the context of such an unruly event” as the Summit, “where jocular insults had been flying from all directions,” Karem, 404 F. Supp. 3d at 215–16, Karem’s statements were not so egregious as to justify suspending his hard pass for thirty days without prior notice.

Of course, the White House was still able to keep Karem suspended for 18 days before the original decision came down, and even this alone might be intimidating to the White House press corps, which was undoubtedly the key reason behind this in the first place.

Filed Under: 1st amendment, 5th amendment, brian karem, due process, press pass, seb gorka

Appeals Court Rules That People Can't Be Locked Up Indefinitely For Refusing To Decrypt Devices

from the all-writs-v.-5th-amendment-v.-throwing-away-the-key dept

The Third Circuit Court of Appeals has finally decided -- after more than four years -- that the government can't keep someone locked up indefinitely for contempt of court charges.

Former Philadelphia policeman Francis Rawls has been locked up since 2015 for refusing to decrypt external hard drives the government claims contain child porn images. The government's claims are based on Rawls' sister's statements. She said Rawls showed her "hundreds" of child porn images that were located on these drives.

The government obtained an All Writs Order demanding Rawls decrypt the devices. This was challenged by Rawls, but unfortunately he did not preserve a Fifth Amendment challenge, so the Appeals Court let the government have its victory. It was a limited victory. It still had two locked drives Rawls claimed he could not remember the passwords for. But it also had Rawls jailed on civil contempt charges.

Rawls will be a free man again, but probably not for long. He challenged the indefinite incarceration, asserting that the law only provides for a maximum of 18 months in jail for civil contempt charges. The court [PDF] agrees:

On September 30, 2015, Rawls was incarcerated for civil contempt after he failed to comply with a court order that he produce several of his seized devices in a fully unencrypted state. Since that day, more than four years ago, Rawls has been held in federal custody. Rawls seeks release arguing that 28 U.S.C. § 1826 limits his maximum permissible confinement for civil contempt to 18 months.

Because we conclude § 1826 applies to Rawls, we will reverse the order of the District Court and order Rawls’ release.

The government argued this statute does not apply to Rawls, since he is the one charged with crimes, rather than a witness to a crime, as 1826(a) states:

Whenever a witness in any proceeding before or ancillary to any court or grand jury of the United States refuses without just cause shown to comply with an order of the court to testify or provide other information, including any book, paper, document, record, recording or other material, the court, upon such refusal, or when such refusal is duly brought to its attention, may summarily order his confinement at a suitable place until such time as the witness is willing to give such testimony or provide such information.

Rawls pointed out he is a witness in this case. The government wants him to give up passwords to hard drives likely containing evidence to be used against him. That makes him both a witness and a criminal suspect. Production of these passwords would be testimonial -- information Rawls may know (the passwords) that the government does not. The simple act of producing passwords is itself testimonial. It allows the government to infer Rawls had control of the drives and knowledge of their contents.

The precedent the government relies on here isn't on point:

There is a significant difference between a contempt confinement for failure to provide information and confinement for failure to stop actively harassing court personnel. Unlike the contemnor in Harris, Rawls is being asked to provide information in a proceeding and is therefore a witness under § 1826(a).

Furthermore, as the concurring opinion points out, the government's insistence these hard drives be unlocked and that Rawls remained jailed until they are, appears to be completely redundant and unnecessarily cruel.

[B]ased on the evidence in the record (as briefly summarized by Judge Fuentes), it appears that the Government is insisting that Rawls’ incarceration for contempt be continued even though it already possesses sufficient evidence of Rawls’ possession and production of child pornography to obtain a conviction under various subsections of 18 U.S.C. §§ 2251 and 2252. In fact, Rawls’ own sister’s testimony regarding Rawls’ possession of a video of his two nieces, aged four and six, may very well be sufficient to convict him of possession and/or production of child pornography involving a minor in his custody or control.

The government appears to want to punish Rawls simply for being uncooperative and to continue this punishment as long as possible before he faces an even longer sentence for the alleged crimes.

I therefore cannot fathom why the Government is so insistent upon further gilding the lily with the evidence that may well be in the encrypted files on the disputed hard drives and demanding his imprisonment until he “coughs up” that evidence. There may well be some justification for insisting that Rawls be imprisoned on contempt charges before his all but certain prosecution for child pornography and the very severe sentences he would be exposed to if convicted for the latter offenses, but such justification for the Government’s conduct here certainly escapes me.

This isn't a case where evidence necessary for a conviction remains out of reach. The government already has enough to pursue a decades-long sentence. Starting Rawls off with four years in jail before even bringing the case to trial is punishment for punishment's sake. It does not weaken the government's case if the drives remain encrypted. All it does is prevent the government from stacking counts as high as it apparently wants to, forcing it to work with the illegal images it has already recovered.

The Fifth Amendment question remains undisturbed for now. But at least in cases like these, where the government uses a 200-year-old law to compel decryption, it will only be able to lock up unwilling (but presumptively innocent) "witnesses" for 18 months, rather than for the rest of whatever.

Filed Under: 4th amendment, 5th amendment, contempt, decryption, francis rawls, indefinite confinement, passwords

Florida Appeals Court Asks State's Top Court To Decide Whether Compelled Password Production Violates The Fifth Amendment

from the restrictions-may-apply dept

The Florida state Supreme Court is being asked to settle the open question as to whether compelled password production violates the Fifth Amendment. (via FourthAmendment.com)

Last October, a state Appeals Court decided that it did. In a case involving an accident caused by a drunk driver, law enforcement sought to compel the suspect to unlock his phone so they could search it for evidence. It's unclear what evidence of drunk driving the police hoped to find on the phone, but that's the case that first made its way to one of the state's appellate courts.

It all worked out, though. The court ruled that compelling a password is a Fifth Amendment issue because it could force the suspect to hand over evidence to be used against him by prosecutors. Another state appellate court came to the same conclusion earlier this year, ruling that compelling password production to unlock a robbery suspect's encrypted device violated the Constitution.

In both cases, prosecutors didn't really care about the password. That's not what they were after. They wanted what was on the phones, which could be evidence.

It's a big "could," though. The state didn't bring much with it but conclusory arguments which are very much not the same thing as establishing the needed "foregone conclusion." Without it, the state is seeking to violate the Fifth Amendment, and for the lousiest of reasons.

Below and on appeal, the state’s argument has incorrectly focused on the passcode as the target of the foregone conclusion exception rather than the data shielded by the passcode, arguing that “because the State has established the existence of the passcode and iTunes password, evidence on the Petitioner’s cell phone, and that he can access the content of his phone,” the compelled search was acceptable. Similarly, the trial court specifically held that the “existence, custody, and authenticity of the passcodes are a foregone conclusion” in the order appealed. This holding, which focuses on the passcodes rather than the data behind the wall, misses the mark.

[...]

Without reasonable particularity as to the documents sought behind the passcode wall, the facts of this case “plainly fall outside” of the foregone conclusion exception and amount to a mere fishing expedition.

The Appeals Court that reached this same conclusion in the second case has now certified the question for the state Supreme Court to examine. The short cert petition says it's up to Supreme Court to set the precedent for the state and resolve the supposed conflicts with prior case law the state argues have been raised by the Appeals Court's decision.

There's a dissent attached to the cert petition [PDF] that, weirdly, argues the state's top court shouldn't take a look at this because the Appeals Court screwed it up the first time. The majority of judges, however, disagrees with the dissent's rationale. [Emphasis in the original.]

Despite the narrow focus of the State’s motion, our dissenting colleague presents many pages of arguments—old and new—that amount to a second opinion on the merits. Tellingly, our colleague’s almost exclusive focus is on the Fourth Amendment and probable cause despite no party mentioning either of them in their merits briefs and the State advancing no argument on such matters in its motion for rehearing and certification. And whether the probable cause affidavit (which sought to seize broad categories of information from the cellphone—without identifying any specific item—on the basis that criminals use cellphones) was proper or a fishing expedition matters not; we fail to see how the issuance of a subpoena or warrant—whether careful drawn or a fishing expedition—negates the Fifth Amendment’s protections, which are the focus of this case.

The majority says the dissent's argument is important, but not quite for the reason the dissent thinks it is.

If anything, the relationship that exists between the Fifth Amendment right against compelled personal disclosures and its neighboring and complementary Fourth Amendment right against unreasonable searches and seizures counsels in favor of protection against governmental overreach into individual autonomy in criminal cases.

The dissent's argument is basically this: it's not a "fishing expedition" if cops have a warrant. That's not how fishing expeditions work and the court should know better. The dissent presents an appeal to its own authority (the judicial system at large), which is about the most worthless argument it could make.

The State did not merely issue a subpoena for Pollard’s phone with a hunch that it might provide incriminating information. Rather, the State introduced evidence showing, to a magistrate’s satisfaction, that probable cause existed that Pollard’s phone contained evidence of a crime. This evidence was what they sought, not the passcode that is the subject of this petition.

Ah, the old "magistrates always read warrant applications thoroughly" argument. In this case, there's a bit more to it: an admission by a co-defendant that the crime was planned via text message. At least that's something. The case this Appeals Court cited to come to its conclusion dealt with drunk driving -- a crime that doesn't seem to have anything to do with a phone's contents.

The state's Supreme Court will have the final say. For now, Florida is (mostly) covered by decisions that say compelling passwords is a Fifth Amendment violation. Whatever the state's top court decides will be appealed by the losing party, moving it to the federal level. And everything sitting unresolved at the federal level eventually moves to the top court in the land. So, at some point, we'll probably have a nationwide ruling on compelled password production, for better or worse. For now, the Fifth Amendment protections have an asterisk attached. Successful invocation may only apply locally.

Filed Under: 5th amendment, compelled password, florida, passwords, speech

Another Federal Court Says Compelled Production Of Fingerprints To Unlock A Phone Doesn't Violate The Constitution

from the must-be-going-so-dark-fingerprint-readers-won't-even-work dept

Where the Fifth Amendment ends for device owners largely seems to be determined by their favored security measure. If it's a password keeping a device encrypted, courts seem more willing to call compelled production a Fifth Amendment violation. If it's a biometric feature -- most commonly fingerprints or faces -- the courts are more likely to consider body parts non-testimonial.

There's not enough of a consensus either way to make it a clear choice, but courts seem to feel faces/fingerprints are like "keys" and passwords like "combinations" when it comes to the metaphorical lockbox that is your phone.

Adding to the case law that is "fingerprints are lockbox keys" is this decision [PDF] from a federal court in Illinois. (via FourthAmendment.com) The court says the Supreme Court says this is how it must be, even if the Supreme Court has yet to field a device encryption case.

The government wants to look in the defendant's phone for evidence of his threats against a confidential informant. There's a built-in limit to this, although it's not one of the government's making. Investigators want to apply the suspect's fingers and thumbs to the seized iPhone to unlock it. The suspect's mind is being taken out of the equation (as it were), which could result in the government getting what it wants in this request without actually getting what it wants from the man's iPhone.

In connection with the government’s motion to revoke Barrera’s bond conditions, District Judge Robert W. Gettlemen ordered that Barrera’s iPhone be turned over to Pretrial Services. The government seeks to search this iPhone, with a home button, that was taken from Barrera in order to develop evidence of his alleged threats. The iPhone has a fingerprint lock function (known as Touch ID), and the government asked this Court for a warrant to compel the defendant to place his fingers and thumbs on the iPhone home button in an attempt to unlock the phone. The government alleged in the affidavit in support of its request for a search warrant that it will select the fingers and thumbs to press on to the home button, and that the iPhone fingerprint unlock function will disable after five incorrect attempts. At that time, the iPhone function will demand a passcode to unlock the phone.

The court says any Fourth Amendment concerns are addressed by the government's warrant, which puts it on the right side of the Riley decision. With that settled, the court addressed the Fifth Amendment issues. (Emphasis in the original.)

Applying those three requirements in reverse order here, a biometric scan is certainly compelled—the government is explicitly requesting the Court’s authority to force the scan. The act may also be incriminating, as unlocking the phone may lead to the discovery of a nearly unlimited amount of potential evidence including text messages, social media posts, call logs, emails, digital calendars, photographs and videos, and location data. [...]

But if a compelled act is not testimonial, and therefore not protected by the Fifth Amendment, it cannot become protected simply because it will lead to incriminating evidence. As a result, the relevant Fifth Amendment inquiry here is whether the compelled act of scanning a subject’s fingerprint to unlock a device is a testimonial act.

The court decides it isn't a Fifth Amendment violation because the government will be choosing the five digits it will apply to the iPhone button, rather than the suspect. To complete the metaphor, the government has ten keys to choose from, but only has five attempts to pick the right key. Since the government is doing all the choosing, the suspect isn't doing anything testimonial since he isn't being asked to tell the government which of his fingers will unlock the phone.

First, the Court holds that the biometric unlock procedure is more akin to a key than a passcode combination. The Supreme Court in Doe, and later in Hubbell, has illustrated the difference between testimonial and non-testimonial physical acts via this helpful comparison, which aptly applies to an iPhone that has two different unlock features – a fingerprint and a passcode. In Doe, the Court noted that the Fifth Amendment permits the government to force an individual to surrender a key to a strongbox containing incriminating documents, but not to reveal the combination to a subject’s wall safe. Thus, using the Doe framework, this Court examines whether a biometric scan of an individual’s finger or thumb is more like a key or a combination.

A combination passcode requires a verbal statement from the possessor of the code. More importantly, compelling someone to reveal a passcode also requires an individual to communicate something against her will that resides in her mind. A key, however, is a physical object just like a finger — it requires no revelation of mental thoughts. Nor does a finger require a communication of any information held by that person, unlike a passcode. In fact, the application of a finger to the home button on a iPhone “can be done while the individual sleeps or is unconscious,” and thus does not require any revelation of information stored in a person’s mind.

But even this conclusion is not that simple. The government must show it knows the phone is owned or controlled by the suspect before it can start asking the court to give it permission to apply the person's fingers to the phone. The court doesn't address whether the government has met this evidentiary burden but rather waves it away by citing a 1988 Supreme Court decision (Doe) dealing with the production of financial records.

[T]he Court holds that the implicit inference from the biometric unlock procedure, that the individual forced to unlock had some point accessed the phone to program his or her fingerprint, is not sufficient to convert the act to testimonial. The Supreme Court considered this similar concept in Doe, when it found that requiring a petitioner to execute a consent directive that would result in the production of bank records would not have testimonial significance.

[...]

Similarly, the implicit inference that one might draw from the biometric unlock procedure — that the cell phone was at some point accessed in order to program the biometric lock feature — is no different in significance than any of the above inferences. It is of the same scale that existed in Doe, Gilbert and the other cases discussed above. The implicit inference is also not necessarily as firm as on first impression – the Touch ID feature on an iPhone permits up to five fingerprints to be programmed, thus allowing the potential for multiple users to program the feature. As a result, the Court concludes that any implicit inference that can be drawn from a biometric unlock procedure is not of testimonial significance.

This decision further muddies the federal waters, making it more likely the Supreme Court will have to address these Fifth Amendment issues in the near future. But until it's all settled, odds are passwords are better than fingerprints if your main concern is unwanted access by government employees.

Filed Under: 4th amendment, 5th amendment, biometrics, compelled production, fingerprints, passwords