Another Florida Appeals Court Says Compelled Passcode Production Violates The Fifth Amendment

from the brace-yourself-for-a-whole-new-wave-of-anti-encryption-bitching dept

Things are getting pretty unsettled in Florida in terms of compelling the production of phone passcodes. Less than a half-decade ago, refusing to produce passwords netted people contempt charges. As these cases moved forward through the court system, the legal calculus changed. As it stands now, state appeals courts in two Florida districts have found that forcing people to give up passcodes violates the Fifth Amendment. But there's still some settling left to do and the First District has asked the state's top court to take a look at the issue.

The latest development comes from Florida's Fifth District, where another state appeals court has reached the same conclusion as the others: passcodes are testimonial, and forcing people to turn them over implicates the Fifth Amendment. (via FourthAmendment.com)

The case deals with some targeted vandalism and alleged stalking. Investigators feel the phone they found at the crime scene belongs to the suspect and contains evidence to support the aggravated stalking charges. (The victim also apparently found a GPS device attached to her car, presumably placed there by the suspect.)

The decision [PDF] recounts the state's bizarre argument at the trial court level -- one that claimed demanding a passcode from the suspect was not an "intrusion."

Because Garcia’s smartphone was passcode protected, law enforcement was unable to unlock the phone to conduct the search. The State then moved to compel Garcia to provide the passcode, alleging in its motion that the contents of Garcia’s phone “are relevant to how the events occurred and whether [Garcia] is guilty,” and that providing the passcode would “involve no unreasonable intrusions upon the body of [Garcia].”

The trial court bought the state's arguments and its "foregone conclusion" assumption and granted the motion to compel.

It orally found that providing the passcode was non-testimonial and thus, “the Stahl decision is controlling here.”

The decision the trial court cited (but didn't discuss in its ruling) was handed down by the Second District Appeals Court in 2016. In that case, the court decided a passcode was non-testimonial because the passcode itself didn't give the state anything it didn't already possess. But, as was pointed out by the Fourth District in its decision in favor of the Fifth Amendment, the Stahl decision misses the point:

Contrary to the Stahl court’s conclusion, which the trial court adopted, the “evidence sought” in a password production case such as this is not the password itself; rather, it is the actual files or evidence on the locked phone.

But that's all the trial court used here and it did so without explaining any of its reasoning in a written order. The appeals court says Stahl controls nothing because the Stahl decision did not correctly address the issue.

In Stahl, law enforcement obtained a warrant to search the defendant’s locked phone, but the defendant refused to provide them with his passcode. The State filed a motion to compel production of the passcode, which the trial court denied, finding the production of the passcode to be testimonial. The Second District Court quashed the order, holding that compelling the defendant to reveal his passcode was not testimonial because the passcode was “sought only for its content and the content has no other value or significance.”

We respectfully disagree with the Second District Court. Distilled to its essence, the revealing of the passcode is a verbal communication of the contents of one’s mind. (“As a passcode is necessarily memorized, one cannot reveal a passcode without revealing the contents of one’s mind.”). We agree with Garcia that the order under review requires that he utilize the contents of his mind and disclose specific information regarding the passcode that will likely lead to incriminating information that the State will then use against him at trial. We therefore conclude that the compelled disclosure of his passcode is testimonial and is protected by the Fifth Amendment.

The "foregone conclusion" exception doesn't work here either. The court says US Supreme Court precedent deals with the production of documents, not oral testimony. Since the court considers oral revelation of a passcode "testimonial," it's unwilling to extend this exception to cover it. Doing so would "narrow" a right without adequate justification.

In summary, we hold that compelling a defendant, such as Garcia, to provide orally the passcode to his smartphone is a testimonial communication protected under the Fifth Amendment and that the foregone conclusion exception or doctrine does not apply to compelled oral testimony.

This decision also asks the Florida Supreme Court to weigh in on this issue and hand down precedent for the state. The appellate level appears to lean heavily towards recognizing compelled production to be a Fifth Amendment violation. Meanwhile, trial courts are acting as though the question was already settled by a single 2016 decision handed down by a single appellate district, ignoring every ruling that's been handed down since then. This should happen sooner rather than later. The issue is too big to ignore.

Filed Under: 5th amendment, compelled production, florida, passcodes

Samantha Bee Gets Talib Kweli To Rap About Protecting Your Phone With A Passcode

from the computer-security-finally-becoming-cool dept

Lately it's been John Oliver whose short segments have been related to Techdirt-focus areas, but now it's another Daily Show alum, Samantha Bee, whose show, Full Frontal, just had an excellent segment by Ashley Nicole Black that's a Mr. Robot parody explaining why everyone should learn about protecting their digital info, including putting a passcode on their phone, using different passwords and more. The ~7-minute clip includes brief cameos by Senators Ron Wyden and Pat Leahy talking about overly aggressive US surveillance -- and an extended bit with technologist Chris Soghoian, who just left the ACLU to go help Congress better understand technology (this is good!). And then, at the end, they get Talib Kweli to do an... updated version of his hit song "Get By" to make it relevant to protecting your personal data from government surveillance, and concluding that the surveillance "goes against the 4th Amendment." And, did we mention the whole thing is pretty funny?

Filed Under: ashley nicole black, encryption, mr. robot, passcodes, samantha bee, surveillance, talib kweli

Court Says Fifth Amendment Covers Smartphone Passcodes, But It's Hardly A Victory For Constitutional Rights

from the blueprint-for-fifth-amendment-evasion-currently-in-progress dept

A recent opinion issued in a prosecution by the Securities and Exchange Commission seems to indicate the government can't force members of the public to hand over passwords without violating the Fifth Amendment. But the details suggest something else: that this is limited to a very specific set of circumstances and is not in any way precedential, at least not at this point.

The courts have previously weighed in on the legality of forcing people to basically provide incriminating evidence against themselves through the compelled relinquishment of passwords. Back in 2013, a magistrate judge rejected an order compelling a defendant to decrypt a seized hard drive by providing the government with his password. A year later, the Massachusetts Supreme Court came to the opposite conclusion: that the compelled production of passwords did not have Fifth Amendment implications.

The DOJ has argued that it does have the right to demand passwords to unlock seized items and actually found a judge that agreed with it. In that case, the court found that unlocking a device was no different than producing documents at the government's request -- distancing it from the "compelled speech" against a person's own interests that the Fifth Amendment is supposed to guard against.

This case falls along those same lines, but the legal conclusions are a bit different.

The Securities and Exchange Commission (SEC) is investigating Bonan and Nan Huang for insider trading. The two worked at the credit card company Capital One as data analysts. According to the complaint, the two allegedly used their jobs as data analysts to figure out sales trends at major U.S. companies and to trade stocks in those companies ahead of announced company earnings. According to the SEC, they turned a $150,000 investment into $2.8 million.

Capital One let its employees use company-owned smartphones for work. Every employee picked his own passcode, and for security reasons did not share the passcode with Capital One. When Capital One fired the defendants, the defendants returned their phones. Later, as part of the investigation, Capital One turned over the phones to the SEC. The SEC now wants to access the phones because it believes evidence of insider trading is stored inside them.

But here’s the problem: The SEC can’t get in. Neither can Capital One. Only the defendants know the passcodes. And the defendants have refused to disclose them. As much as Capital One may want to aid the SEC in prosecuting its former employees, it can't.

The SEC sought an order to compel the production of the passcodes. The suspects refused on Fifth Amendment grounds. This brings us to the tricky details of this case, which suggest it won't become an across-the-board Fifth Amendment-protected "right" to deny the government access to password-protected devices and storage.

The government argued for the compelled production of passwords using the "foregone conclusion" doctrine.

The doctrine, introduced in Fisher v. United States, says that the Fifth Amendment doesn’t block complying with a court order when the testimonial part of complying with a court order is a foregone conclusion. In other words, if the government already knows the testimonial part of complying with the order, and they’re not seeking to prove it from the order, then you can’t use the Fifth Amendment to avoid compliance with the order.

In the government's creative interpretation of the doctrine, the production of passcodes would be no more than the defendants acknowledging they used the phones Capital One supplied them with -- something the government already knows and which has been confirmed by Capital One. Therefore, there are no Fifth Amendment implications. The judge disagreed, correctly pointing out that the government was seeking access to documents possibly contained on the phones, rather than simply seeking to confirm what it already suspected: that the phones were used by the defendants.

By using one thing to achieve another, the government was stretching its "foregone conclusion" to cover any evidence discovered on the unlocked phones. If the defendants have reason to believe incriminating documents resided on those phones, they are well within their Fifth Amendment rights to refuse the government's request. Or so you would think.

Should the SEC ultimately succeed with this interpretation of the "foregone conclusion" doctrine, it will have compelled incriminating testimony. It claims that it's merely seeking to confirm ownership by seeing if the passcodes unlock the phones. But once they're unlocked, it can compel the production of documents. Should these prove to be incriminating, it already has the defendants' admissions that these are their cell phones.

So, this case is less about securing Fifth Amendment rights than the government exploring options on how to obtain permission to compel defendants to hand over access to possibly incriminating information. If the court holds firm in its view of the government's true aims, it will be a small win for constitutional rights but one unlikely to be applied broadly.

As Orin Kerr points out in a second post on the case, some unanswered questions point towards the government being able to successfully argue that simply providing a password to a locked device isn't self-incriminating testimony.

If this analysis is right, then the password is incriminating because it provides a link to the evidence. The government could grant the defendants immunity, but it would need to be use and derivative use immunity — that is, immunity not just from the actual testimony but from what the testimony would reveal.See Counselman v. Hitchcock, 142 U.S. 547, 585 (1892). The defendants should win. That’s where Jonathan comes out, and it might be correct.

But I’m not sure. Here’s my question: Does the “link in the chain” test include a merely causal link — that is, a link in the chain to the evidence? Or does “link in the chain” mean that the testimony was part of the evidence of guilt but not enough to prove the entire offense — that is, a link within the body of evidence? If testimony is solely of value for its causal connection to evidence, and it has no evidentiary value itself, is the testimony incriminating?

If the government can argue that compelled production of passwords that leads to the discovery of incriminating material is merely causal (rather than the password itself being evidence of guilt), it may be able to skirt the Fifth Amendment entirely. This has obvious implications in the ongoing law enforcement war on encryption. With no firmly established legal footing for the argument that demanding passwords violates the Fifth Amendment, password-protected encryption will be ultimately no more safe than leaving everything unlocked and in plaintext.

So, while the court has -- for the moment -- denied the government's request to compel the production of passwords, the underlying legal entanglements don't exactly bode well for the future of the Fifth Amendment.

Filed Under: fifth amendment, passcodes, phone, self-incrimination