Florida Appeals Court Says Producing Passwords Is Testimonial And Protected By The Fifth Amendment

from the A-CHALLENGER-APPEARS dept

The Florida State Appeals Court is bucking the trend on compelled decryption. While most courts have held forcing someone to relinquish the password to a locked device does not raise Fifth Amendment issues, this court has decided that act is testimonial in and of itself. This makes the state's demand unconstitutional and sends it up the ladder to the state's highest court. (via FourthAmendment.com)

The facts of the case may play a role in future deliberations. It involves a drunk driving accident. Phones belonging to the driver and passenger were were taken from the crashed car. The search of the driver's phone didn't go far, thanks to it being locked with a password. Prosecutors sought an order compelling password production but were met with arguments from the driver's lawyer claiming this would violate his Fifth Amendment rights. The appellate court agrees. From the decision [PDF]:

[R]evealing one’s password requires more than just a physical act; instead, it probes into the contents of an individual’s mind and therefore implicates the Fifth Amendment. The very act of revealing a password asserts a fact: that the defendant knows the password.

This is normally where the "foregone conclusion" standard is set -- the one that allows the government to bypass Fifth Amendment protections if it can show it knows the defendant knows the password to unlock a device. That's (usually) the only conclusion the government needs to reach. It does not need to show that it knows evidence needed to prosecute the case resides on the device. It only needs to tie the device to the defendant and show that there's a reasonable certainty the device can be unlocked by the person targeted by the order.

When applying this standard, courts usually don't consider production of passwords testimonial. And if it is, it's only verifying a fact the government has already shown it knows. Often, the government is forbidden to use this particular evidence -- that the defendant unlocked the phone -- against the person in court.

This court goes a different direction. It says, foregone conclusion or no, the production of passwords is testimonial and has the potential to harm the defendant just like any other Fifth Amendment violation would. The court notes the government gains nothing by obtaining a password. It wants what the password provides: access to information that might be used as evidence against the person supplying the password.

Here, the state seeks the phone passcode not because it wants the passcode itself, but because it wants to know what communications lie beyond the passcode wall. If the minor were to reveal this passcode, he would be engaging in a testimonial act utilizing the “contents of his mind” and demonstrating as a factual matter that he knows how to access the phone. As such, the compelled production of the phone passcode or the iTunes password here would be testimonial and covered by the Fifth Amendment.

Rather than use a standard used elsewhere, the court demands more from the government than a reasonable certainty the phone's owner knows how to unlock the phone. It needs to show the evidence it seeks can be found on the device.

Below and on appeal, the state’s argument has incorrectly focused on the passcode as the target of the foregone conclusion exception rather than the data shielded by the passcode, arguing that “because the State has established the existence of the passcode and iTunes password, evidence on the Petitioner’s cell phone, and that he can access the content of his phone,” the compelled search was acceptable. Similarly, the trial court specifically held that the “existence, custody, and authenticity of the passcodes are a foregone conclusion” in the order appealed. This holding, which focuses on the passcodes rather than the data behind the wall, misses the mark.

On this subject, we again disagree with the Second District. In Stahl, the court focused on the “reasonable particularity that the passcode exists,” a fact that the state had established. 206 So. 3d at 136 (emphasis in original). However, this is not the proper focus of the inquiry—it is not enough to know that a passcode wall exists, but rather, the state must demonstrate with reasonable particularity that what it is looking for is in fact located behind that wall. Contrary to the Stahl court’s conclusion, which the trial court adopted, the “evidence sought” in a password production case such as this is not the password itself; rather, it is the actual files or evidence on the locked phone. Without reasonable particularity as to the documents sought behind the passcode wall, the facts of this case “plainly fall outside” of the foregone conclusion exception and amount to a mere fishing expedition.

This is where the facts of the case may result in a ruling that aligns with the trial court's take on the "forgone conclusion" exception, but still denies access to the phone's contents. Everyone carries a phone. Drunk drivers are like sober drivers. That a drunk driver was carrying a phone at the time of an accident does not make it likely that evidence of the crime -- drunk driving -- will be found on the driver's phone. The court goes back to its "fishing expedition" comment, pointing out the state barely has any reason to search the phone at all, much less attempt to weaken Fifth Amendment protections in the process.

Here, the state’s subpoena fails to identify any specific file locations or even name particular files that it seeks from the encrypted, passcode-protected phone. Instead, it generally seeks essentially all communications, data, and images on the locked iPhone. The only possible indication that the state might be seeking anything more specific was the prosecutor’s statement at the hearing that the surviving passenger had been communicating with the minor via Snapchat and text message on the day of the accident and after the accident, a fact that the trial court briefly mentioned in its order but did not appear to rely on in reaching its conclusion.

The concurring opinion raises another issue seldom touched on in other password-related rulings. The "foregone conclusion" exception to the Fifth Amendment is, like the "good faith" exception, something fabricated by courts rather than by laws or Constitutional amendments. As such, it cannot be applied to oral testimony -- such as the relinquishment of passwords to law enforcement.

[H]ere, the State sought to compel the oral production of the requested information. The foregone conclusion exception has not been applied to oral testimony, and for good reason. In Fisher, the court explained that compelling a taxpayer to produce documents “involves substantial compulsion. But it does not compel oral testimony; nor would it ordinarily compel the taxpayer to restate, repeat, or affirm the truth of the contents of the documents sought.” Based on what the production in Fisher would not do, the Supreme Court allowed the government to compel the production of documents. Requiring the accused to orally communicate to the government information maintained only in his mind would certainly compel oral testimony. So, in my view, the basis for granting the petition is not that the State failed to satisfy the requirements of the foregone conclusion exception. Rather, the petition should be granted because the foregone conclusion exception is inapplicable to the compelled oral testimony sought in this case.

Of course, the workaround here is to have defendants punch in the passwords themselves or write them down. The latter would produce more issues than having them punch in the codes, but either way, it should be apparent -- at least in Florida -- that these alternate methods are being deployed to sidestep a precedential Fifth Amendment decision by the court.

The "foregone conclusion" exception is rarely applied in this fashion. A state-level appeals court decision isn't going to change things in the rest of the nation. But it does give defendants something to refer to when challenging compelled password production. And it also suggests the exception itself is being rethought in light of tech advancements that have made it possible for people to carry several houses-worth of documents with them at all times, protected only by a password the government can almost always obtain -- either through use of the exception or with indefinite jailing on contempt charges.

Fourth Amendment protections have undergone several adjustments over the past decade as courts seek to catch up with technology. The Fifth Amendment is due for the same overhaul.

Filed Under: 5th amendment, compelled decryption, encryption, florida, passwords, self incrimination

Minnesota Supreme Court Says Unlocking A Phone With A Fingerprint Isn't A Fifth Amendment Issue

from the non-testimonial-act-of-producing-evidence-against-yourself dept

When it comes to the Fifth Amendment, you're better off with a password or PIN securing your device, rather than your fingerprint. Cellphone manufacturers introduced fingerprint readers in an effort to protect users from thieves or other unauthorized access. But it does nothing at all to prevent law enforcement from using their fingerprints to unlock seized devices.

The US Supreme Court hasn't seen a case involving compelled production of fingerprints land on its desk yet and there's very little in the way of federal court decisions to provide guidance. What we have to work with is scattered state court decisions and the implicit understanding that no matter how judges rule, a refusal to turn over a fingerprint or a password is little more than a way to add years to an eventual sentence.

The Minnesota Supreme Court has issued the final word on fingerprints and the Fifth Amendment for state residents. In upholding the appeals court ruling, the Supreme Court says a fingerprint isn't testimonial, even if it results in the production of evidence used against the defendant. (h/t FourthAmendment.com)

From the ruling [PDF]:

Although the Supreme Court’s distinction between the testimonial act of producing documents as evidence and the nontestimonial act of producing the body as evidence is helpful to our analysis, the act here—providing the police a fingerprint to unlock a cellphone—does not fit neatly into either category. Unlike the acts of standing in a lineup or providing a blood, voice, or handwriting sample, providing a fingerprint to unlock a cellphone both exhibits the body (the fingerprint) and produces documents (the contents of the cellphone). Providing a fingerprint gives the government access to the phone’s contents that it did not already have, and the act of unlocking the cellphone communicates some degree of possession, control, and authentication of the cellphone’s contents. See Hubbell, 530 U.S. at 36. But producing a fingerprint to unlock a phone, unlike the act of producing documents, is a display of the physical characteristics of the body, not of the mind, to the police. See Schmerber, 384 U.S. at 763.

Because we conclude that producing a fingerprint is more like exhibiting the body than producing documents, we hold that providing a fingerprint to unlock a cellphone is not a testimonial communication under the Fifth Amendment.

The ruling notes the defendant did try to holdout on this, sticking to his Fifth Amendment arguments. But when the trial court gives you only unpalatable options, defendants tend to give prosecutors what they want.

The district court concluded that compelling Diamond’s fingerprint would not violate his Fifth Amendment privilege because “[c]ompelling the production of [Diamond’s] fingerprint or thumbprint would not call upon the use of [his] mind. It is more akin to providing a key to a lockbox.” Accordingly, it ordered Diamond to “provide a fingerprint or thumbprint as deemed necessary by the Chaska Police Department to unlock his seized cell phone.”

Diamond continued to object to providing the necessary fingerprint for unlocking the phone. Nevertheless, he finally unlocked the cellphone with his fingerprint in court after being held in civil contempt and warned of the possibility and consequences of criminal contempt.

This is an aspect never discussed by the FBI and others engaged in the war on encryption. Many, many people can be motivated to unlock devices when faced with the prospect of indefinite imprisonment on contempt charges. It's something that should work in all but the most extreme criminal cases where the potential imprisonment might be as close to indefinite as humanly possible.

Filed Under: encryption, fifth amendment, fingerprints, first amendment, minnesota, self incrimination

Military Appeals Court Says Demands To Unlock Phones May Violate The Fifth Amendment

from the ANSWER-UNCLEAR:-ASK-AGAIN-LATER dept

A decision [PDF] handed down by the Appeals Court presiding over military cases that almost affirms Fifth Amendment protections against being forced unlock devices and/or hand over passwords. Almost. The CAAF (Court of Appeals for the Armed Forces) doesn't quite connect the final dot, but does at least discuss the issue, rather than dismiss the Fifth Amendment question out of hand. (h/t FourthAmendment.com]

The case stems from a harassment case against a soldier who violated (apparently repeatedly) a no-contact order separating him from his wife. After being taken into custody, Sgt. Edward Mitchell demanded to speak to a lawyer. Rather than provide him with a lawyer, investigators asked him to unlock his phone instead.

Appellee invoked his right to counsel at approximately 10:50 a.m. Appellee's platoon leader signed a "Receipt for Pre-Trial/Post Trial Prisoner or Detained Person," and SSG Knight escorted Appellee back to his unit, where he remained in the company area and accessed both his Kyocera phone and iPhone.

[...]

In the office, Investigator Tsai informed Appellee of the verbal search and seizure authorization, and Appellee questioned the validity of verbal authorizations, asking to see a written one. Around this time, the commander left the office. Investigator Tsai told Appellee that verbal authorizations are valid and asked if Appellee had any cell phones on his person. Appellee then handed an iPhone to the investigators. Investigator Tsai saw that the iPhone was protected by a numeric passcode, and asked Appellee to provide it. Appellee refused.

At this point, this line of questioning should have been abandoned. Actually, it should never have begun without Mitchell's lawyer present. But the investigators apparently believed that asking, rather than ordering, Mitchell to unlock his phone made the whole thing consensual.

Investigator Tsai then handed the phone back to Appellee and asked him to unlock it, saying: "if you could unlock it, great, if you could help us out. But if you don't, we'll wait for a digital forensic expert to unlock it." Neither investigator knew at the time that Appellee's iPhone had two finger/thumb prints stored, and could have potentially been opened using "Touch ID capabilities." Appellee then entered his passcode and unlocked the phone: "[Appellee] was also required to permanently disable the cell phone's passcode protection. In order to do so, [he] was required to access the phone's settings and enter his numeric passcode (PIN) two more times to fully disable the phone's protections."

The military judge at the lower level suppressed the evidence, holding that Mitchell was in custody without requested legal representation at the time he unlocked his phone for investigators. The Appeals Court affirms the lower court's findings.

Under the circumstances presented, we conclude that the Government violated Appellee's Fifth Amendment right to counsel as protected by Miranda and Edwards. The Government does not contest that Appellee was in custody when he invoked his right to counsel while detained at the military police station. It is almost equally clear that Appellee was in custody in his commander's office when investigators asked him to unlock his iPhone.

The court also points out that simply asking nicely for an in-custody suspect to "help out" the government by possibly incriminating themselves doesn't make it any more Fifth Amendment-compliant, nor does it change the nature of questioning from an "interrogation" to "a couple of guys chatting about stuff with absolutely no criminal case-building implications."

This line of questioning qualifies as interrogation. The agents' initial request—“can you give us your PIN?”—is an express question, reasonably likely to elicit an incriminating response. The Government contends that a request for consent to search is not an interrogation, citing this Court’s reasoning in United States v. Frazier that “such requests are not interrogations and the consent given is ordinarily not a statement.” 34 M.J. 135, 137 (C.M.A. 1992). But asking Appellee to state his passcode involves more than a mere consent to search; it asks Appellee to provide the Government with the passcode itself, which is incriminating information in the Fifth Amendment sense, and thus privileged.

The court points out the simple act of unlocking a phone can be incriminating. It demonstrates for investigators and prosecutors the person holding the phone may well be responsible for any incriminating content found on it. It also implies ownership, making it easier to connect the person to the device (and the content contained).

By asking Appellee to enter his passcode, the Government was seeking an “answer[] … which would furnish a link in the chain of evidence needed to prosecute” in the same way that Hoffman and Hubbell used the phrase. Not only did the response give the Government access to direct evidence as in Hubbell, it also constituted direct evidence as in Hoffman. See Hubbell, 530 U.S. at 39–40 (“The documents were produced before a grand jury …. The use of those sources of information eventually led to the return of an indictment ….”); Hoffman, 341 U.S. at 488 (“[T]ruthful answers … to these questions might have disclosed that he was engaged in such proscribed activity.”). As even the dissent concedes, Appellee’s response constitutes an implicit statement “that [he] owned the phone and knew the passcode for it.”

Based on that, the court finds Mitchell's Fifth Amendment rights were violated by this in-custody request to provide a passcode. Unfortunately, the court considers this the end of its judicial inquiry.

In light of this holding, we need not reach the question of whether the Government directly violated Appellee’s Fifth Amendment privilege against compelled self-incrimination. We thus do not address whether Appellee’s delivery of his passcode was “testimonial” or “compelled,” as each represents a distinct inquiry.

Even though the ruling doesn't extend far enough to make passcodes worthy of Fifth Amendment protections, the judicial analysis at least shows providing passwords can create evidence to be used against the accused. This decision doesn't quite stretch that far thanks to the investigators' ignoring Mitchell's invocation of his right to an attorney, but it does the act of entering passwords can be considered self-incriminating.

Filed Under: 5th amendment, caaf, compelled unlocking, edward mithchell, military, self incrimination, unlocking phones

When A Fingerprint IS The Password, Where Does The Fifth Amendment Come Into Play?

from the a-non-testimonial-appendage? dept

FBI Director James Comey is still complaining about encryption but it doesn't seem to be preventing law enforcement from accessing devices. To date, law enforcement has paid hackers to break into a phone, had an iPhone owner suddenly "remember" his password, seen a person jailed for 7 months (so far) for refusing to provide a password and, now, a law enforcement agency has used a warrant to force a suspect to unlock an iPhone using a fingerprint.

[A]uthorities obtained a search warrant compelling the girlfriend of an alleged Armenian gang member to press her finger against an iPhone that had been seized from a Glendale home. The phone contained Apple's fingerprint identification system for unlocking, and prosecutors wanted access to the data inside it.

The mostly-unanswered question is whether this violates the Fifth Amendment by forcing a person to provide evidence against themselves. (Not that due process was at the forefront of law enforcement's mind in this case. Or the magistrate judge's either. Jonathan Zdziarski points out the warrant was obtained within 45 minutes of the suspect being arrested -- not even enough time to bring in a lawyer.) While the law allows police to collect data from detained individuals -- including fingerprints -- it doesn't say much about physically applying someone's finger to their phone to unlock its contents.

The concern that fingerprint "passwords" would be less insulated against court orders and warrants was brought up here more than two years ago, shortly after Apple announced the new security feature. Biometric data isn't something anyone "knows" that could be considered "testimonial." It simply is an indicator of who you are, which courts have held isn't covered under Fifth Amendment protections against self-incrimination.

The additional concern is that law enforcement may have also used this Fifth Amendment workaround to obtain information on a separate suspect. The LA Times article adds these details to the general murkiness:

Why authorities wanted [Paytsar] Bkhchadzhyan to unlock the phone is unclear. The phone was seized from a Glendale residence linked to Sevak Mesrobian, who according to a probation report was Bkhchadzhyan's boyfriend and a member of the Armenian Power gang with the moniker of "40." Asst. U.S. Atty. Vicki Chou said the search was part of an ongoing probe. She declined further comment.

Bkhchadzhyan was arrested and pled no contest to one count of identity theft. But the US Attorney's comment seems to imply law enforcement was looking for more than just evidence on Bkhchadzhyan when it searched the phone. If so, it raises even further questions about the constitutionality of this particular warrant, which may have forced this suspect to provide evidence against someone else.

The only prior case to raise this issue isn't very instructive and a dataset of one is hardly an indicator of prevailing judicial winds. But the reasoning in the 2014 case draws a line between what the court considers "testimonial" and what is merely providing access.

In 2014, a judge said Baust could be compelled to provide his fingerprint to open a locked phone but could not be ordered to disclose a passcode. The judge reasoned that providing a fingerprint was akin to giving a key, while giving a passcode — stored in one's mind — entailed revealing knowledge and therefore testifying. Baust was later acquitted.

But does that line even exist? It's difficult to say it does when both fingerprints and passwords are virtually interchangeable, thanks to Apple's Touch ID system. The fingerprint is the password. The difference is detained suspects can only retain one of these "keys" in their minds. The rationale used by the court presumes vocal utterances are the only way a person can provide incriminating evidence against themselves.

It's not like withholding passwords will work in all cases either. Those who aren't jailed for contempt of court may instead find judges deciding that providing a password to law enforcement isn't a "testimonial" act on its own. The refusal to provide a password may also work against defendants by giving prosecutors a bit more ammo for their "foregone conclusion" justifications. After all, if a locked device didn't contain evidence of criminal activity, any "reasonable" person would have provided a password without hesitation.

It's a stretch of an argument though -- considering the prosecution needs to provide evidence it knows the stuff it's looking for resides on the devices, which is something extremely difficult to prove when the device is fully encrypted.

The limits of the Fifth Amendment's protections against self-incrimination are far from clearly defined when it comes to encrypted devices.. This leaves the security question in the hands of each individual user. Your choice of security method depends on who you're more worried about having access to your phone. If it's phone thieves, then a fingerprint might do. But if it's the government, use a password.

Filed Under: 5th amendment, encryption, fingerprint, fingerprint swipe, id, paytsar bkhchadzhyan, self incrimination, sevak mesrobian, touch id

Massachusetts Ignores 5th Amendment; Says Defendant Can Be Forced To Decrypt His Computer

from the that's-unfortunate dept

For many years, courts have struggled with the legal question of whether or not law enforcement can force a defendant in a lawsuit to decrypt encrypted files. All the way back in 2007, we wrote about a judge in Vermont finding that such forced decryption represented a Fifth Amendment violation, as it could be considered a form of self-incrimination. However, that was just one court. Other courts have ruled the other way. Not surprisingly, the Justice Department doesn't believe the Fifth Amendment should apply in these situations, but courts still seem to be divided as judges go back and forth on the issue.

Unfortunately, it appears that Massachusetts' highest court has now gone over to the wrong side of the debate, finding that there is no Fifth Amendment violation in forcing people to decrypt their computers. In this ruling, the court said that there was "an exception" to the Fifth Amendment, if the results are a "foregone conclusion." As Cyrus Farivar at Ars Technica summarizes:

That exception, the MSJC said, can be invoked when “an act of production does not involve testimonial communication where the facts conveyed already are known to the government, such that the individual ‘adds little or nothing to the sum total of the Government's information.’”

Of course, that seems like a fairly dangerous "exception." Prosecutors can just claim that such facts are "already known." Furthermore, if the information adds little or nothing, then... why is it even needed? It's difficult to see why anyone should be forced to decrypt information on the basis that... it's not really needed. Here's the key paragraph from the ruling:

When considering the entirety of the defendant's interview with Trooper Johnson, it is apparent that the defendant was engaged in real estate transactions involving Baylor Holdings, that he used his computers to allegedly communicate with its purported owners, that the information on all of his computers pertaining to these transactions was encrypted, and that he had the ability to decrypt the files and documents. The facts that would be conveyed by the defendant through his act of decryption—his ownership and control of the computers and their contents, knowledge of the fact of encryption, and knowledge of the encryption key—already are known to the government and, thus, are a "foregone conclusion." The Commonwealth's motion to compel decryption does not violate the defendant's rights under the Fifth Amendment because the defendant is only telling the government what it already knows.

Given the back and forth nature of so many of these rulings, you have to imagine that it'll eventually end up before the Supreme Court. Hopefully that Court's renewed belief in the Fourth Amendment will extend to the Fifth as well.

Filed Under: 5th amendment, decrypt, encryption, massachusetts, self incrimination