Wednesday, January 9, 2008

District Court Holds Compelled Entry of Password for Encrypted Files Is Testimonial and Therefore Privileged

U.S. Magistrate Judge Niedermeier, in the District of Vermont, held that the compelled entry of a password required to access alleged pornography on a laptop computer would violate defendant's Fifth Amendment right against self-incrimination. In a case of first impression, the Court held that the act of entering the password, even without disclosing it to the government, would be "testimonial," and therefore privileged. In re Boucher, No. 2:06-mj-91 (D.Vt.,2007)

In December 2006, Defendant Boucher was arrested for transportation of child pornography at the Canadian border after a search of his car uncovered a laptop computer. The arresting officer (Curtis), according to the Court, "located approximately 40,000 images, some of which appeared to be pornographic based on the names of the files."

The Court noted that at the time of the arrest, the officer "opened the computer and accessed the files without entering a password." Under questioning, having waived his Miranda rights, Boucher told Curtis that he downloads many pornographic files from internet newsgroups; and sometimes unwittingly downloads child pornography that he deletes when he realizes what he has."

According to the Court, Agent Curtis asked Boucher to show him where the files he downloaded from the newsgroups were located on the laptop; and Boucher was allowed access to the laptop and navigated to a part of the hard drive designated as drive Z. The Court reports that "Agent Curtis did not see Boucher enter a password to access drive Z." After further examination, according to the Court, "Curtis located several images and videos of child pornography in drive Z." After consulting with the United States Attorney's office, Agent Curtis arrested Boucher, and seized the laptop as evidence after shutting it down.

Two weeks later, Mike Touchette of the Vermont Department of Corrections took custody of the laptop, and created a mirror image of its contents. On examination, he discovered that he was unable to access drive Z because it was encrypted by the program Pretty Good Privacy, which required a password to access drive Z. According to the Court, "since shutting down the laptop, the government has been unable to access drive Z to view the images and videos containing child pornography."
Secret Service Agent Matthew Fasvlo, who has experience and training in computer forensics, testified that it is nearly impossible to access these encrypted files without knowing the password. There are no "back doors" or secret entrances to access the files. The only way to get access without the password is to use an automated system which repeatedly guesses passwords. According to the government, the process to unlock drive Z could take years, based on efforts to unlock similarly encrypted files in another case. Despite its best efforts, to date the government has been unable to learn the password to access drive Z.

A grand jury subpoenaed Boucher to provide the password necessary to access the files on the computer. Boucher moved to quash the subpoena on the grounds that it violates his Fifth Amendment right against self-incrimination. At a hearing on the motion, according to the Court, the government proposed that Boucher could enter the password without the government, the grand jury, or the Court observing or recording the password. The government also proposed that the Fifth Amendment issue would be avoided if the Court ordered that the act of entering the password could not be used against Boucher.

For the Fifth Amendment privilege against self-incrimination to apply, according to the Court, "the communication must be compelled, testimonial, and incriminating in nature." According to the Court, "because the files sought by the government allegedly contain child pornography, the entry of the password would be incriminating." Thus, "whether the privilege against self-incrimination applies… depends on whether the subpoena seeks testimonial communication."

According to the Court, "the government concedes that it cannot compel Boucher to disclose the password to the grand jury because the disclosure would be testimonial," but "the question remains whether entry of the password, giving the government access to drive Z, would be testimonial and therefore privileged."

The Court found that "compelling Boucher to enter the password forces him to produce evidence that could be used to incriminate him." The Court explained that "producing the password, as if it were a key to a locked container, forces Boucher to produce the contents of his laptop."
The act of producing even unprivileged evidence can have communicative aspects itself and may be "testimonial" and entitled to Fifth Amendment protection. United States v. Doe, 465 U.S. 605, 612 (1984) [hereinafter Doe I ] ("Although the contents of a document may not be privileged, the act of producing the document may be."). An act is testimonial when the act entails implicit statements of fact, such as admitting that evidence exists, is authentic, or is within a suspect's control. Doe v. United States, 487 U.S. 201, 209 (1988) [hereinafter Doe II ]. The privilege against self-incrimination protects a suspect from being compelled to disclose any knowledge he has, or to speak his guilt…. The suspect may not be put in the "cruel trilemma" of choosing between self-accusation, perjury, or contempt….

The government relied on Doe II, where the Supreme Court upheld a subpoena requiring the defendant to sign a form requesting bank records from the Cayman Islands. The Court found that the form did not acknowledge any accounts and made no statement, implicitly or explicitly, about the existence or control over any accounts. As characterized by the Court, the Supreme Court held that "because signing the form made no statement about the suspect's knowledge, … the act lacked testimonial significance and the privilege did not apply." In this case, however:
Entering a password into the computer implicitly communicates facts. By entering the password Boucher would be disclosing the fact that he knows the password and has control over the files on drive Z. The procedure is equivalent to asking Boucher, "Do you know the password to the laptop?"If Boucher does know the password, he would be faced with the forbidden trilemma; incriminate himself, lie under oath, or find himself in contempt of court.

Unlike the situation in Doe II, Boucher would be compelled to produce his thoughts and the contents of his mind. In Doe II, the suspect was compelled to act to obtain access without indicating that he believed himself to have access. Here, when Boucher enters a password he indicates that he believes he has access.

The Court noted that "in distinguishing testimonial from non-testimonial acts, the Supreme Court has compared revealing the combination to a wall safe to surrendering the key to a strongbox." According to the Court, "the combination conveys the contents of one's mind; the key does not and is therefore not testimonial." The Court found that "a password, like a combination, is in the suspect's mind, and is therefore testimonial and beyond the reach of the grand jury subpoena."

With respect to the government's offer to restrict the entering of the password so that no one views or records the password, the Court acknowledged that "this would prevent the government from knowing what the password is," but "it would not change the testimonial significance of the act of entering the password."
Boucher would still be implicitly indicating that he knows the password and that he has access to the files. The contents of Boucher's mind would still be displayed, and therefore the testimonial nature does not change merely because no one else will discover the password.

The government's offer not to use the production of the password against Boucher, according to the Court, is based on the same argument the Supreme Court rejected in United States v. Hubbell, 530 U.S. 27 (2000). In that case, the government granted Hubbel immunity in connection with the production of documents, and then charged Hubbell with fraud. The government argued that it was not making improper use of the production because it did not need the act of production itself as evidence and the documents themselves were unprivileged.

The Court in Hubbell "found that the act of production had testimonial aspects, because production communicated information about the existence, custody, and authenticity of the documents." "Here, as in Hubbell," according to the Court, "the government cannot separate the non-testimonial aspect of the act of production, entering the password, from its testimonial aspect."
The testimonial aspect of the entry of the password precludes the use of the files themselves as derivative of the compelled testimony. Any files the government would find based on Boucher's entry of the password could not be used against the privilege against self-incrimination does not apply to an act of production if the existence and location of the subpoenaed evidence is known to the government and the production would not "implicitly authenticate" the evidence.

As recounted by the Court:
In Doe III, the suspect had produced a photocopy of a personal calendar but the Government suspected that the calendar had been altered through the whiting out of incriminating entries…. The government subpoenaed the suspect to produce the original calendar before the grand jury…. The Second Circuit reasoned that the existence and location of the calendar was a "foregone conclusion" because it was known, through production of the photocopy, that the suspect had possession of the calendar and the original calendar added little or nothing to the sum total of the government's information…. The court also found that act of production itself was not necessary to authenticate the original calendar because the Government could authenticate it simply by comparing it to the photocopy…. Therefore, because the government had knowledge of the existence and location of the original calendar and did not need to use the act of production to authenticate the original calendar, the suspect had no act of production privilege and was required to produce the original calendar before the grand jury….

"Here," according to the Court, "the subpoena can be viewed as either compelling the production of the password itself or compelling the production of the files on drive Z. Both alternatives are distinguishable from Doe III."
If the subpoena is requesting production of the files in drive Z, the foregone conclusion doctrine does not apply. While the government has seen some of the files on drive Z, it has not viewed all or even most of them. While the government may know of the existence and location of the files it has previously viewed, it does not know of the existence of other files on drive Z that may contain incriminating material. By compelling entry of the password the government would be compelling production of all the files on drive Z, both known and unknown. Unlike in Doe III, the files the government has not seen could add much to the sum total of the government's information. Therefore, the foregone conclusion doctrine does not apply and the act of production privilege remains.

Since the government is trying to compel the production of the password itself, the foregone conclusion doctrine cannot apply. The password is not a physical thing. If Boucher knows the password, it only exists in his mind. This information is unlike a document, to which the foregone conclusion doctrine usually applies, and unlike any physical evidence the government could already know of. It is pure testimonial production rather than physical evidence having testimonial aspects. Compelling Boucher to produce the password compels him to display the contents of his mind to incriminate himself. Doe III did not deal with production of a suspect's thoughts and memories but only previously created documents. The foregone conclusion doctrine does not apply to the production of non-physical evidence, existing only in a suspect's mind where the act of production can be used against him.

No comments: