District Court Holds Compelled Entry of Password for Encrypted Files Is Testimonial and Therefore Privileged

U.S. Magistrate Judge Niedermeier, in the District of Vermont, held that the compelled entry of a password required to access alleged pornography on a laptop computer would violate defendant's Fifth Amendment right against self-incrimination. In a case of first impression, the Court held that the act of entering the password, even without disclosing it to the government, would be "testimonial," and therefore privileged. In re Boucher, No. 2:06-mj-91 (D.Vt.,2007)

In December 2006, Defendant Boucher was arrested for transportation of child pornography at the Canadian border after a search of his car uncovered a laptop computer. The arresting officer (Curtis), according to the Court, "located approximately 40,000 images, some of which appeared to be pornographic based on the names of the files."

The Court noted that at the time of the arrest, the officer "opened the computer and accessed the files without entering a password." Under questioning, having waived his Miranda rights, Boucher told Curtis that he downloads many pornographic files from internet newsgroups; and sometimes unwittingly downloads child pornography that he deletes when he realizes what he has."

According to the Court, Agent Curtis asked Boucher to show him where the files he downloaded from the newsgroups were located on the laptop; and Boucher was allowed access to the laptop and navigated to a part of the hard drive designated as drive Z. The Court reports that "Agent Curtis did not see Boucher enter a password to access drive Z." After further examination, according to the Court, "Curtis located several images and videos of child pornography in drive Z." After consulting with the United States Attorney's office, Agent Curtis arrested Boucher, and seized the laptop as evidence after shutting it down.

Two weeks later, Mike Touchette of the Vermont Department of Corrections took custody of the laptop, and created a mirror image of its contents. On examination, he discovered that he was unable to access drive Z because it was encrypted by the program Pretty Good Privacy, which required a password to access drive Z. According to the Court, "since shutting down the laptop, the government has been unable to access drive Z to view the images and videos containing child pornography."

Secret Service Agent Matthew Fasvlo, who has experience and training in computer forensics, testified that it is nearly impossible to access these encrypted files without knowing the password. There are no "back doors" or secret entrances to access the files. The only way to get access without the password is to use an automated system which repeatedly guesses passwords. According to the government, the process to unlock drive Z could take years, based on efforts to unlock similarly encrypted files in another case. Despite its best efforts, to date the government has been unable to learn the password to access drive Z.

A grand jury subpoenaed Boucher to provide the password necessary to access the files on the computer. Boucher moved to quash the subpoena on the grounds that it violates his Fifth Amendment right against self-incrimination. At a hearing on the motion, according to the Court, the government proposed that Boucher could enter the password without the government, the grand jury, or the Court observing or recording the password. The government also proposed that the Fifth Amendment issue would be avoided if the Court ordered that the act of entering the password could not be used against Boucher.

For the Fifth Amendment privilege against self-incrimination to apply, according to the Court, "the communication must be compelled, testimonial, and incriminating in nature." According to the Court, "because the files sought by the government allegedly contain child pornography, the entry of the password would be incriminating." Thus, "whether the privilege against self-incrimination applies… depends on whether the subpoena seeks testimonial communication."

According to the Court, "the government concedes that it cannot compel Boucher to disclose the password to the grand jury because the disclosure would be testimonial," but "the question remains whether entry of the password, giving the government access to drive Z, would be testimonial and therefore privileged."

The Court found that "compelling Boucher to enter the password forces him to produce evidence that could be used to incriminate him." The Court explained that "producing the password, as if it were a key to a locked container, forces Boucher to produce the contents of his laptop."

The act of producing even unprivileged evidence can have communicative aspects itself and may be "testimonial" and entitled to Fifth Amendment protection. United States v. Doe, 465 U.S. 605, 612 (1984) [hereinafter Doe I ] ("Although the contents of a document may not be privileged, the act of producing the document may be."). An act is testimonial when the act entails implicit statements of fact, such as admitting that evidence exists, is authentic, or is within a suspect's control. Doe v. United States, 487 U.S. 201, 209 (1988) [hereinafter Doe II ]. The privilege against self-incrimination protects a suspect from being compelled to disclose any knowledge he has, or to speak his guilt…. The suspect may not be put in the "cruel trilemma" of choosing between self-accusation, perjury, or contempt….

The government relied on Doe II, where the Supreme Court upheld a subpoena requiring the defendant to sign a form requesting bank records from the Cayman Islands. The Court found that the form did not acknowledge any accounts and made no statement, implicitly or explicitly, about the existence or control over any accounts. As characterized by the Court, the Supreme Court held that "because signing the form made no statement about the suspect's knowledge, … the act lacked testimonial significance and the privilege did not apply." In this case, however:

Entering a password into the computer implicitly communicates facts. By entering the password Boucher would be disclosing the fact that he knows the password and has control over the files on drive Z. The procedure is equivalent to asking Boucher, "Do you know the password to the laptop?"If Boucher does know the password, he would be faced with the forbidden trilemma; incriminate himself, lie under oath, or find himself in contempt of court.

Unlike the situation in Doe II, Boucher would be compelled to produce his thoughts and the contents of his mind. In Doe II, the suspect was compelled to act to obtain access without indicating that he believed himself to have access. Here, when Boucher enters a password he indicates that he believes he has access.

The Court noted that "in distinguishing testimonial from non-testimonial acts, the Supreme Court has compared revealing the combination to a wall safe to surrendering the key to a strongbox." According to the Court, "the combination conveys the contents of one's mind; the key does not and is therefore not testimonial." The Court found that "a password, like a combination, is in the suspect's mind, and is therefore testimonial and beyond the reach of the grand jury subpoena."

With respect to the government's offer to restrict the entering of the password so that no one views or records the password, the Court acknowledged that "this would prevent the government from knowing what the password is," but "it would not change the testimonial significance of the act of entering the password."

Boucher would still be implicitly indicating that he knows the password and that he has access to the files. The contents of Boucher's mind would still be displayed, and therefore the testimonial nature does not change merely because no one else will discover the password.

The government's offer not to use the production of the password against Boucher, according to the Court, is based on the same argument the Supreme Court rejected in United States v. Hubbell, 530 U.S. 27 (2000). In that case, the government granted Hubbel immunity in connection with the production of documents, and then charged Hubbell with fraud. The government argued that it was not making improper use of the production because it did not need the act of production itself as evidence and the documents themselves were unprivileged.

The Court in Hubbell "found that the act of production had testimonial aspects, because production communicated information about the existence, custody, and authenticity of the documents." "Here, as in Hubbell," according to the Court, "the government cannot separate the non-testimonial aspect of the act of production, entering the password, from its testimonial aspect."

The testimonial aspect of the entry of the password precludes the use of the files themselves as derivative of the compelled testimony. Any files the government would find based on Boucher's entry of the password could not be used against the privilege against self-incrimination does not apply to an act of production if the existence and location of the subpoenaed evidence is known to the government and the production would not "implicitly authenticate" the evidence.

As recounted by the Court:

In Doe III, the suspect had produced a photocopy of a personal calendar but the Government suspected that the calendar had been altered through the whiting out of incriminating entries…. The government subpoenaed the suspect to produce the original calendar before the grand jury…. The Second Circuit reasoned that the existence and location of the calendar was a "foregone conclusion" because it was known, through production of the photocopy, that the suspect had possession of the calendar and the original calendar added little or nothing to the sum total of the government's information…. The court also found that act of production itself was not necessary to authenticate the original calendar because the Government could authenticate it simply by comparing it to the photocopy…. Therefore, because the government had knowledge of the existence and location of the original calendar and did not need to use the act of production to authenticate the original calendar, the suspect had no act of production privilege and was required to produce the original calendar before the grand jury….

"Here," according to the Court, "the subpoena can be viewed as either compelling the production of the password itself or compelling the production of the files on drive Z. Both alternatives are distinguishable from Doe III."

If the subpoena is requesting production of the files in drive Z, the foregone conclusion doctrine does not apply. While the government has seen some of the files on drive Z, it has not viewed all or even most of them. While the government may know of the existence and location of the files it has previously viewed, it does not know of the existence of other files on drive Z that may contain incriminating material. By compelling entry of the password the government would be compelling production of all the files on drive Z, both known and unknown. Unlike in Doe III, the files the government has not seen could add much to the sum total of the government's information. Therefore, the foregone conclusion doctrine does not apply and the act of production privilege remains.

Since the government is trying to compel the production of the password itself, the foregone conclusion doctrine cannot apply. The password is not a physical thing. If Boucher knows the password, it only exists in his mind. This information is unlike a document, to which the foregone conclusion doctrine usually applies, and unlike any physical evidence the government could already know of. It is pure testimonial production rather than physical evidence having testimonial aspects. Compelling Boucher to produce the password compels him to display the contents of his mind to incriminate himself. Doe III did not deal with production of a suspect's thoughts and memories but only previously created documents. The foregone conclusion doctrine does not apply to the production of non-physical evidence, existing only in a suspect's mind where the act of production can be used against him.

Eighth Circuit Blocks Sharing of Leased Broadband Radio Service Channels With Licensee's Competitor

A unanimous panel of the Eighth Circuit Court of Appeals blocked a Sprint subsidiary's customer from sharing leased Broadband Radio Service channels with a Sprint competitor. PCTV Gold, Inc. v. Speednet, LLC, No. 07-2189 (8th Cir., November 29, 2007). The Court upheld a district court finding that Sprint was likely to prevail on its claim that Speednet, LLC's proposed joint venture with Clearwire, Inc. in Saginaw, Michigan, would breach a "Right of First Offer," which ostensibly required SpeedNet to offer to sell its assets to Sprint before selling to any other party. The Court found that Sprint would suffer irreparable harm "if the district court should later find Sprint is entitled to specific performance" because "it will be difficult if not impossible to undo the transfer of assets to Clearwire."

The Sprint subsidiary, PCTV Gold, Inc., is licensed by the FCC to operate a Broadband Radio Service in the Saginaw, Michigan area. SpeedNet, a provider of fixed and portable high-speed wireless internet services, leased BRS channels from Sprint pursuant to a Market Operation Agreement (MOA). After entering into the MOA, SpeedNet began negotiations with Clearwire, one of Sprint's competitors, and in August, 2006, SpeedNet and Clearwire executed a Purchase Agreement, under which they agreed to either merge or enter into a joint venture that would offer services using the spectrum leased from Sprint.

On March 1, 2007, Sprint filed a breach of contract action against SpeedNet, seeking injunctive relief and specific performance to enforce SpeedNet's obligation to first offer the sale of its assets to Sprint. In April 2007, Sprint moved for a preliminary injunction to prohibit SpeedNet from transferring its assets or otherwise altering the structure of its company before Sprint's rights under the ROFO provision of the MOA had been adjudicated.

The Court found that the Sprint subsidiary would suffer irreparable harm because "if the district court should later find Sprint is entitled to specific performance, it will be difficult if not impossible to undo the transfer of assets to Clearwire."

Following a hearing on the motion, the Court found that Sprint appeared likely to succeed on the merits of its claims, and that Sprint was subject to irreparable injury if SpeedNet was permitted to merge or enter into a joint venture with Clearwire. The Court entered a preliminary injunction, which enjoins SpeedNet from:

(1) closing upon, transferring assets in furtherance of, or completing any portion of the transaction envisioned in the Purchase Agreement between SpeedNet and Clearwire;
(2) executing or entering in to the draft Joint Venture Agreement between SpeedNet and Clearwire; or
(3) selling or transferring any assets to any third party entity other than transactions in the ordinary course of business.

SpeedNet appealed from portions of paragraphs (2) and (3) of the district court's order relating to the joint venture with Clearwire. The Court recited the standard for granting a preliminary injunction: "Whether a preliminary injunction should issue involves consideration of (1) the threat of irreparable harm to the movant; (2) the state of the balance between this harm and the injury that granting the injunction will inflict on other parties litigant; (3) the probability that movant will succeed on the merits; and (4) the public interest." Dataphase Sys., Inc. v. C L Systems, Inc., 640 F.2d 109, 114 (8th Cir.1981). The Court concluded that the district court did not abuse its discretion in granting the preliminary injunction, and properly applied the Dataphase factors. According to the Court:

(1) Sprint is subject to irreparable injury should SpeedNet be permitted to merge or enter into a joint venture with Clearwire because monetary relief will not provide adequate or complete relief to it; (2) Sprint is likely to succeed on the merits as to its claim of SpeedNet breaching the ROFO provision of its MOA agreement with Sprint and must first tender an offer to sell to Sprint before all others; (3) the balance of equities warrants the issuance of a preliminary injunction; and (4) the granting of the preliminary injunction promotes the public interest under Kansas law by protecting the freedom to contract through enforcement of contractual rights and obligations.

With respect to irreparable injury, the Court pointed out that "the SpeedNet JV will alter the structure of SpeedNet before Sprint has the opportunity to purchase it." According to the Court, "if the district court should later find Sprint is entitled to specific performance, it will be difficult if not impossible to undo the transfer of assets to Clearwire."

Moreover, according to the Court, "spectrum has unique characteristics that make its loss one which cannot be fully compensated by an award of money damages." The Court pointed out that "the parties specifically agreed in Section 13.2 of the MOA that because spectrum rights are 'of a special, unique, unusual and extraordinary character,' the non-defaulting party is entitled to obtain injunctive and other equitable relief." Accordingly, the Court concluded that "the district court did not err in finding Sprint will be irreparably harmed if SpeedNet is allowed to execute the SpeedNet JV before Sprint's claims are adjudicated."

With respect to Sprint's likelihood of prevailing on the merits, SpeedNet argued that it did not breach the MOA, and that Sprint is equitably estopped from preventing the SpeedNet JV. As characterized by the Court, "SpeedNet contends it did not breach the ROFO provision because such provision didn't prohibit it from speaking with a third party about a potential sale."

Additionally, SpeedNet contended that the ROFO provision does not apply because Sprint is incapable of matching Clearwire's "unique" offer of privately held stock and warrants. On the other hand, as framed by the Court, "Sprint contends that the ROFO provision requires SpeedNet to inform Sprint when it first considers selling its assets and to provide Sprint with written notice of the sale terms SpeedNet would find acceptable," and that SpeedNet is absolutely prohibited from signing a purchase agreement with a third party prior to offering the sale to Sprint.

Abjuring any need to "decide which interpretation of the ROFO is the correct one," the Court limited its inquiry to the "district court's assessment of Sprint's likelihood to prevail on the merits." The Court concluded that "the district court considered each party's arguments carefully and did not err in concluding Sprint has demonstrated a reasonable likelihood of success on the merits of its claim."

The Court rejected SpeedNet's argument that Sprint is equitably estopped from preventing the SpeedNet JV because Sprint encouraged, promoted and benefitted from it. According to the Court, "a party requesting estoppel must show the other party engaged in affirmative conduct designed to mislead it." Under Kansas law—

a party asserting equitable estoppel must show that another party, by its acts, representations, admissions, or silence when it had a duty to speak, induced it to believe certain facts existed. It must also show it rightfully relied and acted upon such belief and would now be prejudiced if the other party were permitted to deny the existence of such facts…. Estoppel will not be held to exist where facts are ambiguous or subject to more than one construction.

SpeedNet claimed Sprint engaged in affirmative conduct which misled SpeedNet into thinking Sprint supported the SpeedNet JV and it would now be prejudiced if prevented from consummating the deal. The Court acknowledged that "in the absence of SpeedNet's alleged breach of the ROFO provision, SpeedNet might be correct that Sprint would be estopped from attempting to prevent the SpeedNet JV." However, according to the Court, "Sprint cannot be estopped from enforcing the ROFO provision because Sprint never engaged in conduct designed to mislead SpeedNet into thinking it would not enforce the provision.

The Court concluded that the district court did not err in assessing the balance of the harms. The Court found that the alleged harm to SpeedNet—a lost business opportunity—was undermined by the fact that a preliminary injunction would only delay its transfer of assets, and outweighed by the potential harm to Sprint, which would "forever lose its rights to purchase SpeedNet in its current state."

The Court found that the district court adequately considered the pubic interest when it carefully considered SpeedNet's argument about a preliminary injunction giving Sprint a monopoly over the spectrum in the Detroit market. According to the Court, "the transcript suggests the district court was persuaded by Sprint's assurances its alleged monopoly would not harm the public interest." In addition, the district court "considered the public's interest in protecting contractual rights.," and "did not abuse its discretion by concluding its grant of a preliminary injunction promoted the public interest by protecting freedom to contract through enforcement of contractual rights and obligations."

Second Circuit Vacates Settlement of Freelance Writers' Class Action

A unanimous panel of the Second Circuit Court of Appeals held that the copyright registration requirement is jurisdictional. Therefore, the district court could not exercise jurisdiction over a copyright infringement class action that included claims for the infringement of unregistered copyrights. In re Literary Works in Electronic Databases Copyright Litigation, No. 05-5943-cv(L) (2d Cir., November 29, 2007)

Plaintiffs brought a class action against publishers on behalf of freelance writers who contracted to author works for publication in print media, and retained the copyrights in those works. The complaint alleged that the contracts did not grant the publishers the right to electronically reproduce those works or license them for electronic reproduction by others, but that the publishers did so anyway in violation of plaintiffs' copyrights.

"After years of negotiations," according to the Court, "class and defense counsel finally agreed on a settlement." "Following lengthy motion practice, the District Court for the Southern District of New York certified a class and approved the settlement." Dissenting class members appealed.

According to the Court, "the overwhelming majority of claims within the certified class arise from the infringement of unregistered copyrights." The issue on appeal, as framed by the Court, is "whether the District Court had jurisdiction to certify a class consisting of claims arising from the infringement of unregistered copyrights and to approve a settlement with respect to those claims." The Court held that the district court did not have jurisdiction.

The Court recounted the history of the litigation, which began with New York Times Co. v. Tasini, 533 U.S. 483 (2001), in which the Supreme Court held that §201(c) of the Copyright Act does not permit publishers to reproduce freelance works electronically without specific authorization to do so. After the Court decided Tasini, three class actions that had been stayed pending the decision, were reactivated and consolidated in the Southern District of New York.

According to the Court, the case involved two kinds of plaintiffs—individual authors and trade groups representing authors—and two classes of defendants—publishers of original electronic content, such as the New York Times Co., and companies operating databases that license content from publishers, such as Thomson Corporation, the owner of Westlaw.

Liability having been established by Tasini, the district court referred the parties to mediation regarding damages. Defendants took the position that the case had little settlement value because the vast majority of claims could not be certified in any class because the copyrights had not been registered as required by §411(a) of the Copyright Act, which provides that "no action for infringement of the copyright in any United States work shall be instituted until preregistration or registration of the copyright claim has been made in accordance with this title." Based on survey evidence, Defendants estimated that less than one percent of the claims satisfied the jurisdictional prerequisite.

"Despite this looming jurisdictional issue," according to the Court, "the desire to achieve global peace in the publishing industry spurred the parties through more than three years of 'often heated' negotiations until they reached an agreement in 2005." The agreement defines the class, "for settlement purposes only," as follows:

All persons who, individually or jointly, own a copyright under the United States copyright laws in an English language literary work that has been reproduced, displayed, adapted, licensed, sold and/or distributed in any electronic or digital format, without the person's express authorization by a member of the Defense Group or any member's subsidiaries, affiliates, or licensees (a) at any time on or after August 15, 1997 (regardless of when the work first appeared in an electronic database) or (b) that remained in circulation after August 15, 1997, even if licensed prior thereto, including English language works qualifying for U.S. copyright protection under an international treaty (hereinafter "Subject Work").

The settlement established three categories of claims. Category A claims concern copyrights that were registered prior to any infringement, and which are eligible for statutory damages and attorney's fees. Category B claims concern copyrights that were registered after the infringing reproduction but before December 31, 2002, and which only qualify for actual damages. Category C claims, "by far the most numerous," according to the Court, concern copyrights registered after December 31, 2002 or never registered at all.

Under the settlement, Category A claimants receive a flat fee; Category B claimants receive the greater of either a flat fee or a percentage of the original price of the work; and, "by and large, Category C claimants also receive the greater of either a flat fee or a percentage of the original price of the work." However, according to the Court, "importantly, if the cost of all claims (plus the cost of notice, administration, and attorney's fees) exceeds $18 million, then the amount paid to Category C claimants is reduced—potentially to zero—before the claims of Category A and B claimants are affected. This feature is called the 'C-reduction.'"

Plaintiffs and Defendants jointly moved for class certification and approval of the settlement. Objections were filed on the ground, withal, that "the disparate treatment of Category C claimants illustrates that named plaintiffs, who each possess at least some registered copyrights, did not adequately represent those absent class members who possess only unregistered copyrights."

The district court granted class certification and settlement approval in September, 2005, but according to the Court, "the District Court never considered whether it had jurisdiction to certify a class consisting mostly of claims arising from unregistered copyrights, or to approve a settlement resolving those claims."

Objectors appealed, and the Court, "became concerned that the District Court and the parties had passed over a nettlesome jurisdictional question." Accordingly, the Court ordered the parties to file briefs "addressing the issue of whether the District Court had subject matter jurisdiction over claims concerning the infringement of unregistered copyrights."

On appeal, the Court emphasized that the Copyright Act's registration requirement is jurisdictional.

Whether this requirement is jurisdictional is not up for debate in this Circuit. On two recent occasions, we have squarely held that it is. See Well-Made Toy Mfg. Corp. v. Goffa Int'l Corp., 354 F.3d 112, 114, 115 (2d Cir.2003) (affirming dismissal for lack of "subject matter jurisdiction" because section 411(a)'s "registration requirement is jurisdictional"); Morris v. Business Concepts, Inc., 259 F.3d 65, 72, 73 (2d Cir.2001) (holding "that subject matter jurisdiction was lacking because the registration requirement of section 411(a) was not satisfied" and affirming dismissal "for lack of subject matter jurisdiction").

The Court refused to overrule its holdings in Morris and Well-Made. "The short answer to these arguments is that this panel simply cannot overrule a prior panel's holding."

The Court further held that "each claim within the certified class must satisfy section 411(a)'s registration requirement." The Court rejected the argument that jurisdiction is proper so long as the named plaintiffs' works were registered.

First, the Court noted that class action certification under Rule 23 does not offer any alternative source of jurisdiction, citing 28 U.S.C. §2072(b), which provides that the federal "rules shall not abridge, enlarge or modify any substantive right," and Fed.R.Civ.P. 82, which provides that "these rules shall not be construed to extend or limit the jurisdiction of the United States district courts."

Under the language of §411(a), according to the Court, "the question, as we see it, is whether the phrase 'the copyright claim' refers to all the claims within the class or only those claims of the named plaintiffs."

The Court agreed that "on the literal level, the language is not dispositive" because "the phrase 'the copyright claim' does not require, or even tend toward, one reading." The Court found, however, that "case law does provide some useful guidance as to how we should interpret that phrase."

The Court observed that "we have applied Article III's jurisdictional requirements to each member of a class," Denney v. Deutsche Bank AG, 443 F.3d 253, 264 (2d Cir., 2006); and "since statutory and constitutional jurisdictional requirements are equally binding, … the same approach should hold here."

The Court also cited Zahn v. Int'l Paper Co., 414 U.S. 291 (1973) (result overruled by 28 U.S.C. §1367), which held that the diversity statute requires each class member to satisfy the amount-in-controversy requirement. 414 U.S. at 301. The Court held that the phrase "matter in controversy" in §1332(a) refers to each class member's claim and therefore requires each claim to satisfy the statute's amount-in-controversy requirement.

Similarly, in Weinberger v. Salfi, 422 U.S. 749 (1975), the Court addressed whether a district court properly certified a class of Social Security claimants who asserted that they had been denied benefits wrongfully. Section205(g) of the Social Security Act grants subject matter jurisdiction over only "final" decisions of the Secretary. Reviewing a class certification, the Supreme Court concluded that the named plaintiffs' claims satisfied the finality requirement but that claims of absent class members did not.

According to the Court, "we see no reason to interpret or apply the jurisdictional requirement of section 411(a) any differently."

In light of these precedents, we hold that the phrase "the copyright claim" in section 411(a) refers to each claim within a purported class, and thus requires that each class member's claim arise from a registered copyright. Only when each claim satisfies that jurisdictional prerequisite may the district court utilize Rule 23 to "exercise [its] jurisdiction over the various individual claims in a single proceeding."