Court Finds Fifth Amendment Protection For Encrypted Hard Drives

WSJ:

In a ruling that could have broad ramifications for law enforcement, a federal appeals court has ruled that a man under investigation for child pornography isn’t required to unlock his computer hard drives for the federal government, because that act would amount to the man offering testimony against himself.

The ruling Thursday appears to be the first by a federal appeals court to find that a person can’t be forced to turn over encyption codes or passwords in a criminal investigation, in light of the Fifth Amendment, which holds that no one “shall be compelled in any criminal case to be a witness against himself.”

The Atlanta-based U.S. Court of Appeals of the 11th Circuit ruled that “the Fifth Amendment protects [the man’s] refusal to decrypt and produce the contents of the media devices,” which the government believes contain child pornography.

In this instance, the accused individual hasn’t even been charged.

Regular readers will remember my call for a computer forensics innocence project. Among my concerns is that if your hard drive or mine fails, there’s no hope of ever recovering a thing from it. But if the police get the same hard drive they explain that there’s no way to completely delete anything on it.

Bruce Schneier, one of the most respected computer security specialists in the world, “We in the security field know the risks associated with trusting digital data, but this evidence is routinely assumed by courts to be accurate.”

Computer forensics is a complex, time consuming, and expensive process poorly understood outside the world of experts. Computer data is volatile and a good computer forensics expert must be skilled in the acquisition, analysis and presentation of computer evidence. For the average person, especially outside of big metropolitan areas, that’s impossibly hard to find.

8 Comments

  1. The constitution is very clear on the this issue. The law enforcement agencies will be required to obtain a search warrant for informaiton concerning the crime and no individual will be compelled to be witness against himself.

    This is no different than one having documents in a safe. You are not required to unlock a safe, the law gets a safecracker or locksmith and they open the safe.

    Guess the law needs to hire a teenager to decrypt the computer and break into the computer.

  2. Could this boomerang, say you have a suit against any governmental agency, could you subpena all the stuff on their computers. Say for example, a cop shooting of a civilian that was unwarranted.

  3. Dduck- A government agency is different than an individual. Unless there’s been a Supreme Court ruling that I missed saying that government agencies are people too.

    I’ve never heard of a government agency “taking the fifth”.

    But an interesting question and I’d be interested in other viewpoints.

  4. I know it’s far fetched, but the law of unintended consequences is still in force.

  5. The Fifth Amendment privilege isn’t triggered when the government merely compels some physical act, like unlocking a safe-deposit box, the court said. But the amendment protects testimony in which a person is forced to use “the contents of his own mind” to state a fact.

    If a safe had a combination the isn’t that using “the contents of his own mind”? There also may be other issues

    “It is not enough for the Government to argue that the encrypted drives are capable of storing vast amounts of data, some of which may be incriminating,” the judge wrote. “Just as a vault is capable of storing mountains of incriminating documents, that alone does not mean that it contains incriminating documents, or anything at all.”

    In a similar case, a federal court in Vermont in 2009 ordered a suspect to produce an unencrypted version of a drive on his laptop, but authorities had already seen evidence of child pornography on it.

    I can see why they wouldn’t require decryption without more evidence but then they shouldn’t allow opening a safe if it’s just a fishing expedition either. I have a feeling this may get reversed again.

  6. I hate to say it, but I agree 100% with RP. If this digital info is needed get a warrant. Since 9-11, our government is snooping on digital data without a warrant. If a reasonable suspicion of a crime is present, let LEO get a warrant…

  7. Well I think one point to be made here regarding warrant is that even with a warrant the ruling would seem to preclude the government getting the password from the suspect.

    Since even basic PGP software can provide encryption with trillions of combinations, the information would, in effect, be unavailable even with a warrant.

  8. I hate to say it, but I agree 100% with RP. If this digital info is needed get a warrant. Since 9-11, our government is snooping on digital data without a warrant. If a reasonable suspicion of a crime is present, let LEO get a warrant

    What? Did you even look a the case? The cops had a warrant and seized the data. Because of the encryption they couldn’t crack the drives to find out what’s on them. The cops provided that info to the DA and the DA took it to a grand jury and a fed judge issued a contempt citation. This is so far past a warrant stage.

    I think I get the argument tho I haven’t had time to work all the way thru it. Using this encryption you can’t even tell if there is anything there. It partitions and “hides” part of the drive and you can’t tell if it is even there never mind what’s on it. So by providing a key then you are confirming it’s presence (an encrypted partition) and thus testifying against yourself. I see the logic and it makes it a more complicated situation than providing a combination to a safe. It would be like providing the combination to a hidden safe, you have the combo but you must also give the “location” which they can’t force you to do. Hmmmm…..

    I’m a but torn on this.

Submit a Comment