Does the Fifth Amendment privilege against self-incrimination provide grounds for a defendant to refuse to decrypt a smartphone, hard drive or other device which was seized by law enforcement under a valid search warrant? Recent cases suggest that Fifth Amendment protections may not apply, and thus a court may compel the accused to decrypt a seized electronic device.
The Fifth Amendment protects a criminal defendant from being a “witness against himself.” That protection applies only when a compelled communication is testimonial in nature, i.e., the communication will “explicitly or implicitly…relate a factual assertion or disclose information.” Doe v. U.S., 487 U.S. 201, 210 (1988).
Is the act of producing documents or electronic evidence in response to a subpoena a testimonial communication? In the seminal case of Fisher v. US, 425 U.S. 391 (1976), the Supreme Court reasoned that the act of production (tax documents in that case) may be testimonial because it could implicitly admit the existence and authenticity of the evidence and that the defendant had custody and control. However, the Fisher Court recognized an exception — the production of documents is not “testimonial” if the testimonial facts which would be implicit in the act of production are a “foregone conclusion.” When applying the “foregone conclusion” exception later in US v. Hubbell, 530 U.S. 27 (2000), the Court explained that to show that any implied testimony would be a foregone conclusion, the Government must describe with “reasonable particularity” the evidence it is seeking.
The Eleventh Circuit applied this reasoning to a case involving compelled decryption in US v. Doe (In re Grand Jury Subpoena Duces Tecum), 670 F.3d 1335 (11th Cir. 2012). The Defendant invoked his Fifth Amendment right after the Government seized two laptops and five external hard drives, much of which was password encrypted and not able to be forensically examined. That court held that the act of decryption by password is testimonial because it compels the individual to use the “contents of his own mind” to communicate some statement of fact. See Curcio v. United States, 354 U. S. 118, 128 (1957). The Government did not establish the “foregone conclusion” exception because the Government did not know whether any files existed on the device, nor did it know with “reasonable particularity” that the individual could even access the encrypted data. Compare this result to the cases which hold that the compelling of an accused’s fingerprint does not implicate the Fifth Amendment privilege because the production of a fingerprint is not considered “testimonial” because it lacks a communicative act. See, e.g., Schmerber v. California, 384 U. S. 757 (1966) (providing a blood sample is not testimonial).
In comparison, the Third Circuit Court of Appeals recently affirmed the compelled decryption of devices. In U.S. v. Apple MacPro Computer, 851 F.3d 238 (3d Cir. 2017) the court held that the government had carried its burden of proving that any “testimony” implied by the act of decryption was a “foregone conclusion.” First, the custody and control of the devices and the authenticity of evidence were not at issue. Second, the Government demonstrated with particularity the evidence it sought – its forensic examination of unencrypted portions of the devices revealed the presence of child pornography and log files showed visits to websites offering it. In addition, the accused had shown the illegal images to a witness who watched him access the images from the accused’s computer and external hard drives. Third, the evidence showed that defendant knew the passwords because he had provided passwords to one of his seized smartphones (but not to a “vault” type app on the device) and shown the contents to a witness. Thus, defendant’s feigned lack of memory of the key to two external hard drives was unavailing. In contrast with Doe, in Apple MacPro the Government knew of the existence of the illegal files and knew the Defendant could access them.
Most recently, in March 2018 a California district court applied the “foregone conclusion” exception to a case involving the decryption of an iPhone, a laptop, and an external hard drive. In re Search of a Residence in Aptos, Calif., 2018 WL 1400401 (N.D. Cal. March 20, 2018). Citing the Apple MacPro decision, the Aptos court found that decryption would be non-testimonial. Custody and control were not an issue, and a third party co-conspirator testified that that the defendant knew the password and shared the illegal images with the witness. It went on to point out that to find otherwise, the Fifth Amendment would preclude the production of a device if a password was used, but not a fingerprint. It stated that “a rule that the government can never compel decryption of a password-protected device would lead to absurd results. Whether a defendant would be required to produce a decrypted drive would hinge on whether he protected that drive using a fingerprint key or a password composed of symbols.”
In summary, the recent trend in compelled-decryption cases appears to hinge on whether the Government has independent knowledge that the individual is the owner of the device in question, the device contains evidence of a crime, and that the individual knows how to decrypt the device. With smartphones, tablets, and mobile technology becoming ubiquitous, along with their built-in encryption methods, we expect the issue of compelled decryption to be raised more frequently. Chief Justice Roberts even mused that smartphones “are now such a pervasive and insistent part of daily life that the proverbial visitor from Mars might conclude they were an important feature of human anatomy.” Riley v. California, 134 S. Ct. 2473, 2484 (2014).