A Computer Gets Keyed

Despite the  heated  arguments surrounding the case of  Sebastien  Boucher and the government’s efforts to obtain his password to collect evidence of his possession of kiddie porn, we suffered Boucher-interruptus when Vermont Magistrate Judge Jerome J. Niedermeier’s decision never made it up to the Circuit. 

The good news is we have bad news to report.  Colorado District Court Judge Robert Blackburn has issued a decision in United States v. Fricosu, raising many of the same issues presented by Boucher.  The defendant’s home was searched pursuant to a warrant, and a computer seized which held encrypted files.  She decided to chat about it with her husband, who was in jail on a state charge, on a recorded line, giving the government a pretty clear conversation so show that this was her computer, that she knew it was encrypted and that it contained stuff she would prefer the government not know.

So, the government subpoenaed the defendant to produce an unencrypted version of the content of the computer. For good measure, they offered her immunity for doing so.

Fricosu moved to quash, arguing that the subpoena violated her Fifth Amendment privilege against self-incrimination, demanding a testimonial act of production by compelling her to acknowledge her control over the computer and its contents.  Mind you, the contents themselves are not protected, as evidence of a crime already searchable by virtue of the warrant for her home, but the contents, already in the prosecution’s hands, can’t be “interpreted” without the encryption key.  This is a geeky point, and of little legal significance, but I would hate for the geeks out there to castigate me for failure to acknowledge this detail.

Judge Blackburn found, under the preponderance of evidence standard, that there was no privilege left to protect.

There is little question here but that the government knows of the existence and location of the computer’s files. The fact that it does not know the specific content of any specific documents is not a barrier to production. (Citations omitted.)

Additionally, I find and conclude that the government has met its burden to show by a preponderance of the evidence that the Toshiba Satellite M305 laptop computer belongs to Ms. Fricosu, or, in the alternative, that she was its sole or primary user, who, in any event, can access the encrypted contents of that laptop computer. The uncontroverted evidence demonstrates that Ms. Fricosu acknowledged to Whatcott during their recorded phone conversation that she owned or had such a laptop computer, the contents of which were only accessible by entry of a password.

Moreover, the government has offered Ms. Fricosu immunity, precluding it from using her act of producing the unencrypted contents of the laptop computer against her.

The court held that it was a “foregone conclusion” that the computer was hers and she had the ability to access its contents, unencrypted, thereby dissipating her 5th Amendment privilege against compelling her to engage in the testimonial act of production.

As much as I hate the outcome, under the general principle that the prosecution should not be able to make the defendant do anything to contribute to her own conviction, the decision comports with existing precedent.  To prove my pain in this regard, I note that Orin Kerr at Volokh reached the same conclusion, and you know how much I hate to agree with Orin.

Though the decision is sound under existing law, it gnaws at me for two reasons.  First, the general sense that the prosecution should do its dirty work on its own, and no person should be compelled to contribute to their own demise.  It’s just unAmerican.

The second reason is that computers (and for that matter, iPads and iPhones and everything shiny object beginning with “i”) are analogized to common physical evidence, as has historically been the fodder of prosecutions.  They aren’t the same.  The contents of a computer may well hold the digitalized version of evidence, but it also holds essentially our entire thought process, a revelation into the workings of our mind as manifested in binary code.  The prosecution may be entitled to the evidence, but they aren’t entitled to our every thought.

It has long struck me that, if we’re constrained to understand technology by analogy, a computer is more like a diary than anything else, a sanctum for the ideas that reveal our lives.  No court would order a person to undergo a brain scan so that the prosecution could access their thoughts, assuming it could be done (and, if the growth of technology continues, may well be possible some day).  Yet they can achieve much of the same access via our computers. 

Much of the discussion to Orin’s post on Fricosu relates to whether the defendant can simply say “I forgot” when ordered to unencrypt the files. There are plenty of variations on this theme, discussion of the sanction imposable for her refusal to comply with the court’s order, and the aforementioned geeky argument that the government already has the evidence, just not the key needed to make it usable.  While these side issues may interest some, they fail to address the core problem, that most of us feel that our computers should be sacred, beyond the reach of the government.

A continuing theme here is that the law has failed miserably to address the fundamental changes that  technology has on society, behavior and privacy, and that reliance on precedent and analogy is leading us down a path where privacy will be little more than an arcane notion and a fond memory.  That Judge Blackburn’s decision is sound based on existing law does little to address the question of whether existing law is sufficiently sound to maintain our rights in light of changes in technology.

Unless the law comes to grips with this, we’re in trouble, and it’s rather difficult to imagine that there are many judges (Sotomayor possibly excepted) who has a sufficient grasp of technology or the will to break free of ancient precedent upon the realization that it just doesn’t apply well anymore.  In the meantime, Fricosu’s lawyer say they will appeal, and we may end up with a Circuit decision that won’t bode well for the contents of computers.  So much for Pretty Good Protection.

9 comments on “A Computer Gets Keyed

  1. Brian Baldridge

    Does not the grant of immunity render the 5th Amendment privilege moot? If so, is there a reasonable motive for the court to choose to rule more broadly?

  2. Burgers Allday

    Over at VC in the comments section, a person named David Schwartz makes some interesting points. To try to paraphrase what he argued:

    The info sought is not a password, but a translation key for a coded language. He compared it to a coded telephone intercepted conversation where, say, “blog entry” means “cocaine.” The government has the transcription of the telephone converstaion, but it is generally understood that the suspect cannot be forced to say that “blog entry” means “cocaine” in the telephone converstaion. In other words, in encrypted file cases, the problem is not access to the data (that is the government can read the ones and zeros of the data), but INTERPRETATION of what the data means. This is because the data in these cases is not password protected, but rather encrypted.

    Imagine this example: lets say they finally got the zodiac killer and found that he had a bunch of coded notes in his file cabinet, similar to the coded notes he used to send to Bay Area newspapers back in the day. Sure the government can force the suspect to turn over all the notes, but can he be compelled to de-code them?

    That would be the proper analogy given what is going on inside the computer.

  3. SHG

    It does, as a supplemental basis for the unencryption, though seeking that the defendant perform the unencryption rather than provide the password arguably avoids any testimonial privilege as well. But this is all somewhat hypertechnical, as the fact that she does it and thus provides the government with the ultimate evidence to be used against her is form over substance.  But then, that’s law.

  4. SHG

    It’s an interesting thought, whether the encryption key needed to “interpret” the code is the same as the thought process behind word usage needed to interpret the language used.  I suspect no judge would get too hung up on the analogy, as the encryption key is a thing, albeit a digital thing, rather than thought processes.  But again, it all goes back to judges trying to apply old precedent to technology via analogy.  It doesn’t work well.

  5. Burgers Allday

    Not sure if it matters, but the VC commenters indicated that the court was seeking an unencrypted version of the drive, rather than seeking the encryption key.

    Also, these encryption keys often exist only in the noumenal realm (which is to say in the mind of the suspect). They don’t need to be a physical copy of the key required to de-crypt.

    I am not trying to say who will win on this in the end. I am a 4a hobbyist, and am happy to leave 5a to the experts. Fascinating issues, to me, though.

  6. SHG

    From a hypertechnical perspective, it makes a world of difference. Without a password, the government can’t get into the filed at all, and translating that into concrete terms, can possess the evidence.  Without the encription key, they can get into the file and “physically” possess the evidence, but can’t interpret what they possess into anything meaningful.

    To geeks, this distinction is quite important.  To judges, I suspect it’s a distinction without a difference. To the law, it’s just another thing where precedent and analogy doesn’t fit well at all.

  7. Ziran Zhang

    To me, the whole problem stems from the murky line between taking evidence from the defendant and forcing the defendant to give evidence. There is nothing particularly objectionable about taking a blood sample from a defendant to determine his blood type (at least by current standards). It is only a small step from taking a blood sample to requiring the defendant to give a urine sample. Of course, once you accept that a defendant can be compelled to give a urine sample, it is only a small step from there to say that he is also required to turn over the keys to a lockbox, and a further small step to require him to give the password to a lockbox, and so on.

    The current testimonial/non-testimonial distinction for Fifth Amendment law has moved a long way from the old rationale of avoiding the cruel trilemma between perjury, contempt, and self-incrimination. Maybe it makes sense from a purely historical point of view, but as you pointed out, the doctrine fares poorly in the face of advancing technology.

    And regarding your point about the brain scan, are you sure that no judge would order a brain scan? To me, there seems to be nothing inherently “testimonial” about a person’s thoughts, because all of that information presumably exists prior to any demand from law enforcement. If no law enforcement officer is asking questions during the brain scan, a person’s thoughts would be much like a diary, the contents of which is clearly discoverable. So in theory, existing law already permits this kind of practice, if the technology ever comes to pass.

  8. Mark Bennett

    The immunity that allows a judge to compel testimony is direct and derivative—if testimony is compelled, then, nothing derived from that testimony can be used against the witness.

    So let’s say that Judge Blackburn had said, “you’ve been immunized; you must decrypt your hard drive.” He would still have been left with the question of what evidence was derived from the defendant’s judicially compelled actions.

Comments are closed.