Wreaking havoc in the blawgosphere,  Gideon at A Public Defender posted about the Boucher case, followed immediately by the Texas Tornado, Mark Bennett at Defending People, on the heels of a  Washington Post story about the case.  I had  posted about it more than a month ago after  Orin Kerr alerted me to the case, when the Vermont  federal court decision had first been issued.

Briefly, this is the case where the feds sought the defendant’s PGP password to get into the contents of his laptop computer.  Bennett kindly shows us what a PGP (Pretty Good Protection) looks like, in what is being touted by local prosecutors as his most lucid and interesting post of the year.  The problem arises from the fact that Boucher had previously used the password to provide border guards access to his computer, which started this whole mess.

If you want the full fact patter or additional details, take a look at any of the links above.  No reasons to restate them here.

This is an important case and decision, and because it’s caused so much confusion around the blawgosphere, it’s worth another visit to try to deconstruct the confusion.   While the right of a defendant not to be forced to incriminate himself always stems from the 5th Amendment to the United States Constitution, not all efforts at forcing incrimination seek inculpatory statements.  This case is one that has the government subpoenaing a specific act from the defendant, not a statement.  The government is demanding the defendant input his password into a computer so that they can access the protected files.

What distinguishes this demand is not that the defendant speak the word out loud, or say it on the witness stand, or tell it to any federal agent anywhere at any time.  The government would be more than happy to put the defendant into a private room, have him input the password with no one watching, and walk out of the room with no one the wiser as to the password.  Or, for that matter, have his attorney input the password, or anyone else for that matter, as long as they are able to access the files afterward.

The 5th Amendment right is implicated not because he is being told to give up the word to a federal agent, but because the act of inputing the password proves that he has the password that allows access to the computer and, by complying with the subpoena, can produce it upon demand.  It is this act that incriminates the defendant, not the password itself or the manner in which he provides it.  This is called the “act of production” privilege.

Judge Jerome Neidermeier (I chuckle every time I see that name; I’m such a child) in quashing the subpoena, analogized the demand to opening a safe.  If the subpoena was for a key, because a key is a physical thing, it would be a proper subject of a subpoena.  But if the safe was opened by a combination rather than a key, it would call for something that existed only in the defendant’s mind, and while not testimony in the traditional sense, would have a testimonial component since it provides evidence of what the defendant “knows”.

In other words, the defendant would be compelled to give “testimony”, thus bringing it within the protection of the 5th Amendment, by divulging that he knows the password rather than the password itself.

The act of producing even unprivileged evidence can have communicative aspects itself and may be “testimonial” and entitled to Fifth Amendment protection. United States v. Doe, 465 U.S. 605, 612 (1984) [hereinafter Doe I ] (“Although the contents of a document may not be privileged, the act of producing the document may be.”). An act is testimonial when the act entails implicit statements of fact, such as admitting that evidence exists, is authentic, or is within a suspect’s control. Doe v. United States, 487 U.S. 201, 209 (1988) [hereinafter Doe II ]. The privilege against self-incrimination protects a suspect from being compelled to disclose any knowledge he has, or to speak his guilt. Id. at 210-11. The suspect may not be put in the “cruel trilemma” of choosing between self-accusation, perjury, or contempt.

Orin contended that this decision has one glaring flaw:  Since Boucher had already input the password when he was initially stopped at the border crossing, the “act of production” privilege was already waived and Judge Neidermeier’s decision, while otherwise strong, fails to recognize that the government already possesses proof positive of this “testimonial” fact.  Now, it just wants to get into the computer, and the defendant has no more “act of production” privilege to protect.

Both Gideon and Bennett have argued that this case should be analogized to a simple Miranda-type statement waiver.  Even if a defendant has waived his Miranda right to remain silent by talking to the agent, he can invoke it again at any time and stop.  The fact that he once answered questions doesn’t mean that he has to answer questions again in the future. 

Bennett, always looking for the sex angle, goes a step further:

That reminded me of one of our law school classmates who, when we were discussing the law of rape in first-year criminal law class, asked the professor, “if you consent to have sex with someone once, does that mean you’ve consented for always?”

Um, no.

Aside from this brief salacious interlude, Gideon puts it in terms of an inquiry:

My question is: Why is it a waiver for him to use the password once? I don’t know enough about 5th Amendment waiver jurisprudence, but when a witness invokes the privilege, it is usually done on a question by question basis. What if Boucher here is telling the truth that these may have been inadvertently downloaded and “went along” to prove to the agents that he was “innocent”? Then when he discovered that he was looking guilty, he didn’t want to “help” them anymore.

Gideon’s point is well taken, and indeed Boucher doesn’t want to “help” them anymore, which is why his attorney moved to quash the subpoena.  The problem for Sebastien Boucher is that he is not being asked to subject himself to questioning, but rather to produce one piece of information that will expose physical evidence against him. 

While individuals have a constitutional right not to incriminate themselves by way of being compelled to give testimony, they do not have the right under the Constitution to withhold physical evidence that incriminates them.  That’s why the government can get a search warrant to search a home for a weapon, or drugs, or any physical evidence that can be found there. 

This case involves the pivot point between self-incrimination and the collection of physical evidence.  Orin Kerr’s point is that by Boucher having already input the password, he has already given the government this crucial piece of evidence.  There is no longer any question that Boucher possesses the password, and the testimonial nature of the “act of production” has already been given up.  The genie is out of the bottle and can’t be put back in.

What will be curious on appeal of Judge Neidermeier’s ruling is whether the Circuit goes with the waiver approach or the invocation of privilege approach.  There are plenty of apt analogies to apply, such as consent to search a car or apartment, subsequently withdrawn. 

The difference here is that each new question, new room searched, new act of sex (if one is inclined to follow Bennett’s lead), is an independent act and hence entitled to independent protection.  The password demanded from Boucher is not a new bit of information, but the same bit that has already been provided.  They just need it again. 

This is a peculiar fact pattern, but one likely to recur given the breadth of federal investigations into computer crime and child pornography.  What is most important about the decision is its guidance in people dealing with federal intrusion into the private world of their computers.  One aspect that has not yet been satisfactorily addressed, in my opinion, is why the contents of a computer are not viewed in the same way as a personal diary, containing content that the owner intends to keep deeply personal that reflects the operations of his mind, and hence should be beyond the scope of government intrusion.  Hopefully, this will be explored soon as well.

Additionally, I still can’t figure out what basis existed for border guards to be entitled to demand that Boucher permit them to access the contents of his hard drive.  While the general rule is that everything is subject to search at the border, the rule was grounded at a time when border guards were looking for dangerous plants, untaxed watches and bombs (in our Age of Terrorism).  This is another situation of “remembering the rubric while forgetting the rationale.”  There is no logical reason for the government to need to search a computer hard drive before allowing entrance into the United States, except general law enforcement.

As technology exceeds the bounds of old laws and court decisions, cases like Boucher will test the limits of the old ways to see whether they can and should be applied to a new, digital world.  Precedent provides stability in the law, but technological advances render the old rubrics truly obsolete and inapplicable.  As the Courts try to fit square pegs into round holes, there’s bound to be a great deal of confusion and disagreement as to our “tried and true” rules and what little privacy we have left. 

My guess is that it’s going to be a bumpy, unpleasant ride, but Judge Neidermeier’s handling of this case, aside from Orin’s nit-picking on one fact, is an exceptionally good start.  Now if only the Circuit will agree.