Decryption and the Fifth Amendment: Can the Government Force Disclosure of Your Secrets?

The stage is being set for the Supreme Court to evaluate technology’s effect on the scope of the Fifth Amendment right not to incriminate oneself.

The government is seizing computers routinely now in investigations. But, the files on those computers are increasingly obscured from the plain view of government investigators (or anyone else who recovers the computer) because they are encrypted. That is, the words in those files are scrambled into unreadable letters and numbers by a mathematical algorithm so that only a person with a password or phrase is able to make the unreadable information into readable format again.

So, courts are being asked to order persons to reveal the password or phrase, which is known as the encryption key. This raises serious fifth amendment issues, because that encryption key may only be stored in the mind of the person who encrypted the files. If the person provides the encryption key, it potentially communicates to the government who encrypted the file(s) and that the person had control of the file(s), and it implies that the person knew what was in the file(s). And if the contents of the file are either evidence or fruits of a crime, such as communications that reflect knowledge of wrongdoing or trade secrets or other confidential information that the computer user would not be expected and allowed to possess, the forced disclosure amounts to compelling the computer user to incriminate himself. At least, that’s what the Eleventh Circuit has now held.

Two federal district courts have held that the government may order disclosure of encrypted files. In re Grand Jury Subpoena to Boucher, 2009 WL 424718 (D.Vt. 2009); United States v. Fricosu, No.1:10-cr-00509 REB (D. Colo. Jan. 23, 2012) (both requiring disclosure of the unencrypted hard drive). But, on February 27th, the Eleventh Circuit held that the forced disclosure is unconstitutional. In United States v. John Doe, the court ruled that the government cannot force the disclosure, even if it offers act of production immunity to the defendant.

The Supreme Court has already decided that a person may be forced to produce a key to a lock box, because doing so is not “testimonial.” It is merely a physical act that does not explicitly or implicitly relate a factual assertion or disclose information. But, the Court has also written that while forcing production of a key was constitutional, forcing disclosure of a combination to a combination lock would not be constitutional because it would reveal information that was in the defendant’s mind. So, too, is forcing a person to disclose a decryption password or phrase stored only in his mind.

The Eleventh Circuit’s decision makes good sense because it acknowledges the fact that when the government does not know what files are on a computer, coercing the defendant into revealing the existence of those files, and implicitly his control and knowledge of them is clearly testimonial. Whether the Second and Tenth Circuits will reach a similar conclusion if the Fricosu and Boucher cases eventually present the issue on appeal is a question that warrants monitoring. The reality is that encryption is becoming standard on many computers (even built into the operating system), and is required by law in certain settings. More to come as this issue surfaces more frequently and percolates through the courts.