March 7, 2012 | By Hanni Fakhoury

A Tale of Two Encryption Cases

In the last two months, two different federal courts have ruled on whether the Fifth Amendment's right against self-incrimination applies to the act of decrypting the contents of a computer. We wrote amicus briefs (PDF) in each case arguing the Fifth Amendment did prevent forced decryption when that act would incriminate a witness. And while our arguments were similar in both courts, the results were different.1 A district court judge in Colorado ruled (PDF) that Ramona Fricosu could be forced to decrypt information on a computer seized by law enforcement in connection with a mortgage fraud case.2 But the 11th Circuit Court of Appeals in Atlanta ruled (PDF) that the 5th Amendment prevented the government from forcing a suspect in a child pornography investigation to decrypt the contents of several computers and drives seized by law enforcement.3 So how can these two cases be reconciled? To understand, it's important to take a close look at not only the facts of each case, but also the law regarding the Fifth Amendment.

Decryption May Be "Testimonial" Under the Fifth Amendment

The Fifth Amendment protects a person from being "compelled in any criminal case to be a witness against himself." To be protected by the Fifth Amendment, a person needs to show three things: (1) compulsion; (2) incrimination; and (3) a testimonial communication or act.4 Both cases had compulsion: the government sought judicial authorization to force Fricosu (through an order under the All Writs Act) and Doe (first through a grand jury subpoena, and later contempt of court when he refused to comply with the subpoena), to decrypt the contents of computers seized by the government pursuant to a search warrant. And both cases had incrimination: Fricosu and Doe were suspected of criminal activity and the government had open and active investigations (and in Fricosu's case, she was already under indictment) against them.

That brings us to whether the act of decryption is "testimonial." When thinking of "testimony," it's common to envision a person taking the witness stand and answering questions before a jury. But "testimony" is more broadly understood to refer to communication, and specifically doing something that explicitly or implicitly conveys a statement of fact.5 The issue in the decryption cases is not whether the decrypted contents of the computer (the files) are "testimonial" under the Fifth Amendment. The simple answer to that question is that they aren't, because despite whatever incriminating character the files may have, the creation of the documents were not "compelled" by the government.6 Instead, the issue in these cases is whether the act of decrypting the computer or producing a decrypted version of information on the computer is "testimonial" under the Fifth Amendment. And the answer to that question, as with many legal questions, is "it depends."

Different Facts = Different Results

An important piece of legal background first. There are two ways in which the act of producing something is not "testimonial." The first is when the government is demanding that a person perform a physical act that does not make use of the contents of their mind.7 The classic example is the government forcing someone to turn over a key to a lock. In contrast, it would be "testimonial" for the government to force someone to turn over a combination to a lock because then the person would be revealing something in their mind, and in turn, conveying a statement of fact the government didn't know otherwise.

Turning to decryption, the 11th Circuit believed that the act of decryption communicated a statement of fact, and was therefore "testimonial" under the Fifth Amendment. The 11th Circuit explained: 

the decryption and production of the hard drives would require the use of the contents of Doe's mind and could not be fairly characterized as a physical act that would be nontestimonial in nature. We conclude that the decryption and production would be tantamount to testimony by Doe of his knowledge of the existence and location of potentially incriminating files; of his possession, control, and access to the encrypted portions of the drives; and of his capability to decrypt the files.8

In Fricosu's case, the judge did not explicitly find that the act of decryption was testimonial, but it did preclude the government "from using Ms. Fricosu's act of production of the unencrypted contents of the computer's hard drive against her in any prosecution."9 At a minimum, this is an implicit acknowledgment that Fricosu's act of decrypting was "testimonial." 

But there is a second way in which producing something is not testimonial, and it is here where the two courts reached different results. An act of production is not "testimonial" if the government can show with "reasonable particularity" that when it tried to obtain the requested material, it already knew what the material was and where it was on the computer. In other words, since turning over the data would not reveal anything to the government that it didn't already know, no Fifth Amendment right comes into play because the testimony at issue is simply a "foregone conclusion."10

The 11th Circuit found that the government had failed to make this showing. And that was because during a hearing to determine whether Doe should be found in contempt of court, the government's forensic examiner admitted that because the seized computers had TrueCrypt on them, he had no idea whether there was actually any data on the encrypted drives. Noting that the government failed to show which of the millions of files on a computer it believed were helpful to its investigation, the 11th Circuit rejected the government's suggestion

that simply because the devices were encrypted necessarily means that Doe was trying to hide something. Just as a vault is capable of storing mountains of incriminating documents, that alone does not mean that it contains incriminating documents, or anything at all.11

The judge reached the opposite conclusion in Fricosu, primarily because the witness had admitted on a recorded phone call with her imprisoned ex-husband (and co-defendant) that there was a laptop that investigators would need her help in opening. Plus, the laptop at issue was found in her bedroom and its identity contained her name. The court relied heavily on an earlier case, In re Boucher (PDF), that found the "foregone conclusion" defeated the Fifth Amendment privilege. There, before the defendant was arrested, law enforcement not only saw child pornography on his computer, but the defendant also showed agents a folder on the computer that contained child pornography. Once the defendant was arrested, decryption was a "foregone conclusion" since the agents had already seen the incriminating files on a computer that the defendant had conceded owning and possessing. The judge in Fricosu's case thought her case was similar to Boucher, finding that since it was a "foregone conclusion" that the computer belonged to Fricosu, the Fifth Amendment wasn't implicated by forcing her to decrypt it.

Obviously, we disagreed with the district court's conclusion (and we're not the only ones). The district court's conclusion that the foregone conclusion was satisfied because the government "knows of the existence and location of the computer's files" even though "it does not know the specific content of any specific documents" is tenuous at best.12 And it doesn't square with the 11th Circuit's belief that while the law "does not demand that the Government identify exactly the documents it seeks...it does require some specificity in its requests—categorical requests for documents the Government anticipates are likely to exist simply will not suffice."13

In any event, it was the difference in facts that led to the different results.

The More Important Victory

The 11th Circuit also provided a final, and important, note in its opinion when it ruled that the Fifth Amendment's protection applied not only to the act of decrypting the computers themselves (which the government had essentially conceded in both cases by offering partial immunity to Fricosu and Doe), but also to the government's use of the decrypted contents at a later point in time.

Generally, when "testimony" is protected under the Fifth Amendment, the government can nonetheless compel it as long as it provides the witness with immunity coextensive with the claimed privilege. The government offered Doe "use immunity" that amounted to a promise by the government not to use the fact Doe decrypted the computer against him. But the government did not offer him "derivative use" immunity, which would have prohibited the government from using whatever it found on the decrypted computer (likely files) against him later. The 11th Circuit ruled that the government's offer of immunity was insufficient and that it had to offer both use and derivative use immunity to match the scope of Doe's Fifth Amendment privilege.

But wait. Didn't we just say above that the decrypted contents of a computer weren't "testimonial" under the Fifth Amendment? And if the content wasn't testimonial, why would the scope of immunity need to cover that? The answer is that whether or not content is "testimonial" is irrelevant because the Supreme Court has ruled that the government cannot rely on a "manna from heaven" theory to explain how it magically obtained evidence.14 Even if the government never explained to a jury where it obtained the specific computer files, the fact remains that a protected testimonial act (the production of the unencrypted contents of the computer or the act of decrypting the computer) was necessary to produce the evidence. The only way to truly receive the benefits of the Fifth Amendment is to prevent the government from using any aspect of the testimony -- or anything the government learns as a result -- against the witness.

What This Means for You

If you find yourself in a situation where the government is forcing you to decrypt a computer or provide an encryption key, be sure to let us know. And remember that silence is golden. Boucher talked to law enforcement. Fricosu talked to her ex-husband and co-defendant in jail. It was this talking that defeated their Fifth Amendment privilege through the foregone conclusion doctrine. The less you say, the better. 

And for those of you who have yet to encrypt your electronic devices, EFF has issued a call to action urging users to encrypt their data in 2012. Please join us! Many people feel a strong sense of privacy when it comes to the contents of their computers. As these two cases highlight, encrypting your devices can be useful in ensuring no one accesses your personal data without your cooperation, whether they be fraudsters, employers, or the government.


Deeplinks Topics

Stay in Touch

NSA Spying

EFF is leading the fight against the NSA's illegal mass surveillance program. Learn more about what the program is, how it works, and what you can do.

Follow EFF

How China is strong-arming coders to abandon their open source projects: https://eff.org/r.wso1

Aug 28 @ 4:20pm

Introducing a powerful new tool to help stop the California virtual currency license: https://eff.org/r.5qg6

Aug 28 @ 2:14pm

HTTPS encryption may have gotten the better of Russian censors trying to block a Wikipedia article: https://eff.org/r.vk6f

Aug 28 @ 1:55pm
JavaScript license information