Academic journal article Texas Law Review

Compelled Decryption and the Privilege against Self-Incrimination

Academic journal article Texas Law Review

Compelled Decryption and the Privilege against Self-Incrimination

Article excerpt

Introduction

Encryption is everywhere. Ninety-four percent of Americans aged eighteen to twenty-nine carry smartphones, many of which encrypt their data by default when not in use.1 Laptops, tablet computers, and thumb drives can be and often are encrypted.2 Although users can decrypt electronic devices in different ways, one popular method is to enter a password.3 To unlock the device and decrypt its contents, a person must type in a unique combination of characters that acts as the key and unlocks the device.

The widespread use of encryption has triggered an increasingly common Fifth Amendment question in criminal investigations: When can the government require a suspect to decrypt an encrypted device by entering the password?4 The issue typically arises when investigators have a warrant to search a cell phone or computer, but they cannot execute the search because the data is encrypted. Investigators obtain a court order directing a suspect to produce a decrypted version of the data by entering the password without disclosing it to the government. The suspect then objects, claiming a Fifth Amendment privilege against complying with the order.5

The difficult legal question is how a court should rule on the assertion of privilege: When is the order enforceable, and when would enforcing the order violate the right against self-incrimination? Put another way, how much power does the government have to compel a person to decrypt a device by entering a password? About a dozen court decisions have grappled with this question in the last decade.6 Courts have disagreed on the correct answer,7 as have scholars,8 with both offering a range of standards for how the Fifth Amendment privilege should apply.9

This Essay answers that question in two ways. First, it offers a simple doctrinal rule that explains how the Fifth Amendment should apply. Expanding on my online writings about this subject,1" this Essay argues that the Fifth Amendment poses no barrier to compelled decryption as long as the government has independent knowledge that the suspect knows the password and the government presents the password prompt to decrypt the device to the suspect. When a suspect is presented with a password prompt and is ordered to enter in the password, the only implied testimony in complying is that the suspect knows the password. That testimony will be a foregone conclusion that defeats the assertion of the privilege when the government can independently show that the person already knows the password.

My approach explains why the only federal appellate decision that squarely answers this issue, the Eleventh Circuit's 2012 decision in In Re Grand Jury Subpoena Duces Tecum,11 either is wrongly decided or else is very confusingly reasoned. The Eleventh Circuit appears to have held that the government can compel decryption only when it can first describe with reasonable particularity what decrypted files will be found on the device.12 This holding is incorrect. It erroneously equates the act of decrypting a device with the act of collecting and handing over the files it contains. The two acts may seem similar at first, but they have very different Fifth Amendment implications.

The Essay next goes beyond doctrine and offers a broader perspective. In recent criminal procedure cases such as Carpenter v. United States,b the Supreme Court has signaled a willingness to rethink old constitutional doctrines in light of technological change. Instead of applying old doctrines mechanically, the Court has suggested that courts should reconsider old rules in light of how technology has shifted the balance of government power-a process I have elsewhere called "equilibrium-adjustment/'14 To the extent equilibrium-adjustment extends to the Fifth Amendment, beyond the Fourth Amendment sphere where it originated, cases like Carpenter hint that the Fifth Amendment framework for compelled decryption should look beyond precedent to the normative question: What Fifth Amendment rule offers an appropriate test in light of the role of encryption in modem life? …

Search by... Author
Show... All Results Primary Sources Peer-reviewed

Oops!

An unknown error has occurred. Please click the button below to reload the page. If the problem persists, please try again in a little while.