Fifth Amendment protects passcode on smartphones, court holds

Reader's Note: I have written a follow-up post disagreeing with part of the analysis in this post; you can read it here.

In a new case decided Wednesday, SEC v. Huang, a federal trial court in Pennsylvania held that the government can't force a person to give up his passcode to his smartphone. I think the decision misses the mark, and I hope it is appealed. Here's a rundown.

First, the facts. The Securities and Exchange Commission (SEC) is investigating Bonan and Nan Huang for insider trading. The two worked at the credit card company Capital One as data analysts. According to the complaint, the two allegedly used their jobs as data analysts to figure out sales trends at major U.S. companies and to trade stocks in those companies ahead of announced company earnings. According to the SEC, they turned a $150,000 investment into $2.8 million.

Capital One let its employees use company-owned smartphones for work. Every employee picked his own passcode, and for security reasons did not share the passcode with Capital One. When Capital One fired the defendants, the defendants returned their phones. Later, as part of the investigation, Capital One turned over the phones to the SEC. The SEC now wants to access the phones because it believes evidence of insider trading is stored inside them.

But here's the problem: The SEC can't get in. Only the defendants know the passcodes. And the defendants have refused to disclose them.

That brings us to the new decision. The SEC has asked the court for an order to compel Bonan and Nan Huang to each give up their passcodes to the Capital One phones they used so the SEC can bypass the passcode gate and search the phones. The defendants have opposed the request for an order on Fifth Amendment grounds. In their view, an order forcing them to give up the passcodes would force them to testify against themselves in violation of the privilege against self-incrimination.

In the new ruling, the trial court agreed with the defendants and denied the SEC's request. The opinion was written by Judge Mark Kearney, a relatively new district court judge.

The most important part of the opinion is Judge Kearney's approach to the "foregone conclusion" doctrine. The doctrine, introduced in Fisher v. United States, says that the Fifth Amendment doesn't block complying with a court order when the testimonial part of complying with a court order is a foregone conclusion. In other words, if the government already knows the testimonial part of complying with the order, and they're not seeking to prove it from the order, then you can't use the Fifth Amendment to avoid compliance with the order.

The big issue in Huang is how to apply that doctrine. The government argued that the foregone conclusion doctrine applies because the government already knew the testimonial aspect of complying with the order for the passcode. The government already knew that the users possessed the phones, so the testimonial part of complying with any order—admitting knowledge of the passcode, and therefore admitting to likely former possession of the phones—was a foregone conclusion. Judge Kearney ruled that this argument "missed the mark" because the foregone conclusion doctrine is about what specific documents the government is seeking. Because the existence of specific files sought on the phone was a not a foregone conclusion, the foregone conclusion doctrine couldn't apply:

The court of appeals' reasoning in In re Grand Jury again persuades our analysis. There, the Court of Appeals for the Eleventh Circuit refused to apply the "foregone conclusion" doctrine because the Government could not meet its burden of showing with "reasonable particularity" what "if anything, was hidden behind the encrypted wall." 670 F.3d at 1349. While the Government need not "identify exactly" the underlying documents it seeks, "categorical requests for documents the Government anticipates are likely to exist simply will not suffice." Id. at 1348. There, the Government could not show the encrypted drives actually contained any files, nor could it show which files would if any prove to be useful. Id. at 1347.

Here, the SEC proffers no evidence rising to a "reasonable particularity" any of the documents it alleges reside in the passcode protected phones. Instead, it argues only possession of the smartphones and Defendants were the sole users and possessors of their respective work-issued smartphones. SEC does not show the "existence" of any requested documents actually existing on the smartphones. Merely possessing the smartphones is insufficient if the SEC cannot show what is actually on the device.

The court's conclusion is wrong, I think. The court was unfortunately misled by incorrect language from the 11th Circuit's decision. I believe both are wrong, and here's why. [ETA: The 11th Circuit decision was correct as to the result; just the quoted language was wrong.]

As introduced by the Supreme Court in Fisher, the question asked by the foregone conclusion doctrine is whether the testimonial aspect of production is a foregone conclusion. The testimonial aspect of production is the implicit statement, upon responding to an order to hand over a specific item, that the item being handed over (a) exists, (b) is the thing being requested, and (c) is in the suspect's possession.

For example, imagine the government orders you to turn over any and all crystal meth in your possession. In response to the order, you hand over a plastic bag filled with some substance. Your response effectively testified that you think the item in the bag is crystal meth and that it is in your possession. That's admitting to a crime—possession of crystal meth—so you have a Fifth Amendment right not to have to produce the item in response to the order.

I think the Huang court is wrong because the government did not seek an order forcing the defendants to hand over records of insider trading. If that had been the order, the ruling would be correct. The defendants would have a clear Fifth Amendment privilege, and the "foregone conclusion" doctrine would not apply. If that were the case, the government would be relying on the defendants to tell the government what investigators are trying to figure out: whether any records of insider trading are on the phone, and where on the phone they can be found. That's not a foregone conclusion, so the government can't make the defendants do that work for them.

This case is different, however, because the government is seeking an order to obtain the passcodes. The details of what records are on the phone should be irrelevant to whether the foregone conclusion doctrine applies because access to the phone is independent of what records are stored inside it. Handing over the passcode has the same testimonial aspect regardless of what is on the phone. Because the government already knows which defendant used which phone, the fact that a particular defendant knew how to access a particular phone by knowing the passcode is a foregone conclusion.

Finally, let me quote from a post of mine last year on why possible Fifth Amendment issues raised by the content of the passcode could be addressed by having the defendants just enter in their passcodes rather than handing them over to the government:

Having the defendant enter in his passcode would minimize the Fifth Amendment implications of the compelled compliance, as it would not involve disclosing the potentially incriminating evidence of the passcode itself. The passcode itself could be independently incriminating, at least in some cases. Imagine a conspiracy case in which members of the conspiracy use a common passcode. Proof that a suspect used that exact passcode on his own phone would be incriminating evidence, as it could help to show membership in the conspiracy.

Because the passcode itself could be incriminating, the smart way to limit the Fifth Amendment problem is for the government to ask for an order compelling the target to enter in the passcode rather than to divulge it to the police. That way, the government gets the unlocked phone but never gets the passcode. If the defendant has to enter in the passcode rather than tell it to the police, the testimonial aspect of complying would only be admitting knowledge of the passcode, which would very likely be a foregone conclusion in a case where the phone is used heavily by that person.

That procedure may be difficult in this case, however, as the opinion says that the defendants are "presently residing in the Far East."

Full disclosure: My wife works for the SEC, although she has no involvement in this case.