Virginia state trial court ruling on the Fifth Amendment and smart phones

Last week, there was a lot of press coverage about a Virginia court ruling on how the Fifth Amendment applies to bypassing a smart phone passcode. The ruling hasn't been available before today, but here it is: Commonwealth v. Baust, via Marcia Hofmann. It's a short opinion, just five pages, so it's a quick read. Unfortunately, though, the opinion doesn't address the really important issue raised by compelled decryption: Whether the government can force the defendant to enter in the passcode. It's not the court's fault that the opinion didn't reach that, to be clear. The government never asked for an order compelling the defendant to do that, so the court didn't decide it. Here's a quick rundown of the facts, the law, and my reaction.

The defendant has been charged with assaulting a woman. There is reason to believe that the defendant videotaped the assault and that there is a copy of the video on the defendant's passcode-protected smart phone. The state wants the defendant to be ordered either to disclose his passcode so the police can enter in the passcode to unlock the phone themselves, or else to give up his fingerprint to unlock the phone directly using the phone's fingerprint sensor.

The court reaches a split ruling. First, there is no Fifth Amendment problem with forcing the defendant to provide his fingerprint. Second, the defendant cannot be forced to tell the government his passcode because that would be forcing the defendant to disclose the contents of his own mind. Most importantly, the court rules that the foregone conclusion doctrine doesn't apply because the police don't know the passcode:

Contrary to the Commonwealth's assertion, the password is not a foregone conclusion because it is not known outside of Defendant's mind. Unlike a document or tangible thing, such as an unencrypted copy of the footage itself, if the password was a foregone conclusion, the Commonwealth would not need to compel Defendant to produce it because they would already know it.

In dicta, the Court adds that the defendant could not be compelled to hand over a decrypted version of the video believed to be on his phone. That's true because it is not a foregone conclusion that the video exists or is on the phone. The defendant can't be forced to effectively testify as to that by producing a decrypted version of the video.

This is just a state court trial ruling, not an appellate decision. So it's interesting more for its reasoning than its precedential value. With that said, here are some thoughts on the reasoning of the case.

First, the court's ruling on divulging a fingerprint is easy. There's obviously no Fifth Amendment problem with that. On the government's request for the passcode, the opinion is frustrating because the government's request was poorly framed. In this case, the government doesn't need to know the defendant's passcode. It only needs to bypass the passcode gate, either through the fingerprint or by having the passcode entered in by the defendant. If the government couldn't get into the phone with the fingerprint, then, the sensible request would be for an order to have the defendant enter in the code rather than an order disclosing it to the government. But the government didn't ask for that: Instead it asked for an order that the defendant tell them his passcode.

What's the difference? Having the defendant enter in his passcode would minimize the Fifth Amendment implications of the compelled compliance, as it would not involve disclosing the potentially incriminating evidence of the passcode itself. The passcode itself could be independently incriminating, at least in some cases. Imagine a conspiracy case in which members of the conspiracy use a common passcode. Proof that a suspect used that exact passcode on his own phone would be incriminating evidence, as it could help to show membership in the conspiracy.

Because the passcode itself could be incriminating, the smart way to limit the Fifth Amendment problem is for the government to ask for an order compelling the target to enter in the passcode rather than to divulge it to the police. That way, the government gets the unlocked phone but never gets the passcode. If the defendant has to enter in the passcode rather than tell it to the police, the testimonial aspect of complying would only be admitting knowledge of the passcode, which would very likely be a foregone conclusion in a case where the phone is used heavily by that person. But the government didn't ask for that here, so the court didn't consider how the Fifth Amendment would apply in such circumstances.

Notably, the court does address in dicta whether it would be incriminating for the defendant to hand over the unencrypted video believed to be on the phone. But forcing the defendant to hand over the unencrypted video is quite different from having him enter in the passcode to unlock the phone. Being forced to enter in the passcode to unlock the phone amounts to being forced to say, "I know the passcode for this phone." On the other hand, as the court recognized, being forced to produce the unencrypted video amounts to being forced to say much more, such as "I admit that the video exists; I admit that this is the video; I know where that video is; and I admit that I know what video you're talking about." Being forced to produce the video raises a host of Fifth Amendment issues that merely entering in the passcode does not.