The Volokh Conspiracy

Mostly law professors | Sometimes contrarian | Often libertarian | Always independent

Crime

Thoughts on the Third Circuit's decryption and self-incrimination oral argument

|The Volokh Conspiracy |


Constitution

I have blogged before about the Third Circuit's pending case on the Fifth Amendment limits of ordering a suspect to decrypt his hard drive by entering in the password. The court heard argument in the case Wednesday, and the oral argument recording has been posted on the court's website.

Here are six thoughts on the argument, in no particular order:

1. Judge Jordan repeatedly pushed counsel to articulate if there was anything testimonial about entering in a password beyond the implicit statement, "I know the password." The lawyers couldn't come up with anything, although their answers weren't as direct on this as they could have been. To my mind, Jordan correctly identified the key to the case and the way to resolve it: Because the only testimonial aspect of entering in a password is knowledge of the password, there is no Fifth Amendment bar to an order to enter in the password if the defendant's knowledge of the password is a foregone conclusion. Whether the defendant knew what files are on the hard drive is irrelevant, as the act of entering in the password does not imply any statements about that. Near the end of the argument, Judge Nygaard chimed in with short comment that suggested to me he probably agreed with that approach (although it was a short comment, so it's not clear).

2. Judge Vanaskie's questioning focused on whether the government would use evidence of crime outside the scope of the warrant if it gets access to the plaintext. He wanted to know if the government would waive reliance on the plain view exception, and he expressed concern that the government could use the power to search the hard drive to obtain other evidence. On one hand, I agree with Judge Vanaskie that this is a major problem. I have written articles here and here arguing that the plain view exception shouldn't be allowed in computer search cases (or, as I later updated the idea, that there should be use restrictions on computer searches). Judge Vanaskie, who himself lectures on computer crime investigations, is right to be concerned about the issue. With that said, I agree with DOJ's lawyer, Nathan Judish, that the scope of plain view is a separate Fourth Amendment question that would have to be raised later, after a search occurs, rather than now when the government is seeking to decrypt the hard drive.

3. Counsel for the defendant argued that entering in a password is blocked by the Fifth Amendment because it is like being forced to translate all of the contents of the hard drive. Even assuming the Fifth Amendment would bar the compelled translation of the contents of the hard drive, I don't think the analogy works. If you are compelled to translate a document, your implicit testimony includes a few things: you generally know the language that is being translated; you can read that language; you can read, understand, and translate the specific words used; and you would translate them in the specific way you are suggesting is best. None of that is implicit testimony with entering in a password. Entering in a password that unlocks the password only says, "I know the password." It doesn't say anything about understanding how decryption works. The fact that the process by which the plaintext appears involves essentially "making" the plaintext from ciphertext is irrelevant to the Fifth Amendment. The Fifth Amendment issue is only about what you had to say, not about what other people or machines did in response to what you had to say.

4. There was some discussion of whether, if the government wins and the defendant enters in the password, prosecutors could tell the jury about how the defendant decrypted the hard drive. DOJ's Judish acknowledged that there may be Fifth Amendment problems with that, and he explained that the government would not plan to tell the jury about the defendant's act. I think the DC Circuit's dicta in In re Sealed Case is relevant here:

If, moreover, the Government attempts to introduce at trial the Witness' production of the companies' records to prove the existence or authenticity of the documents or his possession or control of them, instead of introducing independent evidence to the same effect, then the Witness may presumably once again raise his Fifth Amendment privilege and contest whatever evidence the Government proffers to show that what the Witness implicitly acknowledged by producing the documents was either a "foregone conclusion" or not incriminatory.

Under that guidance, the defendant can successfully raise a Fifth Amendment challenge later at trial if the government tries to introduce evidence of the act of decryption to prove the defendant's possession of the files on the hard drive. But that possibility won't come up if the government proves its case to the jury without ever telling them about the defendant's act of decryption.

5. There was an interesting discussion about how to characterize the foregone conclusion doctrine. If the doctrine applies, does that mean that the ordinarily testimonial act of production is not testimonial in context; or that the testimonial act is not incriminating in context because the government knows the fact; or is the act still testimonial and incriminating but just an exception applies? Good question. It doesn't really matter in practice, of course, as it's a form question rather than one of substance. But I think the court's foregone conclusion doctrine cases are pretty murky on this point. Off the top of my head, I think it would probably make the most sense to say that the second view is right. The foregone conclusion doctrine applies when the government already knows the implicitly testimonial statement and doesn't add to its knowledge when the act occurs with its implicit testimony, so that testimony isn't incriminating as it doesn't tell anyone anything new or give any new evidence. But that's just my take, and Fisher refers to testimony more than incrimination on this. Perhaps the ambiguity isn't surprising, as the Court has sometimes struggled to draw clear lines between the testimony inquiry and the incrimination inquiry.

6. DOJ's Judish pointed out that the court doesn't have to embrace the incrimination argument in Point 1 above to rule for the government. The court could also rule for the government under the 11th Circuit's test, which gives a higher hurdle for the government but that is probably met here on the facts. As I explained in my earlier post, I think it's actually pretty important for the Third Circuit not to follow the Eleventh Circuit's test. That's true, I think, because getting the decryption standard right is important for the "going dark" debate.

The dynamics here are complicated, but here's a very quick sketch of an argument I'll be going into much more detail on in a forthcoming book. The pressure to have a mandate for exceptional government access to encrypted data will depend in large part on how often encryption is a barrier to government access. If strong encryption is a big barrier that substantially impacts a lot of cases, pressure for change will mount; if it turns out the government can still solve many cases anyway, the pressure will dissipate. I think the major question is likely to be over government access to data at rest, such as searches of cell phones, hard drives, and laptops. How often encryption is a barrier to government access in the context of data at rest is partly a question of how much of a barrier the Fifth Amendment raises. If the Fifth Amendment bars access outside the rare case when the government knows what specific files are on the hard drive, then there will be more pressure for other solutions. On the other hand, if the Fifth Amendment only requires proof that the defendant knows the password, which will generally be pretty straightforward for the government to satisfy, then the government will gain access significantly more often. Clarity about the correct Fifth Amendment standard is therefore pretty important. It tells us how much encryption is likely to impact law enforcement access, and will help us assess the options over time in the going dark debate.