In Decryption Cases, Don't Forget the Fourth Amendment

Requiring a search warrant isn't everything. But it isn't nothing.

In comment thread to last night's post on the new cases about decrypting electronic devices, commenter Rossami offers a reaction I have seen elsewhere:

Prof Kerr may be right that these decisions are correct implementations of current law but they are normatively exactly wrong. If the police can merely demand that users decrypt their contents, then we have no real privacy. I find that answer unacceptable.

I certainly appreciate that perspective. But I'd add a reminder that, in both cases, the government was required by the Fourth Amendment to get -- and in both cases did get -- search warrants based on probable cause before decrypting the devices.

In the California case, the government had obtained a search warrant to search the suspect's house and to seize devices that contained child pornography. The issue before the court was whether the suspect could be compelled to help the government execute the warrant by unlocking the devices seized during the search. The Wisconsin case was similar. The government obtained a search warrant before it used the passcode to unlock the phone. The defendant moved to suppress the fruits of the warrant search.

I realize that readers may disagree on whether the Fourth Amendment warrant requirement amounts to "real privacy." As I've joked before, electronic privacy debates have two stages: the first stage where the complaint is that the government shouldn't be allowed to do that without a warrant, and the second stage where the complaint is that the government shouldn't be able to do that with only a warrant.

But it seems worth noting, in debates on the legal limits of decryption, that the warrant requirement of the Fourth Amendment is an agreed-upon floor to search devices whether they are encrypted or not. The Fourth Amendment is the part of the Constitution that is ordinarily about the privacy of "persons, houses, papers , and effects," and its full protection already applies. The issue under debate is what additional legal limits are imposed on unlocking the devices in addition to the Fourth Amendment warrant requirement for searching them. The warrant requirement isn't everything. But it isn't nothing, either.

Comments

[Kermudjin]

If not the Fourth, then couldn't the Fifth be invoked to avoid self-incrimination by unlocking a device?

[MonitorsMost]

These are both Fifth Amendment cases and the "foregone conclusion" doctrine is a Fifth Amendment doctrine. In re Aptos is exclusively a fifth amendment case. Jackson is a Miranda-prophylactic Fifth Amendment protections case.

A cliff's notes version of the doctrine is this: unlocking something is only "testimony" if it shows possession or control of whatever needs to be unlocked. If the government can prove you own the item, then it isn't testimony.

[Kermudjin]

In the previous post by the author, he makes the statement: "In this case, the fact known to the government that is implicit in the act of providing the password for the devices is "I, John Doe, know the password for these devices." That is the "testimony" not protected by the Fifth. But that is not really what is being askwed of the defendant.

What the police or court are asking is "What is the password to this device?"

How is that question different from "Where did you hide the body?"

One can refuse to answer the latter, but not the former?

[Vandalia]

The problem as I see it is that this is an ultimate question of fact in a criminal prosecution that can only be determined by a jury, and then must be proven beyond a reasonable doubt. As such, a request to "unlock" a device would have minimal relevance to a criminal prosecution.

Perhaps after conviction, a failure to provide a password could be used at sentencing, once it is proved - beyond a reasonable doubt by a jury - that the individual did in fact own the device, or it could possibly be the basis for a second "obstruction of justice" prosecution, but otherwise it is putting the "cart before the horse."

[Patrick Henry, the 2nd]

The forgone conclusion doctrine is a joke. If they know its on there, they what does it matter if they see it?

[Junkie]

My understanding is that 5A has been interpreted to mean that you can't be forced to unlock a safe. With a warrant they can break into it, though.

I'd like to see phones/computers interpreted the same way.

[nonzenze]

You can be forced to produce documents that the government knows that you have in your possession. This is true whether they are in a filing cabinet or a safe or a computer drive.

Some restrictions apply, big area of law, greatly simplified, ....

[TwelveInchPianist]

But if the documents in your safe are written in a cipher, you can't be forced to provide the cipher key.

[BillyG]

In the California case, the government had obtained a search warrant to search the suspect's house and to seize devices that contained child pornography.

If it was encrypted, how did they know it was on those devices? Or did they suspect it was on one (or more) of the devices and were searching all of them for the evidence? You can't exactly search an encrypted device until after the key has been provided.

[James Pollock]

They searched the premises for all the devices that could hold the illegal data, and seized them. This device is encrypted. The probable cause that you had the illegal data is still probable cause that you have the data, and since we didn't find it on the unencrypted devices we seized, we can probably get a warrant to search the device, specifically.
The variation of this that I got in civil procedure was a lockbox in the trunk of a car. The cops get a warrant to search the car, and to seize any container that might contain the contraband they're able to describe with specific particularity they think you possess. They seize the container under this warrant. Then they obtain a warrant to search that container, specifically. That's very likely a valid warrant, unless the original warrant that allowed the seizure was flawed.

[apedad]

During a search, they seize everything that's potentially evidence (that's authorized by the search warrant of course).

The search warrant will describe the persons, place, or things to be searched but in general terms like, "...and any other documents or electronic media...."

Then they'll review everything later on.

[Joe_JP]

Tonight's Landmark Cases episode on CSPAN involves Katz v. U.S.

What ever happened to Charles Katz? The opinion as a whole suggests he could still be liable for the crime involved. A loss or win at SCOTUS repeatedly is not the end of the story.

[Caphon]

I get it from a 4A perspective. Acknowledging 5A is a completely different conversation, I don't really understand how 4A gets them the passphrase before 5A withholds it. If the pass phrase _is_ the content, i.e. the content doesn't exist without it, and only I know the passphrase, aren't I being compelled to create evidence against myself by divulging something only I know? How does this work with physical (non-virtual) ciphers? Can I be legally compelled to unscramble words that mean nothing without my knowledge? 4A gets you the material, but if it's usefulness is nil without my special insight, how's it that different than me not having to tell you where I was last night at 9pm or where I got the $2 that were in my pocket?

[MatthewSlyfield]

I certainly appreciate that perspective. But I'd add a reminder that, in both cases, the government was required by the Fourth Amendment to get -- and in both cases did get -- search warrants based on probable cause before decrypting the devices.

Part of the issue here is that judges are too credulous of police statements in warrant applications and are little more than rubber stamps. This leads to the view that warrants as they are now aren't providing any protection of people's fourth amendment rights.

It would be different if warrants were harder to obtain and/or if it was easier to challenge the legitimacy of a warrant at trial or on appeal.

[MonitorsMost]

A long developing externality caused by interpreting "probable" to be a far less exacting standard than "preponderance."

[MatthewSlyfield]

From what I've read, the interpretation of "probable" used by the judges who issue warrants is "not impossible".

[MonitorsMost]

I'm the rare circumstance where "probable cause" applies in a civil proceeding, the definition is "probable cause exists if the proposition to be proven has been prima favor show. The court determines whether the facts (or absence thereof)-if believed- warrant more proceedings." It is basically a standard taken in the light most favorable to the state. Which is obviously far lower than preponderance and renders probable cause, as interpreted, a gigantic misnomer.

[TwelveInchPianist]

Most drug dog alerts are false positives. But they are still probable cause if the cops can certify that the dog was trained to detect drugs.

[James Pollock]

For that matter, so is the cop's testimony that they smelled "the distinctive aroma of marijuana".

[TwelveInchPianist]

"Part of the issue here is that judges are too credulous of police statements in warrant applications and are little more than rubber stamps. "

Much like the rest of the system. The courts aren't a check on the cops, so much as a device to make people believe that there is a check on the cops. That's why most cases are resolved by coerced pleas.

[James Pollock]

The problem is one of optics.
If the "probable cause" is shaky but turns up evidence of a crime, we don't like excluding the evidence and possibly letting a criminal get away with it. If the "probable cause" is shaky but turns up no evidence, there's no criminal prosecution and very likely that's the end of it. It's pretty rare that you get BOTH a shaky warrant application AND a person with the money and time and righteous anger enough to pursue a civil-rights lawsuit. And then the USSC decides that qualified immunity should apply, because pursuing shaky warrant applications is illegal, but not illegal ENOUGH, sometimes even if a jumpy cop executing a warrant on the wrong house shoots grandma for being deaf and not getting on the floor fast enough.

[RHD]

So, does a lawyer in the child porn case advise the client not to provide the passcode demanded by the warrant, or if that is ethically a step too far, advising the client of the options and the likely consequences of each, and then leaving it up to the client what to do? Possession of child porn has stiff mandatory minimums. If providing the passcode will give the gov't the evidence to obtain a conviction, taking the contempt penalty may be the best of a bad bargain. Of course, to get the warrant in the first place, the gov't had to show probable cause. Not the same as proof beyond a reasonable doubt, but combined with proof of the contempt conviction (if admissible at trial), the client still might not have a defensible case.

[Junkie]

Can't a contempt issue be ongoing, where they hold you until you talk?

[nonzenze]

Only if they believe that you may eventually divulge it.

[Voize of Reazon]

Remember H. Beatty Chadwick who was held 14 years for civil contempt and finally released when a county judge decided that holding him any longer wasn't liable to lead to his compliance.

[Morrowind542]

How are combinations to safes handled in regards to the fifth amendment?

[TwelveInchPianist]

Decryption isn't searching. They're not supposed to issue search warrants for the contents of defendant's minds, but that's what they are doing.

[MatthewSlyfield]

This.

[Peter Gerdes]

You are exactly right on the issues about privacy and the 4th amendment.

However, I'd argue that it undermines the normative aims of the 5th amendment to require they produce a password.

If the government wants to argue before the jury that surely they must have a password and ask the jury to make an adverse implication based on their choice not to decrypt the device I'm fine with that. That gives the defendant the right to present whatever defense (no matter how absurd the judge finds it) to the jury.

Also the government has to deal with the argument that the defendant is actually afraid of some other fact being revealed (maybe even the government knowing he cross-dresses is too shameful).

[DodgerBobH]

If you are correct that a defendant has a right under the Fifth Amendment to withhold the password from the government, it would be improper for the prosecutor to comment on defendant's failure to "testify" about the password.

[Peter Gerdes]

It was a claim about the normative aims of the 5th amendment not a claim about the current procedural interpretation.

I was suggesting that while in general the prosecution can't comment on the defendant's refusal to testify the motivations which support the foregone conclusion doctrine justify (normatively) the weaker exception that the prosecution can present the individual's failure to decrypt evidence to the jury but not the stronger exception that the defendant can be held in contempt for failure to produce the decryption key.

Maybe you don't like that outcome and think it's bad policy but it's not an impossible way for the law to work.

[Patrick Henry, the 2nd]

I like the way you've described this process. Much better than the way its currently done.

[Peter Gerdes]

Also, how does the compelled decryption case differ from demanding the charged individual tell the police where their gun can be found?

Suppose a judge believes that the individual in question surely knows what happened to the gun they own. Why can't they order the defendant to tell the prosecutor where the gun was so they can run ballistics and fingerprints on it? Especially if they agree not to enter into evidence the fact that the individual knew where the firearm was at trial?

[Peter Gerdes]

Delete ME. Accidental duplicate.

[James Pollock]

As I recall, the justification for this is that if there IS a gun, and the police can't find it, a child might find it, and use it to create a danger for themselves and others. So demanding to know where the gun is has a "public safety" component besides "we'll never get a conviction unless we can find the gun."

I could be wrong. Criminal law didn't interest me, and so I only took the required criminal procedure class, and not any of the ones that people who plan to actually practice criminal law take. So I only have the 1L view of the 4th, 5th, and 6th amendments.

[TheAmazingEmu]

The logic is the same. If there's a foregone conclusion about the gun (i.e., everyone already knows the defendant knows where the gun is), then he can be forced to admit that. I think, in that scenario, it's a high hurdle to prove, but the logic would be the same. Essentially, when the statement compelled is not any more marginally incriminating than the evidence before the statement was compelled, the defendant can be compelled to make the statement.

[Peter Gerdes]

Really? Are there people sitting behind bars now because they won't fess up as to where their gun is (as they are sure revealing the location would lead to a murder conviction)?

[Peter Gerdes]

Also why doesn't the same reasoning apply if a judge believes that the defendant knows what happened to the gun he owns. Why can't the judge rule it's a foregone conclusion that he knows where the gun is and demand he testify to what happened to it so the prosecution can test it for ballistics and fingerprints (suppose they stipulate not to introduce his knowledge of where it was at trial)?

If not why is it different? What if the judge merely demands the defendant testify either that the gun is lost, stolen or to it's present location?

[Marko]

So if one has some handwritten notes, say encrypted with a book cypher, would one have to reveal the book that was used to do the encoding?

[Marko]

Suppose one kept an electronic cheat sheet of passwords, the total gibberish type 32 characters long with all type of characters interspersed. In such a case, the foregone conclusion that the suspect 'knows' the password is incorrect. If said person (permanently) deletes (or *ahem* lost) the sheet, it would be impossible for then to ever decrypt the materials. Or a two part key which requires input known to a 3rd person (possibly one not involved in the alleged crime or of whom no suspicion yet exists), would you have to identify the other person and would/could they be compelled to comply?

[Peter Gerdes]

Yes, it is technically possible to come up with a complex scheme that lets one work around this issue.

Probably the most usable are systems which divide a disk into an encrypted partition and another partition that may be random data or may be another encrypted partition plus garbage data. Store your porn on the first encrypted partition, your naked pics on a second encrypted partition and etc.. Unless the government can prove the number of encrypted layers they can't established there even is more data much less that you have the password for it.

However, such systems are wasteful (you have to encrypt a lot of random data wasting disk space) and hard to use so very few people will ever make use of them making such complex systems mostly irrelevant to this question.

[PoxOnBothYourHouses]

Peter Gerdes: "However, such systems are wasteful"

Still, if you actually have kiddie porn -- or frankly anything else that someone (a governmental or private party) wants -- you're a fool not to use it. And the late, lamented True Crypt included an option for such a hidden encrypted volume.

[Peter Gerdes]

The Truecrypt feature is not as safe as one might think: https://hal.inria.fr/hal-01056376/document

Short explanation: windows restore points leak information about shadow volumes.

[PoxOnBothYourHouses]

Peter Gerdes: "However, such systems are wasteful"

Still, if you actually have kiddie porn -- or frankly anything else that someone (a governmental or private party) wants -- you're a fool not to use it. And the late, lamented True Crypt included an option for such a hidden encrypted volume.

[dwb68]

As far as the CA case, maybe the commenter overlooked the significant fact that the "incriminating aspect of complying was a forgone conclusion."

I too was prepared to be outraged, but the facts of the case support the finding that incrimination was a foregone conclusion. The FBI had a lot. They mostly knew what was on the drive.

One might argue that there was other stuff on the computer/phone/hard drive which the FBI did not know about, which would be incriminating, and providing the password might incriminate the defendant in new ways. But the Defense does not seem to have argued that.

[MonitorsMost]

The forgone conclusion doctrine is not made out of whole cloth. It's attempting to deal with the distinction that a criminal defendant cannot withhold incriminating tangible evidence but cannot be forced to divulge testimony. If a client brings you the murder weapon, you can't tell him to keep it or throw it in the lake. You can't lock in your safe at the office either.

[Greg_Cherryson]

All this splitting hair about decryption (with or without a warrant, "testimonial" or "non-testimonial") is a result of courts having become excessively deferential to the executive branch of the government, rather than committed to upholding the well established interpretation of what "private papers" are. Boyd v. United States 116 U.S. 616 (1886) has never been expressly overturned, and I see no reason why we shouldn't start invoking it again:

"The seizure or compulsory production of a man's private papers to be used in evidence against him is equivalent to compelling him to be a witness against himself, and, in a prosecution for a crime, penalty or forfeiture, is equally within the prohibition of the Fifth Amendment.

Both amendments relate to the personal security of the citizen. They nearly run into, and mutually throw light upon, each other. When the thing forbidden in the Fifth Amendment, namely, compelling a man to be a witness against himself, is the object of a search and seizure of his private papers, it is an "unreasonable search and seizure" within the Fourth Amendment."

Speaks for itself!

[TheAmazingEmu]

Everyone would agree that a phone with no password or encryption would only be protected by the Fourth Amendment. If they were capable of decrypting the phone without needing the password, I think people would be hard-pressed to argue the Fifth Amendment applies. The question is whether an encrypted phone that can't be broken into receives greater protection. This whole thing may be a question of technology for now and ultimately a dead end with jurisprudence. In the long run, it's the Fourth Amendment that covers all cases and not just these circumstances. Complaints about the Fourth Amendment being too lax should apply regardless of whether the phone even has a password.

[ldillon]

I'd like to point out that a search warrant is the right to search, not the right to succeed in a search. The government has the right to try and defeat encryption but not a right to succeed in doing so. A backdoor would effectively grant the right to succeed.

[Longtobefree]

Right. Somehow using brute force to put your finger on the sensor is fine and legal. So never use fingerprint locks; use a real password, and have a second one to give cops that causes the device to delete and scrub the entire world.
And of course never use a cloud backup.

[James Pollock]

Alas for you, it is fairly trivial to make a backup of an encrypted device, and attempt to decrypt the backup. So a "delete if wrong password entered" defense only destroys the backup, and probably not even that. When your careful plan fails to delete the original device, they tag you for obstruction, attempting to tamper with evidence, or spoliation (if it's a civil case).

Much smarter to not possess the verboten in the first place. There's a CHANCE you're smarter than all the brains the authoritities can throw at your (potentially) naughty data, but that's really not the way to bet over the long haul.

[Rossami]

That misses the point entirely, James. Encryption is not merely to hide illegal acts from the authorities. Encryption also protects the many entirely legal things that we just want to keep private. The legal uses of encryption far outnumber the illegal uses. And with very limited exceptions, the government has no business snooping in your private stuff just because there might be something illegal there.

[nonzenze]

They have no business until they get a warrant, upon probable cause to believe there is evidence or fruits of a crime, and signed by a neutral magistrate.

After that, well it's debatable, right?