Final Version, "Compelled Decryption and the Privilege Against Self-Incrimination"
Now out in the Texas Law Review.
I am pleased to say that the Texas Law Review has published the final version of my article on how the Fifth Amendment applies to compelling a person to enter a password: Compelled Decryption and the Privilege Against Self-Incrimination. This article has roots in some blog posts that I wrote here at the Volokh Conspiracy a few years ago. Given the recurring and difficult nature of the question, I decided to expand considerably on the posts by writing the full article. It's still relatively short by law review article standards, though, at a relatively svelte 33 pages.
Here's the abstract:
This Essay considers the Fifth Amendment barrier to orders compelling a suspect to enter in a password to decrypt a locked phone, computer, or file. It argues that a simple rule should apply: an assertion of privilege should be sustained unless the government can independently show that the suspect knows the password. The act of entering a password is testimonial, but the only implied statement is that the suspect knows the password. When the government can prove this fact independently, the assertion is a foregone conclusion and the Fifth Amendment poses no bar to the enforcement of the order. This rule is both doctrinally correct and sensible policy. It properly reflects the distribution of government power in a digital age when nearly everyone is carrying a device that comes with an extraordinarily powerful lock.
I was very pleased that the Massachusetts Supreme Judicial Court relied on my article recently in Commonwealth v. Jones, which adopted the standard I suggest for apppying the foregone conclusion doctrine. Here's the key passage from Jones, which was decided on March 6:
[F]or the foregone conclusion exception to apply, the Commonwealth must establish that it already knows the testimony that is implicit in the act of the required production. Id. at 522-523, 11 N.E.3d 605. In the context of compelled decryption, the only fact conveyed by compelling a defendant to enter the password to an encrypted electronic device is that the defendant knows the password, and can therefore access the device. See id. See also Kerr, Compelled Decryption and the Privilege Against Self-incrimination, Tex. L. Rev. (forthcoming 2019) (manuscript at 18) ("the only assertion implied by entering the password is that the person compelled knows the password"). The Commonwealth must therefore establish that a defendant knows the password to decrypt an electronic device before his or her knowledge of the password can be deemed a foregone conclusion under the Fifth Amendment or art. 12.
Other courts are now grappling with the same issue. For example, the Indiana Supreme Court will hold oral argument in a case raising the same question on April 18th.
The Texas Law Review invited Professor Laurent Sacharoff to respond to my article, and he wrote a 10-page response in the Law Reviews's online edition: What Am I Really Saying When I Open My Smartphone? A Response to Orin S. Kerr. (Laurent and I have been disagreeing about this issue for years, so it was great to have our differing views directly in print.) From his introduction:
The rule should not be, as Kerr argues, whether the government can how the suspect knows the password to the device. Rather, the rule should be whether the government already knows the person possesses the files on the device and can identify them with reasonable particularity. This rule, after all, is precisely what the case law requires in an ordinary documentproduction situation.
Which of these two rules should govern depends, roughly speaking, upon whether this foregone conclusion doctrine applies to the password only or to the files on the device as well. This debate has divided courts recently. In fact, some courts holding that the government must merely establish that the suspect knows the password have often cited Kerr's argument made earlier in blog posts that have ultimately led to his more serious consideration here.
The difficulty arises because the act of production doctrine itself, and therefore the foregone conclusion doctrine, rest upon a faulty premise. Courts and some scholars including Kerr rarely discuss this flaw and how it infects the entire act-of-production enterprise. This short response piece shows how we must address this flaw before applying the act of production doctrine to the new situation of passwords.
Below, I first sketch the act of production doctrine as it applies to ordinary document productions, along with its faulty premise, before applying the analogy to entering passwords to unlock devices. I then try to show why Kerr's simple rule does not follow from the existing case law, in part because he has failed to take account of this faulty premise. Finally, I assess Kerr's larger normative argument.
I reply to the core of Professor Sacharoff's response in my article with the following:
Professor Sacharoff contends that the testimony implicit in entering a password to decrypt a device includes additional statements, specifically that "the device likely belongs to the person" who entered the password "and that the person possesses, perhaps knowingly, the files on the device." In my view, Professor Sacharoff is mixing up the implied testimony inherent in an act with its evidentiary value. The implied testimony of an act is what a person must have been thinking to complete the act. On the other hand, the evidentiary value of an act is what conclusions a fact-finder might be more or less inclined to reach upon learning of the act. An act of decryption no doubt can have broad evidentiary significance in many cases. A fact-finder informed that a person decrypted a device may be more inclined to think that the person owns the device and may have knowledge of its contents. But the privilege against self-incrimination harnesses different principles than evidence law. What matters for the privilege is the state of mind that the act necessarily reveals, not what facts about the world an act suggests are more likely to be true.
I have more thoughts on Professor Sacharoff's response that I'm happy to add if there is interest. But I figured that, for now, I would at least put the links up and let readers know about the article and the exchange.