The Volokh Conspiracy
Mostly law professors | Sometimes contrarian | Often libertarian | Always independent
Is Compelled Decryption Heading to the Supreme Court?
Unlocking phones may reach SCOTUS, but there's a potential catch.
One of the major issues in the law of digital evidence investigations is how the Fifth Amendment privilege against self-incrimination applies to unlocking phones. As I wrote here at the Volokh Conspiracy back in 2020, the lower court caselaw is a total mess. No one can say what the law is. And I've been waiting for a case to come down that might be a good candidate for U.S. Supreme Court review to clear up the mess.
Here's a possibility: The Utah Supreme Court's ruling today in State v. Valdez. In this post, I want to talk about Valdez and consider if it would be a good prospect for Supreme Court review.
The Facts
Valdez was charged with kidnapping and assault of his ex-girlfriend. The government had a warrant to search his phone, as a lot of the evidence was thought to be of their communications. And his ex-girlfriend's phone, which would also have the communications, had gone missing. But Valdez's phone was locked, with a nine-dot pattern passcode needed to access it, and the police could not break in. The government asked Valdez for his password, telling him that if he declined they might damage the phone to try another way to bypass the encryption. But he refused to provide the passcode, and he told them to just destroy the phone. The government was never able to get into the phone.
At trial, the government wanted to put on testimony that Valdez refused to unlock the phone as evidence of his guilt. The defense objected, arguing that Valdez had asserted his Fifth Amendment privilege. The trial court overruled the objection, allowing the testimony. During the closing argument, the prosecution emphasized that the text messages between the defendant and his ex-girlfriend stored on his phone would answer whether this was a real kidnapping (as the prosecution claimed) or consensual (as the defense asserted). And in that context, the prosecution argued, the refusal to unlock the phone was incriminating. The jury convicted the defendant.
The Valdez Ruling
The parties in the case both assume, as the court of appeals ruled below, that the government cannot comment on a defendant's assertion of his Fifth Amendment privilege under Griffin v. California, 380 U.S. 609 (1965). Griffin ruled that the government can't comment on the defendant's refusal to testify at trial, and it's not obvious it extends to a pre-trial assertion. But the Utah Supreme Court accepts that framing, assuming for the purposes of argument that the key question is whether Valdez had a Fifth Amendment privilege not to provide his passcode. And the court concludes that the answer is yes. As it summarizes:
We first address the State's argument that providing a passcode is not a testimonial communication. We disagree. Providing a passcode is testimonial because it is a communication that discloses information from the person's mind. We then move to the State's other arguments. We conclude that the foregone conclusion exception does not apply here. That exception arises in cases involving compelled acts of producing evidence to determine whether the act has any testimonial value because the act implicitly conveys information. Such an analysis is not necessary in a case involving a verbal statement that explicitly provides information.
The Utah Supreme Court thus agrees with the court of appeals that the conviction cannot stand, as it was based on a Fifth Amendment violation and it was not harmless error.
Why This Might Be Cert-Worthy
Will the U.S. Supreme Court review Valdez, assuming the state seeks review? Maybe.
Here's the case in favor.
First, there's a state Supreme Court split on how the Fifth Amendment privilege applies to orders to compel a password in order to execute a warrant for a phone. Unless I'm missing something, Valdez joins the Pennsylvania Supreme Court's ruling in Commonwealth v. Davis in upholding the privilege in that setting. On the other hand, the New Jersey Supreme Court disagreed with that view in State v. Andrews, ruling that the foregone conclusion doctrine applies and the defendant can be forced to disclose the password if the government can show he knows it. So at the very least, there is a 2-1 split on compelled disclosure of passwords.
Second, Valdez would come to the Supreme Court in a better procedural posture than other cases. Most compelled unlocking cases involve interlocutory appeals. The government gets an order requiring the defendant to say the password or unlock the phone, and the government seeks enforcement of the order. Whether the order can be enforced then goes up on appeal while the rest of the case is still pending. That can create procedural barriers, most significantly if the state wins in the state supreme court; the U.S. Supreme Court probably lacks jurisdiction to review the ruling under the final judgement rule. Here, by contrast, there's a final judgment.
Some Potential Complications
But there are some complications.
First, Valdez is a compelled disclosure case, not a compelled unlocking case. There are state supreme court splits on both compelled disclosure and compelled unlocking. But the issues are potentially very different, as the Valdez court explored in depth. In a case that involves an interlocutory appeal, the two issues are often either presented together or at least are easy to address together. The government has an order, and it just wants "in" to the phone so it can execute the warrant. Typically, prosecutors are happy if the defendant either unlocks the phone or gives the government the password to unlock it. Either is fine.
It's different with Valdez. The record in Valdez is that he was asked to provide the passcode, not to enter it. And the issue is whether the government could have testimony on that. If the Supreme Court were to take Valdez, it might have to only answer the compelled disclosure issue, and then save the compelled unlocking issue for another day.
That's certainly possible. But it might be odd to only address half of the puzzle. Compelled unlocking and compelled disclosure raise different legal issues, but they go together in practice. Would the Supreme Court want to take on one half of the puzzle without being able to take on the other half? I don't know.
A second question is whether the somewhat uncertain assumptions framing Valdez might deter the Justices. As Footnote 6 of Valdez points out, the parties are assuming that Griffin applies to commenting on pre-trial evidence. And there are also interesting Salinas v. Texas issues lurking: Assuming that the refusal to unlock the phone counts as an assertion of the privilege, what follows from that is an issue not explored by Salinas. But maybe the U.S. Supreme Court would just put that set of issues aside, taking Valdez for the specific issue on which the parties have agreed the case rests.
As always, stay tuned.
Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Comments may only be edited within 5 minutes of posting. Report abuses.
Please
to post comments
What different issues does compelled unlocking (*via* password) raise? If SCOTUS decides the issue on the basis that it's testimony that you have access to the contents then wouldn't that decide both issues?
I understand that technically it's different, but I'm having trouble understanding what kind of position would make a different outcome in the two cases likely.
So here in IL we have an interesting issue. Its not directly on point; but for sake of analogy - imagine a DUI suspect refused to provide a breathalyzer sample (which they are allowed by statute to do). So in response, the government seeks a warrant for a blood sample and almost every time, they get it. But the cops aren't the one's who draw the blood, a phlebotomist does. And if the suspect tells them they don't consent, they won't take it. So what happens? The police tells the suspect they will charge them with obstruction of justice for impeding their lawful investigation by frustrating their warrant/evidence gathering. Give blood or face a new charge and if they still refuse, they do in fact get charged with DUI and also obstruction of justice.
So in the context of the phone warrant - government gets warrant for contents of phone. Can't get in and need password. Defendant refuses to provide it. Can they charge defendant then with obstruction? And if they do, can they argue THAT at trial since the act which makes up the elements of the offense is the refusal to provide the password (to frustrate the carrying out of the search warrant)?
I think i am also aware of other cases where police seize laptops or computers and can't get in because encrypted password and then courts holding defendant in contempt for failing to provide it. Again, not directly on point - but raises similar issues as far as tension between a valid warrant and with the assertion of 5th amendment right against self incrimination goes.
"But the cops aren’t the one’s who draw the blood, a phlebotomist does."
Sounds like the cops need to find a phlebotomist who will draw blood on a suspect even if they say they don't consent, if there's a warrant. Forcing someone to say that they consent isn't obtaining consent.
Do phlebotomists have any ethical code or enforceable licensing guidelines that would impede performing a procedure on a person who has refused (or would not provide consent for) the procedure?
https://phlebotomyu.com/legal-issues-in-phlebotomy/
If some phlebotomist or other was willing to do the procedure on a person/suspect who refused it, who would restrain the suspect, if such restraint is necessary?
If the police have the power to order you to give your consent to a blood draw on pain of "obstructing justice" why would they not equally have the power to order the phlebotomist to draw blood, whether you consent or not, on pain of "obstructing justice" ?
A phlebotomist who did that would face *personal* liability though - even to the point of losing their license.
That the cops demand it doesn't relieve them of their ordinary duty to get informed consent. For this to work, the state would have to create a law that provides immunity for this coercion.
Warrants that compel a business to release a suspect's data to the police work because 'third party doctrine' removes from the third party any liability (or ability to protect customers) for doing this.
Even then, there's a difference between getting a locksmith to break a lock for you with a warrant and a medical professional to do . . . medical stuff.
I don't understand how asserting your right against self-incrimination can ever be counted as "obstruction of justice". But as you say, courts have been letting police get away with that for some time now.
Blood alcohol content is physical evidence. Asking your permission is a nicity, en route to a warrant. In my state, IIRC, if you refuse they can take your license.
More generally, I struggle with the notion that declining to assist the police is "obstructing" them. Obstructing implies to me, getting in the way. Not declining to help.
If the police wish to search the shed in my neighbor's yard and wants me to get my toolbox and use my screwdriver to take the shed door off its hinges, then if I say "No - do it yourselves" I can't see that in any version of English I know, that I'm "obstructing" them.
If the police want to investigate something then they should investigate. Themselves.
.
There is no right of self-incrimination as pertaining to blood draws. (Whether there is as pertaining to decrypting/unlocking cell phones is unsettled.)
I assume that there is an app by now that mimics a lock screen, but deletes all data when an "oh my God, it's the cops" code is entered?
in many cases even if they cannot get to the data on the phone they could serve a warrant to check for backups on the home computer and cloud accounts. images might be easier to crack as that key is not held by the consumer.
using a complex passcode on the phone will thwart nearly all tools to break it and you can lower the threshold for erroneous code attempts to wipe the phone from the default of ten
Since forensic protocols are to image the drive before decrypting, you'll only delete the image. And then the police could hit you with an obstruction charge because you didn't merely refuse to cooperate - you actively attempted to delete the data.
Imaging also defeats the 10-attempts limit. You just restart attempt 11 (or whatever threshold you set) on a new image.
The 'taking an image' doesn't work on a lot of modern high-end phones. At least for Apple ones. Its locked to the hardware and you can't just re-upload the image when you hit failed try number 9 and start over.
This was an issue a few years ago with the Berkely shooters' (?) phone. Cops wanted to get into it 'urgently' (even though he was already dead) and Apple just shrugged and said 'nothing we can do' and they couldn't brute force it. Ended up with an Israeli company (?) that managed to crack it eventually.
I believe that was the San Bernardino terrorists that you're thinking of.
It is not possible on iOS devices to write such an app, unless one exploits of an appropriate OS bug. Apple’s original design carefully separates apps’ data from each other. This is why there is not a market for iOS virus checkers.
Every approved app goes through Apple’s vetting process. There is a pretty good chance they would catch this app. Of course, if Europe makes Apple let people install apps from non-Apple stores, all this could change.
I infer that there was no court order specifically compelling the defendant to provide the passcode, as some other defendants have been subject to. The U.S. Supreme Court could duck the privilege question this time by requiring the state to seek such an order pretrial and allowing the defendant to appeal it.
I hate lawyers who quibble like this.
The 4th and 5th Amendments aren't excuses for quibbling. Everyone but a lawyer understands it means KEEP OUT. MIND YOUR OWN BUSINESS.
If I can't do it to cops, judges, etc, then they can't do it to me without a warranty.
The thing about warranties is that you always have to read the fine print.
Yeah, I caught that too late to edit, and edit hasn't been working anyway.
More seriously, isn't there some kind of conflict between hiring people to investigate crimes and then saying the one rule is MIND YOUR OWN BUSINESS? The idea of investigating crime is that crimes are not just the criminal's business, but rather everyone's business. The People hire investigators, paying their salaries out of taxpayer funds, to figure out the business of those who committed crimes. Maybe this particular thing violates the Fifth Amendment, and maybe it doesn't. But I don't see how it can be answered by saying people must only mind their own business.
I believe that if I cannot do something to a cop, judge, etc, then they need a proper warrant to do it to me. That third party doctrine violates it. The pen and trap (?) warrant-free snooping violates it. The post office recording envelopes violates it. The 702 exceptions violate it. Cameras on utility poles recording 24x for a year violates it. Fish and game wardens trespassing violates it. Sneaking around cars in driveways or at curbs violates.
That's what I mean by quibbling lawyers disgust me.
If I can't do it to cops -- if I would be arrested for doing it to cops -- then cops need a warrant to do it to me.
No QI. No absolute immunity for prosecutors and judges. They are just people. If I can't do it to them, they can't do it to me without a proper warrant obtained before hand, and if they get caught violating the warrant, or making up QI and other excuses after the fact, they need to go to jail.
But the government has a warrant in all of these cases. Everyone agrees that the government can't search the phone without a warrant. The warrant is valid. What now?
The quibble here is that providing a password is not self-incrimination. My rant is about all these quibbles in general, all following the same pattern, that government wins because government judges, prosecutors, and cops all know that if they don't back each other against their common enemy (the public) even when not justified, their offended government brethren will not back them when they need protection from the common enemy (the public).
Pretending that compelling a password is not self-incriminating is just another quibble.
Is it fair to say that you have strong commitments that make a bunch of issues very easy, that may otherwise be hard to those who don't have a similarly strong a set of commitments?
Here's how lawyers come across to almost everybody I know, as far as quibbling away rights and letting the government get its way:
Cop: "Say 'I'".
Joe: "Why should I?"
Lawyer: "Go ahead, it's just a word."
Judge: "Here's your warrant. It's just a word. Say it or go to jail for obstruction of justice."
(repeat for "did" and "it")
Cop, lawyer, and judge, all together in three part harmony: "He confessed!"
Every single time it comes down to government vs people, the government wins.
Slaughterhouse quibbled away, in spite of both sides, pro and con, believing it to incorporate the entire Bill of Rights against the states.
Lawyers quibble, people lose, government wins.
Every one I have talked with thinks compelling a computer password or safe combination is self-incrimination.
Of course you don't! The government needs to convict criminals. The hell with what people need.
...Slaughterhouse quibbled away the 14th Amendment...
I think I will take that as a "yes." 🙂
.
You realize that this post is about a case where the government lost, right?
"If I can’t do it to cops — if I would be arrested for doing it to cops — then cops need a warrant to do it to me."
Let's assume, just for the sake of discussion, that it's bad for people to run red lights, or drive at night without headlights, or go 90MPH thru school zones. Officer Jones sees you driving at night without headlights, or running a red light, or going 90 in a school zone. The current scheme is that he pulls his marked car behind you and turns on his lights and sirens. Current law does not allow you to just ignore him.
Should he be required to get a warrant before pulling over people going 90 in a school zone? Or should all of us be able to pull over people we suspect are guilty of traffic offenses, with penalties for anyone who fails to pull over when John Q. Public flashes his hi beams and honks, or whatever?
Oh grow up. Only a quibbler pretends he doesn't know what I'm talking about.
The entire point is that you are mad stuff's not simpleand the rejoinder everyone is coming in with is that law made to deal with a complicated world is not going to be simple.
The problem here is that the Fifth Amendment does not protect you from producing records. The Fourth might, but that's what warrants are for. Before computers, if you had books and records, they clearly were subject to seizure by a warrant. For that matter, unencrypted computers are today, and those are often the first thing seized in many cases, since we live in the information age, and computers are a great source of information.
The issue is whether forcing someone to decrypt records is a Fifth Amendment issue.
This is my understanding, Prof. Kerr can correct me.
I don't like compelled decryption at all, Bored Lawyer. It is a recipe for endless government mischief.
And gentlemen in the founding era encrypted their communications. Do we have caselaw about compelled decryption from the founding era? Because we should, if courts then thought they could demand such a thing.
With a phone that was in recent use it seems likely the defendant knows the pin/password/whatever, but what about the more general case?
I have some old android phones and thumb drives for which I have long forgotten the passwords. Do you say, well, he has a phone/drive/file he says he has forgotten the password to, so we'll let the jury assume that device/file contains whatever evidence the government alleges? That doesn't sound right. OTOH, if you don't allow that inference, a whole lot of people are likely to find that the stress of getting arrested made them forget all their passwords.
There is an old, well, not-a-joke: "What's worse than knowing secrets and being in a KGB/Gestapo dungeon? Being in the dungeon and not having any secrets to tell...".
That government wants to incriminate you for not providing your password, which puts the lie to the whole foregone conclusion nonsense, if they can just throw you in jail for not helping them expose info they know is there, but their gnosis isn't sufficient to throw you in jail directly.
Half of humanity lives with an iron boot on their face, forever. Half of the rest lives in sketchy democracies lousy with corruption.
The US should lead the way promoting tougher and tougher uncrackable encryption, making it an expected part of living free. How dare politicians preen in front of the cameras about prosaic crime, when most of humanity suffers from continual megacrime.
Every time the US does stuff like this, the iron boot presses down on billions a little more forever-er.
When did the 5th amendment become a privilege?
Could someone explain how unlocking a phone under a search warrant differs from unlocking a home door?
It seems that the defendant in this case should have sat in jail under contempt until he unlocked the phone or died.
If they have a warrant and you refuse to unlock the door, they will just kick it down. If they have a warrant and you refuse to unlock your phone, they can try to decrypt it.
One obvious point which I don't see being made - the information which the defendant is asked to disclose (the password) is not itself incriminating. Thus the Fifth Amendment does not apply. (Unless it has been that knowledge of the password implicates the defendant in criminal acts. But if the device is the defendant's property, defendant would already by implicated any associated crime.)
Were defendants in the founding era required to decrypt documents on demand? That would be the relevant standard.
If no, it's pretty clear the government should not be able to compel decryption today.
Prof. Kerr has discussed that issue many times over the years. You are correct that the statement "The password to my phone here is 8675309" is not by itself incriminating. But it does constitute an admission that this is the person's phone and that he has the ability to access it. That's why, if those facts are not disputed, the person is generally required to unlock it for the govt, whereas if there's a genuine uncertainty about whether it's his phone, he might not be required to.
Of course, if one's password is, "Ishotthesherriff," then the password itself might be incriminating.