Can a US citizen be required to provide the authentication key for encrypted data on a confiscated computer?

Question

I'm asking this for the sake of a story I was considering writing.

Assume that someone has a computer, and within that computer he has some encrypted data. He is accused of a crime and the police get a search warrant to confiscate his computer. They suspect that he may hold evidence of the crime within the encrypted data, but have no way of getting to it without a password.

Can the police force the owner of the computer to reveal his password, and/or penalize him if he doesn't, since they have a search warrant which justifies their viewing his data? Or would this qualify as being forced to bear witness against yourself and thus be protected under the bill of rights?

Related question, if they confiscate a user's computer and learn his password, either from his providing it or it being saved on his computer, would they have the right to use that password to view information stored on 'the cloud', such as in his e-mail or even on his facebook?

Answer 1

If law enforcement is actually requesting an encryption key, talk to a real lawyer.

To answer your first question, the answer is "the government probably can't demand the password, but might be able to demand the data." Some courts have ruled that the Fifth Amendment can prevent courts from forcing someone to decrypt data for the government, because the act of decrypting the data conveys information (see United States v. Doe from the 11th Circuit). Other courts have ruled that there are situations where that is not the case (US v. Fricosu, In re Boucher). Boucher is particularly interesting because the government first asked for the password itself, and then (when that subpoena was quashed by the magistrate) narrowed its request to the decrypted data on appeal. In the magistrate's opinion, we see

Also, the government concedes that it cannot compel Boucher to disclose the password to the grand jury because the disclosure would be testimonial.

It is not generically a violation of the Fifth Amendment to compel production of documents (the 11th Circuit, quoting the Supreme Court, considered this a "settled proposition"). The issue is that the act of producing the documents can be considered testimony -- by producing the documents, the person is showing that they know the documents exist, where they are, how to read them, etc. Possession of the key to decrypt a file links you to that file, because keys are generally kept secret. In the 11th Circuit case, the court found that the government didn't know for a fact that a) Doe could decrypt the files, and b) what files existed on the encrypted drive. In the cases where forced decryption was allowed, the government had seen enough to independently show that the files existed, were authentic, and that the defendant had actual control/possession over them. The 11th Circuit asked for a bit more (the location), based on a standard that is in effect in some circuits but not others.

In any event, courts seem to generally consider this to take a court order to force production of anything; the police can't just order you to do it.

Answer 2

Current law in the United States on this subject is unsettled.

In re Boucher (2009): The United States District Court for the District of Vermont held that if the contents of the encrypted files are generally known to the government, then revealing the encryption key is not self-incrimination, and Fifth Amendment protections do not apply.

United States v. Kirschner (2010): The United States District Court for the Eastern District of Michigan held that forcing someone to reveal their password was "producing specific testimony asserting a fact", and as such, counted as self-incrimination.

United States v. Doe (2012): The 11th Circuit Court of Appeals held that revealing the encryption key for encrypted data (or equivalently, revealing the decrypted data) constitutes self-incrimination, so the government cannot force you to reveal it.

United States v. Fricosu (2012): This was shaping up to be another fight over key disclosure, the trial judge having ruled that the defendant must reveal their password, until the police received the password through alternate means, rendering the question moot.

There do not appear to have been any Supreme Court rulings on the subject.

Answer 3

If the owner of the computer has been arrested and is the subject of a criminal investigation, he can not be forced to give the police a password because it is a violation of his rights protected by the 5th amendment.

A typical Miranda warning includes the language

You have the right to remain silent (when being questioned).

Analysis

Kirschner and Doe support this answer.

Boucher does not apply because the defendant waived 5th amendment protection by initially cooperating. Fricosu does not apply because the encryption issue was mooted by a third party providing the password. In both cases, the 5th amendment was used to protect the defendant from being forced to produce the password. Another hurdle is the non-rebuttable assertion that the defendant might not remember the password. As Fricosu pointed out.

Disclaimer

If you have a legal problem, ask a real lawyer not the internet.

Answer 4

The big question (since this is for a story) is whether the fact that you know the password, or the password itself, is evidence against you. If the password itself is evidence, then you could be forced to unlock the data while nobody watches you and can learn your password (for example if your password is my_wifes_bones_are_hidden_under_the_floorboards). Same if you just don't want to reveal it.

If the fact that you know the password is by itself incriminating you, and the police can't prove that you know or knew the password, then you don't need to reveal that you know the password. For example knowing the password may prove that you are the owner of a computer, or that you knew the contents of a hard drive.