18

I'm asking this for the sake of a story I was considering writing.

Assume that someone has a computer, and within that computer he has some encrypted data. He is accused of a crime and the police get a search warrant to confiscate his computer. They suspect that he may hold evidence of the crime within the encrypted data, but have no way of getting to it without a password.

Can the police force the owner of the computer to reveal his password, and/or penalize him if he doesn't, since they have a search warrant which justifies their viewing his data? Or would this qualify as being forced to bear witness against yourself and thus be protected under the bill of rights?

Related question, if they confiscate a user's computer and learn his password, either from his providing it or it being saved on his computer, would they have the right to use that password to view information stored on 'the cloud', such as in his e-mail or even on his facebook?

  • 1
    Are you interested about producing the key, or just the data? – cpast Jul 29 '15 at 22:48
  • If you use information contributed here elsewhere, please be aware of your obligations under the Terms and CC-BY-SA 3.0 – jimsug Jul 29 '15 at 23:38
  • 2
    @jimsug In what would actually be an interesting question for this site, I don't think CC actually is relevant (as I presume dsollen won't use the actual text of answers here, and I'm quite sure the information in them is not copyrightable). – cpast Jul 30 '15 at 2:08
  • 1
    @jimsug I will keep that in mind, but I was only fact checking a personal story (not one I plan to make money off of). I wouldn't be using the contents directly, so I don't think that applies? – dsollen Jul 30 '15 at 14:27
  • 1
    Nitpick: title says 'authentication key' and 'encrypted' but Q and As are only encryption. Authentication and encryption are different things; some modern computer crypto does both with one key or password (which also aren't actually the same thing); some does both with separate keys or passwords; some does only one or the other. If your case is a key/password used only for authentication I expect (but don't know) it would give a different legal result than encryption. – dave_thompson_085 Dec 10 '15 at 3:46
17

Nothing below is legal advice. I am not a lawyer. If law enforcement is actually requesting an encryption key, talk to a real lawyer.

To answer your first question, the answer is "the government probably can't demand the password, but might be able to demand the data." Some courts have ruled that the Fifth Amendment can prevent courts from forcing someone to decrypt data for the government, because the act of decrypting the data conveys information (see United States v. Doe from the 11th Circuit). Other courts have ruled that there are situations where that is not the case (US v. Fricosu, In re Boucher). Boucher is particularly interesting because the government first asked for the password itself, and then (when that subpoena was quashed by the magistrate) narrowed its request to the decrypted data on appeal. In the magistrate's opinion, we see

Also, the government concedes that it cannot compel Boucher to disclose the password to the grand jury because the disclosure would be testimonial.

It is not generically a violation of the Fifth Amendment to compel production of documents (the 11th Circuit, quoting the Supreme Court, considered this a "settled proposition"). The issue is that the act of producing the documents can be considered testimony -- by producing the documents, the person is showing that they know the documents exist, where they are, how to read them, etc. Possession of the key to decrypt a file links you to that file, because keys are generally kept secret. In the 11th Circuit case, the court found that the government didn't know for a fact that a) Doe could decrypt the files, and b) what files existed on the encrypted drive. In the cases where forced decryption was allowed, the government had seen enough to independently show that the files existed, were authentic, and that the defendant had actual control/possession over them. The 11th Circuit asked for a bit more (the location), based on a standard that is in effect in some circuits but not others.

In any event, courts seem to generally consider this to take a court order to force production of anything; the police can't just order you to do it.

  • This is a great answer. Out of curiosity what can they do if someone says they don't know the password for an encrypted file, or even better yet claims he forgot it years ago. It seems like it would be nearly impossible to prove he remembers the password short of showing him having just opened it? Also, would you happen to be able to name a state that would not allow forcing disclosure of encryption content and/or one state that does (save me hassle in figuring out what states to set a story in lol). Either way this is a great answer! – dsollen Jul 30 '15 at 14:22
9

Current law in the United States on this subject is unsettled.

In re Boucher (2009): The United States District Court for the District of Vermont held that if the contents of the encrypted files are generally known to the government, then revealing the encryption key is not self-incrimination, and Fifth Amendment protections do not apply.

United States v. Kirschner (2010): The United States District Court for the Eastern District of Michigan held that forcing someone to reveal their password was "producing specific testimony asserting a fact", and as such, counted as self-incrimination.

United States v. Doe (2012): The 11th Circuit Court of Appeals held that revealing the encryption key for encrypted data (or equivalently, revealing the decrypted data) constitutes self-incrimination, so the government cannot force you to reveal it.

United States v. Fricosu (2012): This was shaping up to be another fight over key disclosure, the trial judge having ruled that the defendant must reveal their password, until the police received the password through alternate means, rendering the question moot.

There do not appear to have been any Supreme Court rulings on the subject.

5

If the owner of the computer has been arrested and is the subject of a criminal investigation, he can not be forced to give the police a password because it is a violation of his rights protected by the 5th amendment.

A typical Miranda warning includes the language

You have the right to remain silent (when being questioned).

Analysis

Kirschner and Doe support this answer.

Boucher does not apply because the defendant waived 5th amendment protection by initially cooperating. Fricosu does not apply because the encryption issue was mooted by a third party providing the password. In both cases, the 5th amendment was used to protect the defendant from being forced to produce the password. Another hurdle is the non-rebuttable assertion that the defendant might not remember the password. As Fricosu pointed out.

Disclaimer

I am not an attorney. I am not your attorney. This advice is not intended to apply to your specific situation. DO NOT FOLLOW IT. If you have a legal problem, ask a real lawyer not the internet.

  • Do you have a source for this? Court cases have gone both ways in deciding if someone needs to reveal a password or encryption key. – Mark Jul 30 '15 at 0:45
  • @Mark Actually, what I found was mostly going both ways on revealing data, not keys. Boucher and Fricosu were about data, not keys (Boucher was initially about a key, but the government themselves conceded that the key was going too far). – cpast Jul 30 '15 at 2:07
  • Boucher does not apply because the defendant waived 5th amendment protection by initially cooperating. Fricosu does not apply because the encryption issue was mooted by a third party providing the password. In both cases, the 5th amendment was used to protect the defendant from being forced to produce the password. Another hurdle is the un-rebuttable assertion that the defendant might not remember the password. As Fricosu pointed out. @mark – Mowzer Jul 30 '15 at 6:36
1

The big question (since this is for a story) is whether the fact that you know the password, or the password itself, is evidence against you. If the password itself is evidence, then you could be forced to unlock the data while nobody watches you and can learn your password (for example if your password is my_wifes_bones_are_hidden_under_the_floorboards). Same if you just don't want to reveal it.

If the fact that you know the password is by itself incriminating you, and the police can't prove that you know or knew the password, then you don't need to reveal that you know the password. For example knowing the password may prove that you are the owner of a computer, or that you knew the contents of a hard drive.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.