This is an interesting case. From a civil liberties, card-carrying ACLU member standpoint, I'm all for the "anti" side of this - keep the gov't out.
On the other hand, there's a decent case made that establishing this kind of precedent would basically mean that if criminals are smart enough to use PGP, then that data can never be used against them. Since you can be compelled to turn over a physical key via due process, why can you not also be compelled to turn over a digital one?
Most of the privacy arguments vanish as well since they don't want the password (which could give them access to other things they're not supposed to have), but they just want the data.
why can you not also be compelled to turn over a digital one?
Because you may have forgotten it. It's likely you would not have had access to the hardware in the many months these things drag out. I know I've forgotten some complex passwords in a day or two.
Also, there may be an argument to be made that by demonstrating your knowledge of the password you are being forced to confess to ownership of whatever content is unlocked. Although the lock-and-key metaphor seems very attractive, it not necessarily the case that "decryption" equals "authentication".
Encryption is easy, authentication is the harder problem! There have been encryption products sold and used that did not provide effective authentication, i.e., someone who didn't know the key could tamper with the contents of the disk so that it decrypted to something else.
On the other hand, there's a decent case made that establishing this kind of precedent would basically mean that if criminals are smart enough to use PGP, then that data can never be used against them.
So now smart criminals will move to Truecrypt hidden volumes and claim there isn't any hidden volume. So now what do you do? Jail someone who might be telling the truth, or let him go?
This doesn't solve anything. Encryption is way past it.
My understanding of existing case law regarding safes is that you can be compelled to give up a key, as it is just physical property to which the state has right to request, but can not be compelled to give a combination, as that is just memory and would violate the fifth amendment. Just because cryptographers use the term "key" doesn't mean the should be treated as real keys. It seems obvious that a key/paraphrase is perfectly analogous to a safe combination.
You don't have to give up a key. They would be asking you to decrypt the drive. Whether that requires you to enter a passphrase or turn on the webcam and do a jig, it doesn't matter. They have no interest in your key/password/secret 4 digit code. They want the contents of the drive.
Now they could be playing at a disadvantage, but the point is that the 5th amendment does not enter into here. If the police have a warrant for papers in your safe, they simply ask you to open the safe, by whatever means. This is no different when they have a warrant for files (papers, information) on your encrypted drive (safe) and are asking you to open it by whatever means.
It does not matter whether the government forces you to do something (e.g. open a combination lock), as opposed to providing information (e.g. tell them the combination). The deciding factor is whether there is an invasion of your mental privacy inherent in the government compulsion. Whether you disclose the combination or open the lock yourself, the contents of your mind are being used to incriminate you, so your Fifth Amendment rights are being violated. This is distinct from the government demanding the key to a safe, or even taking a blood sample from you against your will, both of which are purely physical impositions.
===
Longer Version:
If the police have a warrant to search your documents, that does not mean that they can make you provide the documents to them. They can look through your stuff to find the documents, but if the police cannot read them, that is their problem.
However, a grand jury can subpoena documents from you, in which case you will be compelled to provide them. In this case, you can invoke the Fifth Amendment privilege against testimonial self incrimination as it relates to the production of documents. To the extent that the act of producing the documents requires you to use the contents of your mind, the act of production cannot be used to incriminate you. So, on one hand, your Fifth Amendment right will not protect you if the police already know that the documents exist and all of the information that is contained in them. However, if the police do not know exactly what documents they are looking for and what the documents say, then the information found in the documents cannot be used against you in court, nor can it be used to find other incriminating information.
In other words if my password is "I am guilty" I can invoke the 5th and tell the grand jury that I will not tell them my password.
However, when the grand jury says "produce the crooked accounting books we know you have (witnesses have testified that you have them) that are stores on your laptop", am I required to somehow produce them or do I just say "nope, not going to happen." In the latter case, if those books are the difference between an acquittal and a conviction, do they just let you go, or do they hold you in contempt until you give in?
Lastly, what is the difference between using the contents of my mind when entering a password vs telling the police where I left the key to my safe?
1 (re: Crooked Account Books) - if the government knows you have accounting books, they can force you to turn them over. You must provide them with physical access to the books. In your example, you could take the hard drive out of your laptop and hand it to them. However, if your hard drive was encrypted, and you had the encryption key memorized, you would not have to tell them. If the judge hearing your case did not understand the intricacies of Fifth Amendment doctrine, like the judge in this case, he might order you to decrypt the hard drive. In this case, your lawyer would ask the judge to stay (i.e., delay) his order to give you a chance for interlocutory appeal.
If the judge did not grant the stay, you could turn over the key but explain that you were not waiving your Fifth Amendment rights. Then when you were found guilty, you could appeal, argue that your Fifth Amendment rights were violated, and get your conviction overturned. Alternatively, you could not turn over the key, go to jail for contempt, and wait for your lawyer to appeal the contempt finding and get you out of jail.
2 (re: password vs. physical key in secret place) - in some cases, the act of producing a physical key may actually be protected under the Fifth Amendment. If the police can show that you know the key's location, then by forcing you to produce the key they are not forcing you to give any testimony, and you have no Fifth Amendment protection. However, if they ask you for a key but can't prove that you have it, they are asking you to create implicit testimony. The implicit testimony is "I know where the key is." If this testimony would end up incriminating you, the it is protected by the Fifth Amendment and you don't have to produce the key.
isnt the simple point of the 5th supposed to be more or,ess "you do cannot be compelled bylaw to help convict yourself)... ay law to the contrary would be unconstitutional.
No, the point of the 5th is that you cannot be compelled to give testimony against yourself (which is under oath and for which you will go to jail if you perjure yourself.) You are not protected from helping to convict yourself if you leave the evidence of your crimes available to the court. An encrypted drive is being considered as something like an un-crackable safe for which you have the combination; providing the password is not testifying, it is providing the court access to evidence that you would otherwise be concealing from a valid warrant.
Providing the password to a safe that contains incriminating documents actually is testimonial in nature because it requires you to disclose information you have in your mind (see above). As such, any information that the government obtains by compelling you to give them the password cannot be used against you in a criminal trial. The judge in the case being discussed here got it wrong, and his decision will be overturned on appeal if it goes up to the Supreme Court.
"Prosecutors in this case have stressed that they don't actually require the passphrase itself, and today's order appears to permit Fricosu to type it in and unlock the files without anyone looking over her shoulder."
So the state is arguing that they're not demanding the password, only the plaintext.
Still seems fishy, but it's not clear that it's testimonial.
I suppose one could argue that it's more akin to a judge demanding that you produce the corpse the police have so far been unable to locate.
Better still, as someone else said, it's like the police demanding that you translate notes you wrote down in your own made-up-and-known-only-to-you language.
The production of decrypted plaintext by means of an encryption key stored in your mind falls squarely within the rule on production of documents from U.S. v. Hubbell, discussed in jpol's comment above. It therefore seems quite likely the state will lose on appeal.
> This is no different when they have a warrant for files (papers, information) on your encrypted drive (safe) and are asking you to open it by whatever means.
This seems acceptable if they have a warrant for the contents of your safe. If they had a warrant for "evidence" and no knowledge or reason to believe that it was in the safe, could they open it/force you to open it simply because you own the safe. Similarly, if you had a hard drive, could they force decryption without knowing how the contents relate to the case.
Another issue that comes to mind is what happens if a hard drive containing truly random data is found, but the state thinks it contains encrypted data. Could someone be held in contempt for not releasing the (nonexistant) keys. This is probably related to the problem of destroyed keys.
Criminal contempt would have to be proven beyond a reasonable doubt, and the elements of proving the defendant's failure to provide the encryption key would include (1) showing that the key exists and (2) showing that they key is in the defendant's possession.
You mean a witness testifies they saw you unlock a system that looks a bit like the one they are seeing in front of them at trial?
Witness testimony is incredibly unreliable in practice, but courts LOVE that crap. So someone basically could get locked away in contempt forever because someone thinks they saw you unlock a system you can't actually unlock...
They savy criminal argument doesn't pass constitutional muster.
You could say "allowing criminals to not testify against themselves could frustrate law enforcement because a savy criminal could just commit everything to memory."
The 5th ammendment clearly says "too bad, those are the rules."
It's not a "reduction to the absurd". It brings up the point that there is no "essential law enforcement" interest that overrides the right to avoid self incrimination. No matter how badly someone wants to convict you, you have a right to not give testimony against your self against your will.
Since you can be compelled to turn over a physical key via due process, why can you not also be compelled to turn over a digital one?
I know this is rare, but in my opinion it's best to reason about the digital world by explicitly ignoring any analogies to the real world. Rep. Watt said during the SOPA committee hearings that we need parallels in the virtual world to the physical world. I couldn't disagree more.
On the other hand, there's a decent case made that establishing this kind of precedent would basically mean that if criminals are smart enough to use PGP, then that data can never be used against them. Since you can be compelled to turn over a physical key via due process, why can you not also be compelled to turn over a digital one?
Most of the privacy arguments vanish as well since they don't want the password (which could give them access to other things they're not supposed to have), but they just want the data.
I'll be watching this one closely.