Pennsylvania Supreme Court Says Compelled Password Production Violates The Fifth Amendment

Tech Dirt – by Tim Cushing

The Fifth Amendment prevents compelled production of passwords, the top court in Pennsylvania has ruled. (h/t ACLU) It joins a handful of other state courts finding passwords to be testimonial, including Indiana, Illinois, and Florida. Unfortunately, there’s no SCOTUS opinion uniting the states, so Fifth Amendment coverage remains spotty. 

Securing rights remains the job of unsympathetic defendants. The state’s child porn prosecution is likely to stall out with its main supply of potential evidence inaccessible. Despite the defendant basically admitting the computer law enforcement seized contained other child porn images (“we both know what’s on there“) and that he alone used the computer and could decrypt it, the court says [PDF] the state’s foregone conclusion assertions aren’t enough to render the Fifth Amendment useless.

That was the state’s argument: the seized computer likely has child porn on it, based on the defendant’s admissions and the investigative work that tracked porn downloads/uploads to his address. The state’s Superior Court found the government’s arguments persuasive, but only by drastically narrowing the scope of its focus.

Applying the foregone conclusion exception, the Superior Court, contrary to the trial court, focused on the password itself, and reasoned that the Commonwealth established the computer could not be opened without the password, that the computer belonged to Appellant and the password was in his possession, and that this information was “self-authenticating” ― i.e., if the computer was accessible upon entry of the password, the password was authentic.

While the government would like the court to believe that the compelled production of passwords is like demanding a key to a locked box, the court disagrees. There is Supreme Court precedent that guides this analysis, even if the Supreme Court has yet to rule on compelled password production.

First, the Supreme Court has made, and continues to make, a distinction between physical production and testimonial production. As made clear by the Court, where the government compels a physical act, such production is not testimonial, and the privilege is not recognized. See Holt; Doe II. Second, an act of production, however, may be testimonial when the act expresses some explicit or implicit statement of fact that certain materials exist, are in the defendant’s custody or control, or are authentic. See Fisher; Hubbell. The crux of whether an act of production is testimonial is whether the government compels the defendant to use the “contents of his own mind” in explicitly or implicitly communicating a fact.

Fifth Amendment protections may be limited in cases like these, but they’re not nonexistent. The government has an evidentiary burden to meet before it can demand production of passwords.

[U]nder a foregone conclusion analysis, the Supreme Court has reasoned that an act of production does not render communication testimonial where the facts conveyed already are known to the government such that the evidence sought “adds little or nothing to the sum total of the Government’s information.” Fisher, 425 U.S. at 411. Thus, what is otherwise testimonial in nature is rendered nontestimonial, as the facts sought to be compelled are a foregone conclusion. As described above, for the exception to apply, the government must establish its knowledge of: (1) the existence of the evidence demanded; (2) the possession or control of the evidence by the defendant; and (3) the authenticity of the evidence.

The state simply doesn’t have it here. It has a computer that, if unlocked by a compelled password, would become “self-authenticating.” The defendant’s assertions about his control of the computer isn’t enough to clear these hurdles. Most of the state’s “foregone conclusion” about available evidence (with the exception of a single, verified child porn image transferred from the defendant’s IP address to investigators during the investigation) is nothing more than a strong hunch. That’s not enough.

In sum, because the Commonwealth has failed to establish that its search is limited to the single previously identified file, and has not asserted that it is a foregone conclusion as to the existence of additional files that may be on the computer, which would be accessible to the Commonwealth upon Appellant’s compelled disclosure of the password, we find the Commonwealth has not satisfied the foregone conclusion exception.

This ruling does not go so far as to cover compelled production of biometric features, however.

Because we are dealing with a motion to require an individual to recall and disclose a memorized password to a computer, in essence, revealing the contents of one’s own mind, we need not address the related, but distinct, area involving biometric features like fingerprints, thumbprints, iris scanning, and facial recognition, or whether the foregone conclusion rationale would be appropriate in these circumstances.

But the court hints it would likely find in the state’s favor if the decryption key was a fingerprint.

[N]ot only are these communications not before our Court, it is the United States Supreme Court that long ago has created the dichotomy between physical and mental communication.

Also of note is this: supporting briefs filed on behalf of the government by other state governments appear to contain threats of anti-encryption legislation if courts continue to allow the Constitution to protect defendants from self-incrimination.

In a joint amicus brief in support of the Commonwealth, various states provide an interesting history of modern encryption, press the troubling consequences of Appellant’s position ― including the altering of the balance of power, rendering law enforcement incapable of accessing large amounts of relevant evidence ― and warn that adopting Appellant’s position could result in less privacy, not more, in the form of draconian anti-privacy legislation.

There’s nothing quite like multiple state governments claiming they’ll strip away privacy protections if they can’t ignore Constitutional protections. When it comes to weighing the interests of all involved stakeholders, it appears the government’s interests weigh the most.

https://www.techdirt.com/articles/20191124/09372943445/pennsylvania-supreme-court-says-compelled-password-production-violates-fifth-amendment.shtml