In courts across the country, EFF has been arguing that the police cannot constitutionally require you to unlock your phone or give them your password, and today the Indiana Supreme Court issued a strong opinion agreeing with us. In the case, Seo v. State, the court found that the Fifth Amendment privilege against self-incrimination protected a woman against unlocking her phone because complying with the order was a form of “testimony” under the Fifth Amendment. Indiana joins Pennsylvania, which ruled strongly in favor of the Fifth Amendment privilege in a compelled decryption case last year. Meanwhile, state supreme courts in New Jersey and Oregon are also considering this issue.
In Seo, the defendant reported to law enforcement outside of Indianapolis that she had been the victim of a rape and allowed a detective to examine her iPhone for evidence. But the state never filed charges against Seo’s alleged rapist, identified as “D.S.” Instead, the detective suspected that Seo was harassing D.S. with spoofed calls and texts, and she was ultimately arrested and charged with felony stalking. The state not only sought a search warrant to go through Seo’s phone, but a court order to force her to unlock it. Seo refused, invoking her Fifth Amendment rights. The trial court held her in contempt, but an intermediate appeals court reversed.
In an amicus brief on behalf of EFF and ACLU and at oral argument in the Indiana Supreme Court, we explained that the compelled recollection and use of passwords to encrypted devices should be viewed as a modern form of “testimonial” communications, which are protected by the Fifth Amendment privilege. Although some courts have struggled with the concept of testimony in the context of compelled decryption, a 1957 U.S. Supreme Court case defines it as anything that requires a person to disclose “the contents of his own mind.” It’s also clear that nonverbal acts can be testimonial, such as being forced to respond truthfully to police questioning with a “nod or headshake,” or to produce a gun that police believe was used in a crime. And in a 1990 case, the U.S. Supreme Court found that a motorist suspected of drunk driving couldn’t be forced to tell police the date of his sixth birthday, even though officers clearly knew the answer and were simply trying to obtain evidence of his intoxication.
The Indiana Supreme Court agreed, writing that unlocking a phone “communicates a breadth of factual information,” since it allows the government to infer that the suspect knows the password to the device and thus possessed the files on the phone. This gives “the State information it did not previously know—precisely what the privilege against self-incrimination is designed to prevent.”
In addition to the question of “testimony,” however, courts in compelled decryption cases have struggled with Fisher v. United States, a 1976 U.S. Supreme Court case that introduced the concept of a “foregone conclusion.” Fisher involved a subpoena for an individual’s tax documents, where the government could demonstrate that it already knew all of the information it would otherwise learn from a response to the subpoena. In other words, it was a “foregone conclusion” that the specific documents the government sought existed, were authentic, and belonged to the individual. Although the Supreme Court has never again relied on this foregone conclusion rationale, the government has built it into a full-blown “doctrine.” State and federal prosecutors have invoked it in nearly every forced decryption case to date. In Seo, the State argued that all that compelling the defendant to unlock her phone would reveal is that she knows her own passcode, which would be a foregone conclusion once it “has proven that the phone belongs to her.”
In our amicus brief, we argued that this would be a dangerous rule for the Indiana Supreme Court to adopt. If all the government has to do to get you to unlock your phone is to show you know the password, it would have immense leverage to do so in any case where it encounters encryption. The Fifth Amendment is intended to avoid putting people to a “cruel trilemma”: self-incriminate, lie about knowing the password, or risk being held in contempt for refusing to cooperate. Instead, it’s clear from Fisher and later Supreme Court cases that the foregone conclusion rationale is very narrow. The Court has applied it in Fisher, a case involving business records, and only where the testimonial communication at issue was the act of providing specified documents. The Court has made clear there is no foregone conclusion exception where a person is required to use the contents of their mind, even in responding to a more open-ended document subpoena. So there should be no exception to the Fifth Amendment when the government compels disclosure or use of a passcode to unlock and decrypt a digital device.
In its opinion, the Indiana Supreme Court largely agreed. It rejected the state’s argument that it could invoke the foregone conclusion rationale if it could show that the defendant knew her password. Instead, it held that the state was “fishing for incriminating evidence” without any knowledge of what was on her phone, and that forcing her to unlock her phone under these circumstances would “sound the death knell for a constitutional protection against compelled self-incrimination in the digital age.”
Although that resolved the case, the court also included a lengthy discussion of why the foregone conclusion rationale should probably never apply to compelled decryption cases. It noted that smartphones contain “far more private information than a personal diary or an individual tax return ever could,” a fact that has led the U.S. Supreme Court to reject the application of pre-digital caselaw to government searches of phones. The Indiana court wrote that applying Fisher’s foregone conclusion rationale “would mean expanding a decades-old and narrowly defined legal exception to dynamically developing technology that was in its infancy just a decade ago.” Finally, the court noted that police have many tools to investigate users of encrypted devices without compromising users’ constitutional rights. In light of these tools, compelling a user to unlock a phone would “tip the scales too far in the State’s favor, resulting in a seismic erosion of the Fifth Amendment’s privilege against self-incrimination.”
We’re gratified by the ruling, and we’re watching for courts in New Jersey, Oregon and elsewhere to continue the trend of protecting against compelled decryption.