In which the Washington Bureau Chief is cryptic

by Eileen | 8:00 am, January 13, 2012 | 1 Comment

Privacy could be greatly enhanced (or not) right here in Colorado. Can Uncle Sam compel you to turn over a passphrase to an encrypted computer, or compel you to decrypt a device for them, in spite of the Fifth Amendment?

The facts, briefly, are these. A woman’s laptop was confiscated pursuant to a warrant by police as part of a fraud investigation. It was, though, fully encrypted at the time, leaving the state unable to execute a second warrant to search its contents. The state is asking for an order, an Application under the All Writ’s Act (as opposed to a milquetoast old subpoena) compelling the woman, already under indictment, to decrypt her computer; she is claiming the 5th Amendment protects here from doing so. A decision could come any day

I know. It’s so exciting. Actually, given where this country is going on privacy rights, it’s so terrifying.

Anyway…

Alright, so, some background. First, you need to to know about Boucher, a 2007 case out of Vermont that essentially asked whether an individual may refuse to provide a passphrase to an encrypted electronic device on the grounds of the 5th Amendment.

OK, first, a brief background to the background. Encrypting a device is substantially different from just taking advantage of the password option to log in. Yes, you should totally do that, but it’s only going to keep out prying roommates and third-rate script-kiddies. In the hands of a forensic professional with time on his side, your little rinky-dink user password is worthless.

Encryption, on the other hand, makes it much harder to get access to whatever is protected. Choose a sufficiently difficult key and passphrase, and it becomes effectively impossible to break into your stuff. It’s possible to encrypt files, volumes, whole drives, and entire operating systems. Once the OS is encrypted, even booting from a disk or swapping your hard drive into another machine won’t allow access.

Contrary to the Hollywood image of slick government hackers who can bypass any system with a modicum of effort, getting into an encrypted OS within the lifespan of the universe requires the passphrase.  Hence Washington’s eagerness to gain the dubious ‘right’ to compel citizens to give up passphrases.

Alright, back to Boucher, but oh-so-briefly. You can read the full details at the link. Sebastien Boucher was arrested and his laptop confiscated for illegal material two ICE agents saw on it during an inspection at the US-Canada border. However, the government turned the machine off and couldn’t re-gain access to the illicit material without knowing the encryption passphrase. They issued a subpoena to compel that the passphrase be turned over, having already got a warrant for the contents of the drive, and Boucher claimed the Fifth. He won the first round but was ultimately defeated when the District Court found for the state

In Boucher, the defendant lost on a specific area of Fifth Amendment law called Act of Production. Basically, to claim Act of Production under the 5th Amendment means you are refusing to turn over something because merely producing it would prove that said documents exists, prove that you have custody of and access to the documents, and would authenticate them. Thus, even producing the documents in question is testimonial and incriminatory.

It’s this kind of stuff the differentiates policy from law.  One considers ideas and moral precepts.  The other is maddeningly hair-splitting.  Is a passphrase more like a key or a safe combination?  Is there a meaningful difference between compelling someone turn over the passphrase and compelling them to enter the passphrase and then surrender the computer?  And so on.

Additionally, when the government appealed the intial Boucher ruling, they amended a key part of their subpoena. At first, they wanted to compel Boucher to turn over his passphrase. On appeal, they amended the subpoena to ask only for the decrypted contents of the drive, even if that meant allowing Boucher to type in his passphrase while no one was looking instead of actually communicating the phrase to the state. It worked. After three years, Boucher gave up the passphrase and was subsequently convicted.

Back in Colorado, the current defendant, Ramonda Fricosu, is also claiming Act of Production and the state is hoping that what worked in Vermont will work here. They’re making the same counter-argument in Fricosu that worked in Boucher – invoking the Foregone Conclusion doctrine by arguing that they know so much about the drive’s contents that Fricosu would not be adding to their case by turning over the decrypted contents.

Now, the intelligent lay person would ask why the state needs to see the drive’s contents if they can’t add anything to the pending case.  However, those of you who know (or might happen to be) lawyers know that as soon as an attorney starts arguing something has no legal value yet he still wants to court to hand it to him, something nasty is in the wings.

In a nutshell, if nothing Fricosu might give to the state by decrypting the computer would be new, then it’s not testimonial and if it’s not testimonial, then there is no 5th Amendment issue and no privilege. Colorado is also perhaps hoping to learn from Vermont in that they have said from the beginning they have no problem with allowing Fricosu to type in her passphrase with no one looking before turning the computer over to a forensic specialist.

(The reason this is a point worth arguing over is that the encrypted contents have no 5^th Amendment privilege as they aren’t testimonial and were created voluntarily. It’s the act of providing access that might be privileged and the state is arguing that if Friscosu never actually shares the access code, only turns over the contents in a newly readable format, then no privilege was violated at all. Yes, of course it’s sophist nonsense.)

For the Obama administration, a cabal that is, at this point, not even pretending to care about privacy, this case is a big deal. Colorado specifically sought out Washington’s approval to pursue the plan to compel Fricosu’s compliance. No less a figure than Lanny Breuer, Assistant Attorney General for the United States, personally approved the request from U.S. Attorney for Colorado John Walsh. One day after Breuer’s approval came through, Walsh’s office asked the District Court of Colorado to order Fricosu to decrypt her computer. Six months later – faster than light when one considers the speed of the U.S. judiciary – we are expecting a ruling from Judge Robert Blackburn.

Regardless of who wins this round, an appeal really is a foregone conclusion. SCOTUS declined to hear Boucher so there is some precedent yet to be set.  And, let’s not be conspiratorial, but it is interesting that D.C. is being kept in the loop on this from day one.

Well, has the state got a case?

Writing for the state is Assistant U.S. Attorney Patricia Davis, who, suffice to say, is not on PPC’s Christmas card list. My favorite part of her brief was where she preciously insisted that breaking into the laptop, “…if it is possible at all, would require significant resources and may harm the Subject Computer.” While that is true enough, the government claiming to be all of a sudden concerned that they might damage a citizens’ property in the course of governing is the worst sort of offensive blather.

The government has sought to compel decryption under the diabolically vague All Writ’s Act, more or less arguing they can compel decryption so long as they claim such authority is an implied power of the judiciary. What’s really going on in Fricosu is an extension of the Boucher battle over Act of Production, itself a cheap game to deny defendants protection against self-incrimination without actually admitting to it.

The state has staked its ground. On the other side, EFF, in an amicus curie brief, points out that the state’s own words; there is, “a very high likelihood of containing evidence pertaining to the charged crimes,” is inadequate to meet the foregone conclusion doctrine’s burden.  For one thing, if you had carte blanche to go through anyone’s laptop, there is a ‘high likelihood’ you’d find something embarrassing if not illegal.

Specifically, another court decision, Hubbell, requires the state to be able to describe what they want with “particularity” if a defendant or witness is to be compelled to produce incriminating evidence. Does the state have a circumstantial case? Yes, they do. Ought the Bill of Rights be able to stand up to the legal jargon equivalent of “damned if we know what there is, but we want to see it”?

Another aspect of invoking AoP is also at play here: authenticity. Davis argues that, “…her [Fricosu's] act of producing [the computer contents] arguably has evidentiary value to authenticate the items.” Here the state’s claim is that they needs the contents, and needs them authenticated by Fricosu’s act of accessing then. Blithely sidestepped is whether or not decryption would also be incriminatory.

Davis however is out to prove that it’s not just economists who can contradict themselves in the same paper. Two pages later, we are reminded that, “[o]nly when an “act of production” explicitly or implicitly communicates facts or information otherwise protected by the Fifth Amendment privilege against testimonial self-incrimination – for example, if the existence and location of subpoenaed records are unknown to the Government, or where the mere act of production would authenticate the records – does the act of production fall within the scope and protection of the defendant’s Fifth Amendment privilege” (emphasis added).

This is from the second Boucher decision, the one that found for the state. In Boucher, the court held that the defendant’s prior behavior – allowing government agents to browse his computer, telling them what drive his images were in, and admitting laptop was his – made it impossible for him to latter claim he hadn’t made the computer’s contents known the the state and authenticated them. Davis is citing this approvingly, never mind what she said a few paragraphs earlier. Either the state needs the authenticated and decrypted drive contents for evidentary value and thus dismisses any issue that the same act of production is testimonial and/or incriminatory; or the state concedes that Fricosu has a legitimate 5th Amendment claim as producing the documents would authenticate them.

Don’t, however, stop here. Davis didn’t. One page later, we see, “The Boucher Court noted, however, that the Government could not make use of the target’s act of production to authenticate the unencrypted drive or its contents” (emphasis added).

Yes, dear readers, the great and sovereign state of Colorado seems to have just admitted that they know they can’t legally use Fricosu’s decryption of the drive to authenticate it despite having just based their argument for compelling the passphrase on the need to authenticate the damn thing.

So, to recap, the state has already contradicted itself by first saying it needs Fricosu to decrypt the drive in order to authenticate its contents and then approvingly citing precedent that the 5th Amendment holds if the mere act of providing something would authenticate it before admitting they actually can’t legally use Fricosu’s potential decryption to authenticate the drive or its contents.

In her response to the state’s application, Fricosu and her counsel make many of the same criticisms while also pointing out that the highly sought information – a passphrase – exists only in the defendant’s head.  There already exists, under Curcio, precedent that courts may not compel disclosure of the contents of someone’s mind.  At stake here is the sickeningly real possibility that something as intimate and seemingly sacrosanct as our own thoughts and memories are to be subject to warrants and subpoenas and the goddamn All Writ’s Act.  Are Constitutional protections now going to be trimmed down with each new advance in technology?

And what of whatever immunity Fricosu might get?  The state has been coy about what’s on the table.  But it’s almost certainly not going to be much.  The immunity that gets trotted out on every courtroom drama is Transactional Immunity.  Compelled testimony usually gets the far less expansive Use and Derivative Use Immunity, a guarantee that what you gave up under compulsion and whatever is derived from that won’t be sued against use.  Use and Derivative Use, however, by no means precludes facing charges on other evidence, perhaps itself compelled from someone else.  Nor does it mean you’ll even get that much.  In Hubbell, the court tried to bring criminal charges using evidence the defendant had turned over, arguing that the immunity was for turning over documents, not for anything found in the actual documents.  That trick didn’t work, but prosecutors still aren’t above trying it again.

In legal circles, finding oneself in this predicament is term the “cruel trilemma”: you will either self-incriminate, perjure yourself, or commit contempt of court.  How’d ya like them apples?

Defendants and witnesses left in such a position might, obviously, prefer not to take a watered down immunity and instead invoke the 5th across the broad.  While it’s a lovely idea, Kastiger allows the courts to offer Use and Derivative Use Immunity whether or not someone wants it and compel testimony, having made the 5th Amendment moot by taking the legal threat off the table to a certain extent.  Civil rights advocates have certainly argued that the value people lose when their 5th Amendment rights vanish  is rarely ever matched by the immunity they get; they’ve also argued that the Bill of Rights is not something the state may now give, now take away, now replace with a poor consolation prize of its choosing.  To date, though, the decision stands.

Fricosu’s response also gets in on the sophistry, pointing our that the warrant allowed the states the search the computer’s hard drive, which they have done.  Nowhere did the warrant say they had a right to search it to any extent or that Fricosu was compelled to assist in any way.  In part, if the state truly wants us to pretend that bullying a passphrase out of someone and subsequently going through their private files are entirely distinct acts, I suppose this is what they’ll get in return.  Do any of us truly want to be under the jurisdiction of people who maintain a straight face while holding forth on such hair splitting facts?

If any of this is a joke, then the state, responding to the response, didn’t get it.  They argue that having a warrant to search a computer implies full access, however they must get it.  There is a certain one-sidedness is holding that the state’s privileges have implied power while citizens’ rights, as in the case of supposed protection against self-incrimination so convoluted as to be useless, don’t.

When the Fricosu decision comes, an appeal is more or less a given.  Obama wants the case to go further as he’d very like a precedent that the 5th Amendment provides no protection against turning over incriminatory, encrypted documents.  And that is a blood-chilling idea.

Comments