Thoughts, essays, and writings on Liberty. Written by the heirs of Patrick Henry.

“Free speech, exercised both individually and through a free press, is a necessity in any country where people are themselves free.”     Theodore Roosevelt

January 17, 2008

Can The Government Force You To Reveal A Password ?

by Doug Mataconis

That’s the interesting legal question posed by a case out of Vermont:

The federal government is asking a U.S. District Court in Vermont to order a man to type a password that would unlock files on his computer, despite his claim that doing so would constitute self-incrimination.

The case, believed to be the first of its kind to reach this level, raises a uniquely digital-age question about how to balance privacy and civil liberties against the government’s responsibility to protect the public.

From a Constitutional perspective, there are two parts of the Bill of Rights that are at issue, the Fourth Amendment:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

And the Fifth Amendment:

No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.

Seizing someone’s computer, assuming that it is supported by a warrant based on probable cause, is clearly permissible. But what if you need an unbreakable password to access what may be incriminating evidence (in this case, child pornography) ?

Clearly, the Fifth Amendment permits a suspect to remain silent, and revealing a password (assuming it’s not written down somewhere on a piece of paper subject to seizure) would clearly seem to be testimony. And that’s what one Federal District Court Judge has ruled:

On Nov. 29, Magistrate Judge Jerome J. Niedermeier ruled that compelling Sebastien Boucher, a 30-year-old drywall installer who lives in Vermont, to enter his password into his laptop would violate his Fifth Amendment right against self-incrimination. “If Boucher does know the password, he would be faced with the forbidden trilemma: incriminate himself, lie under oath, or find himself in contempt of court,” the judge said.

Now, here are the facts of the case:

The case began Dec. 17, 2006, when Boucher, a Canadian citizen with legal residency in the United States, was driving from Canada into Vermont when he was stopped at the border by a U.S. Customs and Border Protection inspector. The inspector searched Boucher’s car and found a laptop in the back seat, according to an affidavit filed with the court by Mark Curtis, a special agent with Immigration and Customs Enforcement who was called in by the inspector.

Boucher said the laptop was his, according to the affidavit. When the inspector saw files with titles such as “Two-year-old being raped during diaper change,” he asked Boucher if the laptop contained child pornography. Boucher said he did not know because he was not able to check his temporary Internet files, according to the affidavit.

Curtis asked Boucher “to use the computer” to show him the files he downloads. Curtis reviewed the video files, observing one that appeared to be a preteen undressing and performing a sexual act, among other graphic images, the affidavit says.

Boucher was arrested and charged with transportation of child pornography in interstate or foreign commerce, which can carry a sentence of up to 20 years in prison for a first offense.

Keep in mind that in some versions of the story I’ve read online, Boucher was said to have typed in the PGP password prior to showing the files to the Border Patrol agents. And that, it seems, could be his downfall:

Orin S. Kerr, an expert in computer crime law at George Washington University, said that Boucher lost his Fifth Amendment privilege when he admitted that it was his computer and that he stored images in the encrypted part of the hard drive. “If you admit something to the government, you give up the right against self-incrimination later on,” said Kerr, a former federal prosecutor.

Kerr has blogged about the case at The Volokh Conspiracy and said the following:

I don’t play in the sandbox of the Fifth Amendment as much as I do the Fourth, but my sense is that Judge Niedermeier is wrong. True, being forced to enter in the password has a communicative aspect to it. It says, “I know the password to drive Z on my laptop.” But based on the specific facts of the case, don’t we already know that? Isn’t it a “foregone conclusion” under the Fisher case? Boucher admitted that it was his laptop, and he described how he used it. When he agreed to show the officers the files inside, he had no problem powering it up and bringing them to the contents of drive Z. The subpoena is simply trying to get Boucher to take the officers back to where he had already taken them before: through the passphrase so they can access the files Judge Niedermier’s response is that this is true for the child pornography the agents saw but that there may be other files on the computer that are also incriminating. Entering in the key will be akin to producing any other files that might exist, effectively saying, “these are files on my laptop.” But I think that’s wrong. As I see it, entering the passphrase doesn’t have any testimonial content as to Boucher’s knowledge or beliefs as to any other files in “drive Z” that may or may not exist. Maybe there are other incriminating files in drive Z. On the other hand, maybe there aren’t. But the answer to that is completely independent of what Boucher is being asked to do

It may be that entering in the passphrase will help the police find more child pornography, but that is not the result of the communicative aspect of responding to the subpoena. Boucher’s entering in the password won’t amount to Boucher’s testimony about anything they don’t already know in the context of this case. Its role is merely that it will let the police access whatever is on the hard drive, which may or may not relate to criminal activity and may or may not implicate Boucher. Boucher won’t be “bringing” the files to the police in response to an order to incriminating files; he ill merely be opening the door to the safe that we all know is his and that we seem to know he knows how to open.

I think Kerr is right on this issue. In the abstract, Boucher has a right to remain silent about the password to his files. His problem lies in the fact that he has already revealed the existence of the encrypted files, allowed the agent to view them (apparently using the password to do so), and admitted the computer was his.

TrackBack URI: http://www.thelibertypapers.org/2008/01/17/can-the-government-force-you-to-reveal-a-password/trackback/
Read more posts from
• • •

14 Comments

  1. If it were something else other than child porn I might agree with the defendant but as far as child porn goes, I can’t agree.

    Comment by TheAmericanLie — January 17, 2008 @ 5:05 am
  2. Yes, but the thing is that the Constitution doesn’t contain exceptions based on the type of offense at issue.

    Comment by Doug Mataconis — January 17, 2008 @ 6:20 am
  3. Nor should it. You should punish the abhorrence level of the crimes with the sentencing, not with how you catch the crook.

    Comment by UCrawford — January 17, 2008 @ 6:34 am
  4. Doug,

    I cannot agree with you.

    Ownership is irrelevant to the question of self-incrimination. Ownership of the computer can be established by matching the serial code of the computer against manufacturer sales records. Plus, it was in his possession, and he attested that it was his.

    Imagine I’m suspected of a crime and I have a conversation with a police officer wherein I reveal information that indicates I may be guilty, but when asked later, he can’t remember just what I said and has no tangible record of the conversation. The court wants to use this information to prosecute me, but because he cannot remember the details, the court has issued a subpoena requiring me to restate what I originally said for the record.

    Must I repeat the conversation and incriminate myself?

    I don’t understand how you’ve come to the conclusion that certain factors, like him having previously accessed the files, now causes him to forfeit his right to not incriminate himself.

    One other thing: he showed the agent the files before he was arrested, and thus, before he was Mirandized. Once read his rights, he is now choosing to exercise them. Does the timeline matter to you?

    Comment by Brian T. Traylor — January 17, 2008 @ 7:26 am
  5. Brian,

    These are the facts:

    1. He acknowledged to law enforcement officers that the computer was his. Under the Fifth Amendment he could have refused to answer.

    2. He accessed encrypted files, presumably by using the password and allowed the l.e.o’s to look at them.

    It’s a fairly standard rule that the privilege against self-incrimination can be voluntarily waived and, inexplicably, criminal suspects often do it in situations where the smartest thing to do would be to shut the heck up.

    Under the waiver law that exists, a fairly good case can be made that this guy waived his right against self-incrimination.

    Comment by Doug Mataconis — January 17, 2008 @ 7:31 am
  6. One other thing: he showed the agent the files before he was arrested, and thus, before he was Mirandized. Once read his rights, he is now choosing to exercise them. Does the timeline matter to you?

    No, because there was no probable cause to arrest him until he showed them the incriminating files.

    Comment by Doug Mataconis — January 17, 2008 @ 7:32 am
  7. Under the waiver law that exists, a fairly good case can be made that this guy waived his right against self-incrimination.

    But does a single waiver constitute perpetual waivers? If I invite a cop into my home, does that mean he’s free to come back against my wishes?

    Comment by Jeff Molby — January 17, 2008 @ 8:46 am
  8. I think Jeff stated what I was trying to get at:

    Does a single waiver imply subsequent waivers? Can a suspect decide at any point in the process to shut up, or is he bound to keep talking (or provide the password again) after he’s opened his mouth once?

    Comment by Brian T. Traylor — January 17, 2008 @ 7:22 pm
  9. You know, I tend to be of the “literal words of the Constitution” bent. The 5th Amendment doesn’t say:

    nor shall be compelled in any criminal case to be a witness against himself, except when he already said something against himself, in which case it is perfectly fine to compel him to be a witness

    Given the words in the Amendment, it seems to me that a person may stop talking at any point and the State has no more Constitutional ability to compel anything. It seems to me that this would include providing a password to his encryption software.

    If the State cannot make its case without compelling this guy to provide information that can be used to incriminate him, then it cannot make its case.

    Comment by Adam Selene — January 17, 2008 @ 8:17 pm
  10. [...] at the Liberty Papers has an interesting overview of a case that’s getting some attention in constitutionalist circles, that being, can you be [...]

    Pingback by The Crossed Pond » The 5th Amendment in the Information Age — January 18, 2008 @ 11:37 am
  11. Doug, you might want to check out this Computerworld article. It has some additional details, including:

    A special agent who had experience and training in identifying child pornography was then called in to inspect Boucher’s computer. That inspection revealed several images of adult and animated child pornography. But when the special agent tried to click on the file with the name suggesting child pornography, he found he was unable to open it.

    So, law enforcement never actually saw any images, only the names of the images. The names weren’t good, obviously, but that doesn’t mean that the images were actually child pornography. At this point Boucher hasn’t revealed anything incriminating, has he?

    When asked about the file, Boucher stated that he visited various newsgroups from which he downloaded pornographic images. He conceded that some of the files might unknowingly be child porn but added that he deleted those files when he saw them.

    So, he’s saying that the files could be there accidentally, which is technically possible if you use a news reader and set it up to download all the images in a newsgroup at a given time. He is also saying that he deleted any files that he became aware of that were illegal. Is there anything there to incriminate him from a legal perspective?

    Now, if law enforcement gains access to those files, they can perform technical forensics on them to prove, or disprove, his story. They can only do so if they can decrypt the files and folders that are encrypted. By providing them with the password to perform the decryption he is giving them access to evidence that is potentially incriminating. That seems to violate the 5th amendment, since he has never done that in the past.

    Comment by Adam Selene — January 18, 2008 @ 12:42 pm
  12. So, law enforcement never actually saw any images, only the names of the images. The names weren’t good, obviously, but that doesn’t mean that the images were actually child pornography. At this point Boucher hasn’t revealed anything incriminating, has he?

    I don’t know. The Times article and Kerr’s article both say that the officers did view at least one video file that could be described as child pornography.

    So, he’s saying that the files could be there accidentally, which is technically possible if you use a news reader and set it up to download all the images in a newsgroup at a given time. He is also saying that he deleted any files that he became aware of that were illegal. Is there anything there to incriminate him from a legal perspective?

    It would depend on what the statute he was being charaged under said about intent.

    Comment by Doug Mataconis — January 18, 2008 @ 12:58 pm
  13. Still, it doesn’t look to me like Boucher had previously incriminated himself. And, even if he had, why is forced to continue? That isn’t what the 5th Amendment says.

    Comment by Adam Selene — January 18, 2008 @ 8:11 pm
  14. let us remember that the constitution was created so that the government had boundaries in which it must play. to chip away at the boundaries is to destroy “we the people.” as several people have stated, the 5th amendment does not say that once you start to speak you are compelled to continue, so even if he did type in the password before, he did not do it in a way so that the agents could view it, nor did he write it down. it is locked in his head and that’s where it gets to stay.

    Comment by Daniel Schlotte — January 19, 2008 @ 7:43 pm

Comments RSS

Subscribe without commenting

Sorry, the comment form is closed at this time.

Powered by: WordPress • Template by: Eric • Banner #1, #3, #4 by Stephen Macklin • Banner #2 by Mark RaynerXML