The Liberty Papers

That’s the interesting legal question posed by a case out of Vermont:

The federal government is asking a U.S. District Court in Vermont to order a man to type a password that would unlock files on his computer, despite his claim that doing so would constitute self-incrimination.

The case, believed to be the first of its kind to reach this level, raises a uniquely digital-age question about how to balance privacy and civil liberties against the government’s responsibility to protect the public.

From a Constitutional perspective, there are two parts of the Bill of Rights that are at issue, the Fourth Amendment:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

And the Fifth Amendment:

No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.

Seizing someone’s computer, assuming that it is supported by a warrant based on probable cause, is clearly permissible. But what if you need an unbreakable password to access what may be incriminating evidence (in this case, child pornography) ?

Clearly, the Fifth Amendment permits a suspect to remain silent, and revealing a password (assuming it’s not written down somewhere on a piece of paper subject to seizure) would clearly seem to be testimony. And that’s what one Federal District Court Judge has ruled:

On Nov. 29, Magistrate Judge Jerome J. Niedermeier ruled that compelling Sebastien Boucher, a 30-year-old drywall installer who lives in Vermont, to enter his password into his laptop would violate his Fifth Amendment right against self-incrimination. “If Boucher does know the password, he would be faced with the forbidden trilemma: incriminate himself, lie under oath, or find himself in contempt of court,” the judge said.

Now, here are the facts of the case:

The case began Dec. 17, 2006, when Boucher, a Canadian citizen with legal residency in the United States, was driving from Canada into Vermont when he was stopped at the border by a U.S. Customs and Border Protection inspector. The inspector searched Boucher’s car and found a laptop in the back seat, according to an affidavit filed with the court by Mark Curtis, a special agent with Immigration and Customs Enforcement who was called in by the inspector.

Boucher said the laptop was his, according to the affidavit. When the inspector saw files with titles such as “Two-year-old being raped during diaper change,” he asked Boucher if the laptop contained child pornography. Boucher said he did not know because he was not able to check his temporary Internet files, according to the affidavit. When you use your browser it saves a history of the websites you’ve visited, and the same is the case for any images downloaded onto a browser page whilst you’re perusing it, for example if you visited an adult website such as fulltube and images of an adult nature were downloaded in your browser during your visit to the site they would be automatically stored in your temporary internet files, although it’s perfectly legal to view adult pornography it is however illegal to view child pornography and any evidence of downloading or viewing of child pornography can be used as evidence in a case against you.

Curtis asked Boucher “to use the computer” to show him the files he downloads. Curtis reviewed the video files, observing one that appeared to be a preteen undressing and performing a sexual act, among other graphic images, the affidavit says. Had it simply been legal content from a site like sexm, that would have been fine, but it was not the case in this instance.

Boucher was arrested and charged with transportation of child pornography in interstate or foreign commerce, which can carry a sentence of up to 20 years in prison for a first offense.

Keep in mind that in some versions of the story I’ve read online, Boucher was said to have typed in the PGP password prior to showing the files to the Border Patrol agents. And that, it seems, could be his downfall:

Orin S. Kerr, an expert in computer crime law at George Washington University, said that Boucher lost his Fifth Amendment privilege when he admitted that it was his computer and that he stored images in the encrypted part of the hard drive. “If you admit something to the government, you give up the right against self-incrimination later on,” said Kerr, a former federal prosecutor.

Kerr has blogged about the case at The Volokh Conspiracy and said the following:

I don’t play in the sandbox of the Fifth Amendment as much as I do the Fourth, but my sense is that Judge Niedermeier is wrong. True, being forced to enter in the password has a communicative aspect to it. It says, “I know the password to drive Z on my laptop.” But based on the specific facts of the case, don’t we already know that? Isn’t it a “foregone conclusion” under the Fisher case? Boucher admitted that it was his laptop, and he described how he used it. When he agreed to show the officers the files inside, he had no problem powering it up and bringing them to the contents of drive Z. The subpoena is simply trying to get Boucher to take the officers back to where he had already taken them before: through the passphrase so they can access the files Judge Niedermier’s response is that this is true for the child pornography the agents saw but that there may be other files on the computer that are also incriminating. Entering in the key will be akin to producing any other files that might exist, effectively saying, “these are files on my laptop.” But I think that’s wrong. As I see it, entering the passphrase doesn’t have any testimonial content as to Boucher’s knowledge or beliefs as to any other files in “drive Z” that may or may not exist. Maybe there are other incriminating files in drive Z. On the other hand, maybe there aren’t. But the answer to that is completely independent of what Boucher is being asked to do

It may be that entering in the passphrase will help the police find more child pornography, but that is not the result of the communicative aspect of responding to the subpoena. Boucher’s entering in the password won’t amount to Boucher’s testimony about anything they don’t already know in the context of this case. Its role is merely that it will let the police access whatever is on the hard drive, which may or may not relate to criminal activity and may or may not implicate Boucher. Boucher won’t be “bringing” the files to the police in response to an order to incriminating files; he ill merely be opening the door to the safe that we all know is his and that we seem to know he knows how to open.

I think Kerr is right on this issue. In the abstract, Boucher has a right to remain silent about the password to his files. His problem lies in the fact that he has already revealed the existence of the encrypted files, allowed the agent to view them (apparently using the password to do so), and admitted the computer was his.