TechLaw: Boucher Court: No Right to Refuse to Produce Encrypted Data

February 24, 2009
Boucher Court: No Right to Refuse to Produce Encrypted Data

Late last week a federal court in Vermont decided that a criminal defendant’s compelled act of producing unencrypted contents of an encrypted laptop is not protected by the Fifth Amendment’s privilege against compelled self-incrimination. The closely watched case of United States v. Boucher is a throwback to cyberlaw’s Cryptozoic Era, the days of Clipper Chip, CALEA, United States v. Bernstein, the shadowy legal status of PGP, and crypto export regs. The court’s resolution of this issue is not going to satisfy everyone, especially persons who believe that encrypting their laptops is a good protection against suspicionless border searches.

However, the court’s ruling neatly solves the government’s problem with gaining access to the growing amount of encrypted data the is being created in response to privacy, data breach, and identity theft concerns. As I read this opinion, so long as the government has a general idea of what might be hidden among the encrypted data, and it can point at the computer housing it, there is no Fifth Amendment impediment to a demand for production of that data in an unencrypted format.

Following his arrest for transportation of child pornography and seizure of the laptop containing the evidence against him, Boucher claimed that his refusal to tell police the password protecting an encrypted portion of the laptop’s hard drive is protected by the Fifth Amendment’s privilege against compelled self-incrimination.

A magistrate judge agreed with Boucher in United States v. Boucher, No. 2:06-mj-91 (D. Vt. Nov. 29, 2007), and it quashed a grand jury subpoena directing Boucher to divulge the password. The magistrate concluded that the act of entering the laptop password was a testimonial act under the privilege. The legal ins and outs of the case are dissected by Prof. Orin Kerr in this Volokh Conspiracy post, and I commend anyone who wants to understand this area of the law better to go there and read it.

Last week, the district court reversed that ruling, though ‘reversed’ is probably not the correct word, since the district court decided a slightly different issue than the magistrate. This is because, on appeal, the government changed its legal approach to the case. Rather than demanding that Boucher give authorities his password, it instead demanded that Boucher turn over the contents of his encrypted hard drive in an unencrypted format. Looking at the case this way, the district court decided that the Fifth Amendment did not give Boucher a constitutional right to refuse.

Any evidence of child pornography on the defendant’s laptop is not protected by the Fifth Amendment because this evidence was voluntarily created by the defendant. The question faced by the district court was whether the act of producing the contents of the laptop was itself a compelled communication of incriminating facts. Courts have held that compelled production of incriminating documents would not violate the Fifth Amendment in two situations: (1) if the existence and location of the evidence was previously unknown to the police or (2) if the act of production would implicitly authenticate the evidence. The district court decided that neither circumstance was present in this case. The government already knew that unencrypted portions of the laptop’s hard drive contained child pornography. And, as for the second circumstance, the government promised the court that it would not use Boucher’s act of producing the contents of the laptop to prove that the child pornography it contained belonged to him.

The court said that the encrypted portions of Boucher’s laptop were similar to the daily calendar at issue in In re Grand Jury Subpoena, 1 F3d 87 (2d Cir. 1993). In that case, the government subpoenaed the original of the defendant’s daily calendar, at a time when it already had a copy of that document. The Second Circuit ruled that the Fifth Amendment would not be violated by compelling production of the original, since the existence and location of the calendar were a foregone conclusion and the defendant had already testified about his possession and use of it.

The court reasoned that the compelling Boucher to produce the vast expanse of unknown, encrypted data on his laptop ‘adds little or nothing to the sum total of the Government’s information’ (quoting the Supreme Court’s opinion in Fisher v. United States, 425 U.S. 391 (1976) about him, so it was not therefore protected by the Fifth Amendment privilege. No doubt many will find this to be a weak spot in the court’s opinion. The Second Circuit may weigh in too; the defendant has already filed an interlocutory appeal to that court.

The decision can be accessed here as a PDF file.

Posted by Thomas O’Toole on February 24, 2009