Give Me Your Password Because Congress Can Say So: An Analysis of Fifth Amendment Protection Afforded Individuals Regarding Compelled Production of Encrypted Data and Possible Solutions to the Problem of Getting Data from Someone's Mind
Michael Wachtel
14
PGH. J. Tech. L. & Pol'y 44 (Fall 2013)
INTRODUCTION
In the summer of 2009, Federal Bureau of Investigation (FBI) agents compelled Google Inc. to disclose a wealth of incriminating documents from a suspect's Google Docs account. 1 The suspects, "Levi Beers and Chris de Diego, [were] the alleged operators of a firm called Pulse Marketing." 2 They were suspected of launching a deceptive email marketing campaign, "spamming" millions of users with information regarding a diet supplement. 3 The suspects were shocked to find out that their documents were not secured or protected, because they thought Google, the company providing electronic document storage services, had a duty to maintain its customers' privacy. 4 The FBI was not only able to compel Google to release information; it did so without having to show probable cause. 5 Instead the FBI needed to establish the lower "reasonable ground" standard to obtain the information. 6 The government is able to obtain documents from a third-party storage, or email provider, under the 1986 Stored Communications Act (SCA). 7 The SCA enables the government to access a customer's data whenever there are "reasonable grounds" to believe that the information would be relevant in a criminal investigation. 8 In addition to Google, other third-party storage providers have admitted that government compulsion of a customer's data would be possible even if the data is encrypted by the third-party provider. 9 A spokesperson for Dropbox Inc., a corporation that provides the extremely popular online storage system, explained that "like most online services, we have a small number of employees who must be able to access user data for the reasons stated in our privacy policy (e.g., when legally required to do so)." 10 Thus, companies like Google and Dropbox Inc. will not protect their customers' files against government intrusion. 11 However, what about individuals who encrypt and store their files in personal storage systems, such as a computer?
Today, personal computers are in many respects akin to a safe: they are used to protect documents and files that the owner wishes to remain private. Why else would a person utilize password based encryption tools on their computer if they were not trying to keep it private? Although the Fourth Amendment ensures that citizens are protected against unlawful searches and seizures, it also permits the government to seize a person's computer if they have "probable cause" to do so. 12 In light of this, an interesting issue arises when the hard drive of a lawfully seized computer is protected by software or an operating system, which cannot be cracked by the respective law enforcement's forensic unit. This issue was addressed in In re Grand Jury Subpoena Tecum Dated March 25, 2011 (United States v. Doe) (Doe IV), where the forensic detective was unable to decrypt a suspect's seized laptop. 13 The Court of Appeals for the Eleventh Circuit declared that compelling the defendant to relinquish his password in order for the state to decrypt his files was unconstitutional, and violated his Fifth Amendment right against selfincrimination. 14
This Note addresses how courts currently view the government's attempted compulsion of a defendant's password and encryption keys, and whether the government's use of this information to decrypt the defendant's device triggers the defendant's Fifth Amendment right against self-incrimination. Additionally, this Note analyzes the suggested solutions for how to deal with password-encrypted data in a trial setting, and recommends a legislative solution. Part I provides background information regarding encryption technology, and how the technology creates an evidence collection problem for the state's case in chief. Part II addresses whether password compulsion is violative of the Fifth Amendment under stare decisis, and how the forgone conclusion doctrine relates to evidence that might be protected by a defendant's Fifth Amendment privilege. Part III analyzes the pros and cons of current and suggested ways of overcoming Fifth Amendment protection that were granted based on the privilege clause against self-incrimination. Finally, this Note addresses the following issue: whether legislation dealing with the encryption problem would pass constitutional muster and, if so, whether it could offer a viable solution to the Fifth Amendment privilege against self-incrimination that passwords create.
Full Article:
http://tlp.law.pitt.edu/ojs/index.php/t ... e/view/132