Compelling Access To Encrypted Information (Part III)

Eleventh Circuit reverses order compelling production of unencrypted computer contents after holding that the “decryption and production of the hard drives’ contents would trigger Fifth Amendment protection because it would be testimonial, and that such protection would extend to the Government’s use of the drives’ contents”; the circuit also distinguishes two recent district court rulings in which production was compelled, in In Re: Grand Jury Subpoena Duces Tecum Dated March 25, 2011 (Doe v. United States), 670 F.3d 1335 (11th Cir. Feb. 23, 2012) (Nos. 11-12268, 11-15421)

Very few cases have addressed the issue when the government may compel an individual to decrypt an encrypted computer. We noted last month’s decision from the U.S. District Court for the District of Colorado in which the court granted a government application under the All Writs Act to provide the government “with an unencrypted copy of” a hard drive which was seized from the defendant. See Compelling Access To Encrypted Information (Part II). Last week, the Tenth Circuit declined to consider an interlocutory appeal of the district court ruling. See Fricosu v. United States, _ F.3d _ (10th Cir. Feb. 21, 2012) (No. 12-701) ("[W]e also note that even if the petition was construed as a notice of appeal, this court would lack jurisdiction to consider the resulting proceeding under any exception to our usual finality rules. See Cohen v. Beneficial Indus. Loan Corp., 337 U.S. 541 (1949)."). Now the Eleventh Circuit has issued a significant opinion examining the issue.

District Court Proceedings

During an investigation concerning the sharing of child pornography, law enforcement officials executed a search warrant at a California hotel after linking particular internet protocol addresses. Two laptops and five external hard drives were seized. Forensic examiners were unable to access encrypted portions of the hard drives.

On April 7, 2011, a grand jury subpoena was served on individual “Doe” for the production of “the ‘unencrypted contents’ of the digital media, and ‘any and all containers or folders thereon.’” Doe, 670 F.3d at 1339. Doe asserted his Fifth Amendment privilege against self-incrimination. The U.S. Attorney requested limited act-of-production immunity pursuant to 18 U.S.C. §§ 6002, 6003.

In granting the request, the district court noted that its order “convey[ed] immunity for the act of production of the unencrypted drives, but [did] not convey immunity regarding the United States’ [derivative] use” of the decrypted hard drive contents. Doe, 670 F.3d at 1338. With the limited immunity order, Doe returned to the grand jury and again refused to comply. The government moved for an order for Doe to show cause why he should not be held in civil contempt.

At the April 19, 2011 show cause hearing, Doe contended he was not protected from the derivative use of his grand jury testimony and he may not be able to decrypt the hard drives. The court heard from a forensic examiner who testified that he determined that the software program “TrueCrypt” had been used to encrypt the hard drives. While no files could be located, the examiner “believed that data existed on the still-encrypted parts of the hard drive.” However, on cross-examination, the examiner admitted that “it was possible that the hard drives contain nothing.” The examiner was questioned whether “random data is just random data,” and responded that “anything is possible.” Doe, 670 F.3d at 1340. The district court initially held Doe in criminal contempt but revised the order to hold him in civil contempt. On April 21, 2011, Doe appeared before the grand jury and refused to provide the unencrypted contents of the hard drives. He was incarcerated until December 15, 2011 when the Eleventh Circuit ordered him released after hearng oral argument on his appeal. Doe, 670 F.3d at 1340 n.12.

Reversal On Appellate Review

The Eleventh Circuit reversed the civil judgment of contempt after concluding Doe validly asserted a Fifth Amendment claim. As the circuit summarized:

[W]e hold that Doe’s decryption and production of the hard drives’ contents would trigger Fifth Amendment protection because it would be testimonial, and that such protection would extend to the Government’s use of the drives’ contents. The district court therefore erred in two respects. First, it erred in concluding that Doe’s act of decryption and production would not constitute testimony. Second, in granting Doe immunity, it erred in limiting his immunity, under 18 U.S.C. §§ 6002 and 6003, to the Government’s use of his act of decryption and production, but allowing the Government derivative use of the evidence such act disclosed.

Doe, 670 F.3d at 1341.

The circuit noted that three elements applied to establish Fifth Amendment protection: “(1) compulsion, (2) a testimonial communication or act, and (3) incrimination.” Doe, 670 F.3d at 1341 (citing United States v. Ghidoni, 732 F.2d 814, 816 (11th Cir. 1984) (citing United States v. Authement, 607 F.2d 1129, 1131 (5th Cir. 1979) (per curiam))). The circuit noted a government concession that the first and third elements were met. The circuit then concluded that production was tantamount to a testimonial communication under the Fifth Amendment. As the circuit framed the issue:

Whether the drives’ contents are testimonial, however, is not the issue. What is at issue is whether the act of production may have some testimonial quality sufficient to trigger Fifth Amendment protection when the production explicitly or implicitly conveys some statement of fact. See Fisher v. United States, 425 U.S. 391, 410 (1976) (“The act of producing evidence in response to a subpoena nevertheless has communicative aspects of its own, wholly aside from the contents of the papers produced.”).

Doe, 670 F.3d at 1342. In addressing this issue, the circuit noted two key established parameters under Fifth Amendment jurisprudence. First,

Where the location, existence, and authenticity of the purported evidence is known with reasonable particularity, the contents of the individual’s mind are not used against him, and therefore no Fifth Amendment protection is available.

Doe, 670 F.3d at 1344 (footnotes omitted) (relying on Fisher, 425 U.S. at 411 (holding that the Fifth Amendment did not bar the production of taxpayer records where the “existence and location of the papers are a foregone conclusion”)). However, at a second jurisprudential point under Fifth Amendment case law, the act of production may be protected by the Fifth Amendment privilege where “knowledge of the implicit testimonial facts associated with his act of production was not a foregone conclusion.” Doe, 670 F.3d at 1344 (relying on United States v. Hubbell, 530 U.S. 27, 35–36 (2000) (during investigation involving the activities of Whitewater Development Corporation, grand jury subpoenaed documents were protected by the Fifth Amendment privilege since the act of production was testimonial and the foregone conclusion doctrine did not apply)). As the circuit explained these parameters:

In Fisher, therefore, the act of production was not testimonial because the Government had knowledge of each fact that had the potential of being testimonial. As a contrast, the Court in Hubbell found there was testimony in the production of the documents since the Government had no knowledge of the existence of documents, other than a suspicion that documents likely existed and, if they did exist, that they would fall within the broad categories requested.
…
Put another way, the Court has marked out two ways in which an act of production is not testimonial. First, the Fifth Amendment privilege is not triggered where the Government merely compels some physical act, i.e. where the individual is not called upon to make use of the contents of his or her mind. The most famous example is the key to the lock of a strongbox containing documents, see Hubbell, 530 U.S. at 43 (citing Doe v. United States, 487 U.S. 201, 210 n.9 (1988)), but the Court has also used this rationale in a variety of other contexts. Second, under the “foregone conclusion” doctrine, an act of production is not testimonial—even if the act conveys a fact regarding the existence or location, possession, or authenticity of the subpoenaed materials—if the Government can show with “reasonable particularity” that, at the time it sought to compel the act of production, it already knew of the materials, thereby making any testimonial aspect a “foregone conclusion.”

Doe, 670 F.3d at 1346 (footnotes omitted).

The Eleventh Circuit also joined with the D.C. and Ninth Circuit in adopting a “reasonable particularity” standard under the “foregone conclusion” doctrine:

United States v. Ponds, 454 F.3d 313, 320–21 (D.C. Cir. 2006) (“Although the Supreme Court did not adopt the "reasonable particularity" standard in affirming our decision, it emphasized that the applicability of the Fifth Amendment turns on the level of the government's prior knowledge of the existence and location of the produced documents.”) (joining Ninth Circuit in In re Grand Jury Subpoena, Dated April 18, 2003)
In re Grand Jury Subpoena, Dated April 18, 2003, 383 F.3d 905, 910 (9th Cir. 2004) (“The government was not required to have actual knowledge of the existence and location of each and every responsive document; the government was required, however, to establish the existence of the documents sought and Doe's possession of them with ‘reasonable particularity’ before the existence and possession of the documents could be considered a foregone conclusion and production therefore would not be testimonial.”)

The Eleventh Circuit concluded the facts of the case were closer to Hubbell rather than Fisher:

In short, we conclude that Doe would certainly use the contents of his mind to incriminate himself or lead the Government to evidence that would incriminate him if he complied with the district court’s order. Moreover, the Government has failed to show any basis, let alone shown a basis with reasonable particularity, for its belief that encrypted files exist on the drives, that Doe has access to those files, or that he is capable of decrypting the files. The “foregone conclusion” doctrine does not apply under these facts. [¶] The Fifth Amendment protects Doe’s refusal to decrypt and produce the contents of the media devices because the act of decryption and production would be testimonial, and because the Government cannot show that the “foregone conclusion” doctrine applies.

Doe, 670 F.3d at 1349.

The circuit clarified its view of the type of showing that the government would have to satisfy:

To be clear, the Government does not have to show that it knows specific file names. Knowledge of a file name, like the Government had in Boucher, would be an easy way for the Government to carry its burden of showing that the existence of the files it seeks is a “foregone conclusion.” That said, if the Government is unaware of a particular file name, it still must show with some reasonable particularity that it seeks a certain file and is aware, based on other information, that (1) the file exists in some specified location, (2) the file is possessed by the target of the subpoena, and (3) the file is authentic. See United States v. Norwood, 420 F.3d 888, 895–96 (8th Cir. 2005) (applying “foregone conclusion” doctrine even though the Government could not identify a specific bank account because the Government was able to prove the name and location of the entity that created the records, introduced payment card numbers, and produced the details of transactions involving the account). Thus, although the Government need not know the name of a particular file or account, it still must be able to establish that a file or account, whatever its label, does in fact exist. Here, the Government was unable to do that.

Doe, 670 F.3d at 1349 n.28.

Distinguishing Recent Cases

The circuit also distinguished two recent district court cases in which the individual was compelled to provide access to decrypted hard drives. In both cases, the government had knowledge particular files. For example, while the case of In re Grand Jury Subpoena to Sebastien Boucher (D.Vt. Feb. 19, 2009) (No. 2:06-mj-91) (known as "Boucher II"), “did not turn on the fact that the Government knew the contents of the file it sought,” the government was able to show its knowledge of the name of a particular file (“2yo getting raped during diaper change”). Doe, 670 F.3d at 1348. In the second case decided last month, United States v. Ramona Camelia Fricosu (D.CO. Jan. 23, 2012) (No. 10-CR-00509-REB), the government was aware of that the content in issue existed on a seized hard drive based on a recorded call by the defendant.

Finally, the circuit concluded that the act of production immunity was not adequate to compel production. As the circuit noted:

[T]he Government cannot obtain immunity only for the act of production and then seek to introduce the contents of the production, regardless of whether those contents are characterized as nontestimonial evidence, because doing so would allow the use of evidence derived from the original testimonial statement.
…
To conclude, because Doe’s act of production would have testimonial aspects to it, an order to compel him to produce the unencrypted contents of the drives would require immunity coextensive with the Fifth Amendment (and § 6002). Immunity coextensive with the Fifth Amendment requires both use and derivative-use immunity. The Government’s offer of act-of-production immunity clearly could not provide the requisite protection because it would allow the Government to use evidence derived from the immunized testimony. Thus, because the immunity offered here was not coextensive with the Fifth Amendment, Doe could not be compelled to decrypt the drives.

Doe, 670 F.3d at 1352 (footnote omitted).

The courts are beginning to address the application of the Fifth Amendment privilege to encrypted data. Three recent cases highlight the importance of the government demonstrating knowledge of the existence of the requested records. As theDoe case suggests, even where the government is aware of the existence of information on a hard drive, the government may need to satisfy a “reasonable particularity” standard.

______________________________