Compelling Access To Encrypted Information (Part I)

Fifth Amendment Privilege was not violated by compelling the defendant to provide an unencrypted version of his laptop drive containing suspected child pornography to the government, in In re Grand Jury Subpoena to Sebastien Boucher (D.Vt. Feb. 19, 2009) (No. 2:06-mj-91) (2009 WL 424718) ("Boucher II")

Can the government compel an individual to provide a password to examine the encrypted contents of a seized computer hard drive? Initially, a magistrate judge concluded the Fifth Amendment barred the government from compelling this information. See In re Grand Jury Subpoena to Sebastien Boucher (D.Vt. Nov 29, 2007) (No. 2:06-MJ-91) (2007 WL 4246473) ("Boucher I") Recently, Chief District Court Judge William K. Sessions, III, of the District of Vermont, overruled the initial ruling and sustained the government’s appeal.

In the case, as Boucher entered into the United States from the Canadian border, an inspector searched his laptop computer and discovered images of suspected child pornography. After waiving his Miranda rights, Boucher told an agent that he downloaded pornographic files. When the agent asked him to show him the downloaded files, Boucher referred him to the Z drive. The agent reviewed videos and images which appeared to be child pornography. Boucher indicated that he did not intentionally download child pornography and deleted these images when he came across them. Boucher was arrested for transporting child pornography. His laptop was seized. After obtaining a search warrant, the government learned that the Z drive was encrypted. A grand jury subpoena was issued for Boucher to provide the password requesting:

all documents, whether in electronic or paper form, reflecting any passwords used or associated with the Alienware Notebook Computer, Model D9T, Serial No. NKD900TA5L00859, seized from Sebastien Boucher at the Port of Entry at Derby Line, Vermont on December 17, 2006.
Boucher I, at 2.

Boucher moved to quash the subpoena asserting Fifth Amendment right against self-incrimination. After an evidentiary hearing, Magistrate Judge Jerome J. Niedermeier granted the motion to quash and concluded that directing Boucher to enter the password was testimonial and therefore privileged. The judge noted:

Entering a password into the computer implicitly communicates facts. By entering the password Boucher would be disclosing the fact that he knows the password and has control over the files on drive Z. The procedure is equivalent to asking Boucher, ‘Do you know the password to the laptop?’ If Boucher does know the password, he would be faced with the forbidden trilemma; incriminate himself, lie under oath, or find himself in contempt of court.
Boucher I at 3.

After the Magistrate Judge ruling, the government narrowed the request for production of an unencrypted version of the Z drive. Since the government was aware of the existence and location of the information during the border examination, the information was not testimonial. As the district court explained:

Boucher accessed the Z drive of his laptop at the ICE agent's request. The ICE agent viewed the contents of some of the Z drive's files, and ascertained that they may consist of images or videos of child pornography. The Government thus knows of the existence and location of the Z drive and its files. Again providing access to the unencrypted Z drive ‘adds little or nothing to the sum total of the Government's information’ about the existence and location of files that may contain incriminating information…. Boucher is directed to provide an unencrypted version of the Z drive viewed by the ICE agent. The Government may not make use of Boucher's act of production to authenticate the unencrypted Z drive or its contents either before the grand jury or a petit jury.
Boucher II, at 3 (quoting Fisher v. United States, 425 U.S. 391, 4011(1976))).

The district court noted that “no ruling on whether the Government can in fact authenticate the unencrypted Z drive or its contents, including images not viewed by the ICE agent during the initial search.” Boucher II at 4, n.2. An appeal has been filed with the Second Circuit.

While the issue was narrowed before the district court, it remains as a matter of first impression in most of the country. The issue is likely to arise under more challenging facts presenting the question whether the government can compel the production of a password for encrypted files where the government is unaware of the contents. The key in any cases presenting the question will turn on whether the password, or the act of production of the information, is deemed to be “testimonial” under the Fifth Amendment. See, e.g., United States v. Doe, 465 U.S. 605, 612 (1984) (“Doe I”) (“Although the contents of a document may not be privileged, the act of producing the document may be.”); see also United States v. Hubbell, 530 U.S. 27, 36 (2000) (“‘The act of production’ itself may implicitly communicate ‘statements of fact.’ By ‘producing documents in compliance with a subpoena, the witness would admit that the papers existed, were in his possession or control, and were authentic.’”) (quoting Doe v. United States, 487 U.S. 201, 209 (1988) (“Doe II”)); Hubbell, 530 U.S. at 38 (“Compelled testimony that communicates information that may ‘lead to incriminating evidence’ is privileged even if the information itself is not inculpatory.”) (quoting Doe II, 487 U.S. at 208, n.6).

Federal Rules of Evidence