January 10, 2008

By Patrick Romero

A recent ruling has once again demonstrated how technology continues to challenge traditional legal frameworks leading to different court rulings. In a controversial case, a federal magistrate in Vermont held that the 5th Amendment’s right against self-incrimination protected a man charged with the transportation of child pornography.

Sebastian Boucher was arrested while crossing the border from Canada into the United States. Border agents stopped Boucher during a routine stop and began to look through his laptop, noticing several files with names indicating acts of child pornography in the Z: drive. When asked if there was any child pornography, Boucher claimed that he wasn’t sure since he downloaded pornography from online newsgroups and then transferred them onto his computer.

Border agents continued to search the drive and eventually were able to locate actual videos and pictures containing child pornography. They then placed Boucher under arrest and subsequently shut down the laptop. One week later, the government tried accessing the files only to realize that the Z: drive was encrypted with PGP(Pretty Good Security), thereby making it impossible to access the files without knowing the password. So can the government compel Boucher to give up the password in order to view the files on his computer?

Boucher’s attorneys argue that forcing their client to reveal the password is a violation of the 5th Amendment. Judge Jerome Niedermeier agreed, writing that disclosing the password would provide evidence to the government that could be used to incriminate Boucher in violation of his 5th Amendment rights. The 5th Amendment protects individuals from being forced to testify against themselves because their response could be self-incriminating. Supreme Court precedent holds that the Fifth Amendment privilege against self-incrimination doctrine “protects a person…against being incriminated by his own compelled testimonial communications.” The issue ultimately came down to whether compelling Boucher to disclose the password is a testimonial communication and therefore privileged under the United States Constitution.

Different Tests to Use

Some acts of production such as providing fingerprints, blood samples, or voice recordings are considered unprivileged since such evidence gives no indication of a person’s thoughts or knowledge. A court can generally force a defendant to provide such information without implicating the 5
th Amendment.

The government is arguing a distinction beyond whether the information is or is not known by the defendant. They contend that revealing the password is not testimonial communication because it will not reveal any new information which the government is not already aware of. The fact that the password is in the content of Boucher’s mind should not preclude disclosure since he would not be revealing any new evidence to the government. It would only be revealing the files that the border agents had previously seen. There may or not be other files on the Z: drive containing incriminating information. As a result, prior knowledge of incriminating activity by the government would bar a 5th Amendment privilege right by Boucher.

Judge Niedermeier took a broader view in his decision denying the government’s subpoena. He believes that that the password qualifies as testimonial communications because it was within the content of Boucher’s mind. Niedermeier referenced a Supreme Court case that analogized the password to the combination of a wall safe. He wrote that “a password, like a combination, is in the suspect’s mind, and is therefore testimonial and beyond the reach of the grand jury subpoena.” If Boucher had written the password somewhere, it would likely be found to be unprivileged and the government could force him to disclose it.

The judge also ruled against the government’s offer which allowed Boucher to enter the password without having to reveal it to the government. Judge Niedermeier wrote that even the effect of hiding the password from the government would still be implicitly indicating that Boucher knew the password and that he had access to the files. The contents of his mind would still be displayed and the testimonial nature would not change by not revealing the password to the government.

Future Rulings in a Digital Age

Each test is dispositive of a particular outcome in cases where technology makes it easier to hide information. The government is seeking to find the best possible strategy to convict criminals and would like for the courts to use a narrow interpretation of what constitutes testimonial communications in a digital age. The dilemma in this case has occurred because access to the evidence is located inside the defendant’s head. Even though the government has sufficient probable cause to get a subpoena if Boucher had child pornography available in his car or house, the encryption technology has now added another dimension for the government to overcome in order to convict.

Supporters of individual rights would prefer the test used by Judge Niedermeier which creates a clear, black and white rule vis-à-vis electronic communications. Privacy advocates would stand by the ruling of the judge and will seek to prevent the government from compelling disclosure of content protected by passwords. They see no need for an exception to the 5th Amendment and hope to convince the courts that passwords should always be testimonial communications.

The case will likely be appealed by the government and should not be viewed as the last word on the topic. There are many variables in the facts of this particular case that could provide ample room for the court to side with either ruling. It does raise an interesting situation that U.S. courts will continue to face as technology becomes more pervasive in criminal investigations.

About the Author Michael Santarcangelo

The founder of Security Catalyst, Michael develops exceptional leaders and powerful communicators with the security mindset for success.

{"email":"Email address invalid","url":"Website address invalid","required":"Required field missing"}

Don't know where to start?

Check out Security Catalyst Office Hours to meet your peers and celebrate the good, help each other, and figure out your best next step. We meet each Friday… and it’s free to attend.