Wednesday, 29 February 2012

Appeals Court Refuses to Rule on Laptop Encryption Case

Written by 

When Ramona Fricosu’s attorney, Phil DuBois, promised to appeal a lower court’s ruling that she be forced to open encrypted files that may have incriminating data in them and assist the prosecution’s case against her, he never expected the appeals court to deny the appeal until after she had complied with the lower court’s demands.

But on Tuesday, February 21, the 10th Circuit Court of Appeals in Denver did just that. It said that the defendant in a real estate scam must provide the prosecution with the data from encrypted files on her laptop computer, possibly containing incriminating evidence against her, before they would hear the appeal. In essence, she may be proven guilty long before she has a chance to be proven innocent by invoking protections under the Fifth Amendment. Said DuBois, this establishes “a very dangerous precedent that a person may be forced to assist in her prosecution in a way the law has not seen before.”

In order for the appeal to proceed, Ramona Fricosu would be compelled to meet with federal agents who will then wait until she opens the encrypted files, copies the contents onto an unencrypted disk, and hands it over.

The judge sidestepped the real issue by claiming that she was supplying only the key to the “vault” where the information was kept rather than the encryption password that she keeps in her mind. DuBois initially claimed, to no avail, that the password in her mind was protected by the Fifth Amendment’s language: “No person … shall be … compelled in any criminal case to be a witness against himself.” The judge instead bought the prosecution’s argument that by ruling in favor of Fricosu, the court would “harm the public interest” in allowing criminals to hide their misdeeds behind an encrypted firewall.

It will give Fricosu little joy if the evidence she is forced to provide convicts her while another nearly identical case is working its way up to the Supreme Court, with a much different and more favorable conclusion. The 11th Circuit Court of Appeals for the Northern District of Florida just decided, two days after the Denver appeals court’s decision to demur, that a John Doe could not be forced to open his encrypted computer files because it violated his rights under the same Fifth Amendment.

In that case, law-enforcement officers were following John Doe in the course of a child pornography investigation. In October 2010, they tracked him to a hotel in California and, after obtaining a search warrant, seized his computer and seven pieces of digital media including a number of external hard drives. They were encrypted with TrueCrypt and the officers were unable to access the files. The court ruled that Doe had to provide his prosecutors with the information and he claimed protection under the Fifth Amendment.

The court ruled in Doe’s favor this time, writing that “what is at issue is whether the act of production may have some testimonial quality sufficient to trigger Fifth Amendment protection.” When it addressed the issue of the “key” to a lockbox versus “password” held in his mind to unlock the computer files, the Florida court ruled exactly opposite of the Denver court:

The decryption and production of the hard drives would require the use of the contents of Doe’s mind and could not be fairly characterized as a physical act…. We conclude that the decryption and production would be tantamount to testimony by Doe of his knowledge of the existence and location of potentially incriminating files….

We are unpersuaded by the Government’s derivation of the key/combination analogy….

Requiring Doe to use a decryption password is certainly more akin to requiring the production of a combination because both demand the use of the contents of the mind, and [that] production … could prove incriminatory….

We are not persuaded by the suggestion that simply because the devices were encrypted necessarily means that Doe was trying to hide something….

The Fifth Amendment protects Doe’s refusal to decrypt and produce the contents of the media devices because the act of decryption and production would be testimonial [against him]….

We hold that Doe properly invoked the Fifth Amendment privilege.  

How two judges looking at essentially identical factual cases could come to opposite conclusions is impossible to understand. It will certainly give Fricosu small comfort to know that her claim of protection under the Fifth Amendment was correct and valid and substantive if she reads about the John Doe case from her jail cell.