Does the Fifth Amendment Protect the Refusal to Reveal Computer Passwords? In a Dubious Ruling, A Vermont Magistrate Judge Says Yes

By SHERRY F. COLB
Monday, Feb. 04, 2008

In a recent decision in Vermont, In re Boucher, a federal magistrate judge held that the Fifth Amendment right against compelled self-incrimination protects a suspect against having to reveal the password permitting access to his computer files. If upheld on appeal, this ruling could prove significant in shaping the category of items that people may withhold from the government, even when the government has good reason to believe that what it seeks will reveal evidence of serious crime. Though such rulings are sometimes subject to debate, the decision in this case seems to have misapplied the Fifth Amendment.

In In re Boucher, defendant Sebastien Boucher had his laptop computer lawfully searched at the U.S./Canada border. In the course of the search, agents found evidence suggesting that Boucher had child pornography files on his computer. One file, for example, was repellently labeled "2yo getting raped during diaper change." At a later date, when the Vermont Department of Corrections took custody of the laptop and created a mirror image of its contents, the agent involved was unable to access the computer drive on which the suspicious files were located. The files were protected by encryption algorithms requiring a password.

Through the use of software that is widely available but ironically called "Pretty Good Privacy," Boucher managed to make his files "nearly impossible to access … without knowing the password," according to a Secret Service Agent with experience and training in computer forensics. Unlocking the drive (through an automated system that repeatedly guesses passwords) could take years.

Because of this obstacle, the grand jury investigating his crime subpoenaed Boucher and directed him to supply the password associated with the computer files in question. Boucher, however, challenged the subpoena on Fifth Amendment grounds.

Compelled, Self Incriminating Testimony

The Fifth Amendment provides that "No person … shall be compelled in any criminal case to be a witness against himself." Read broadly, one could interpret this provision as protecting the individual's right to refuse to cooperate when the government assembles a criminal case against him. This might include declining to open the door when police knock and have a warrant, or refusing to give fingerprints or to submit to a police officer's signal to stop. On the other hand, a very narrow reading might suggest that the only right granted by this provision of the Fifth Amendment is the right to refuse to testify at one's own criminal trial.

The U.S. Supreme Court has not accepted either of these two interpretations of the Fifth Amendment. Instead, it has held that the government may not "compel" a person to provide "testimony" that is "self-incriminating." "Compulsion" refers to force or coercion. If police simply ask a question of a suspect, and she answers the question, there is no compulsion and therefore no Fifth Amendment problem.

"Self-incriminating" refers to the potential of a response to a question to provide a link in the chain of a criminal prosecution against the responder. If police ask a question that does not call for self-incriminating information, then a person who is not in custody or on trial for a crime may be compelled (though by legal process, not by force) to answer the question.

"Testimony" refers to communicative behavior that reveals the contents of a person's mind. Because giving fingerprints, opening one's door, and stopping when police order a stop do not require a person to convey, through communication, the contents of her mind, none of them trigger the Fifth Amendment right against compelled self-incrimination. Though there is compulsion and self-incrimination, there is no testimony.

Two Out of Three

In the Boucher case, the government has attempted to order the defendant to provide access to data that will likely assist in his criminal prosecution on child pornography charges. To put it differently, the government has engaged in "compulsion" to obtain "incriminating" evidence, thus satisfying two of the three requirements for triggering a suspect's Fifth Amendment right.

The remaining requirement is that the government be demanding a testimonial response from the suspect. The question presented by In re Boucher is therefore this: Is the provision of a password for a computer file "testimonial" for purposes of the Fifth Amendment?

Using One's Mind to Help the Police

The Supreme Court has identified as "testimonial" the provision of evidence in which "communication … itself, explicitly or implicitly, relate[s] a factual assertion or disclose[s] information" expressing "the contents of an individual's mind." By that definition, the Fifth Amendment does not protect people against having to stand in a lineup, walk a straight line (for sobriety testing), give a handwriting sample, or even speak words for voice identification. In each of these cases, the incriminating aspect of what the suspect must do is connected to physical features of his actions, rather than to the information in his mind that he communicates through those actions. If a suspect must utter the words "Give me the money," for example, any incrimination follows from what his voice sounds like when he speaks, rather than from the ideas he has conveyed in speaking those words.

The Court has recognized, however, that there are often testimonial features in the otherwise physical act of conveying non-testimonial evidence. For example, when a suspect speaks for a voice-identification lineup, he is implicitly saying "the voice in which I am speaking is my actual voice," and the authenticity of his voice is in fact a precondition to its criminal significance. Despite the Court's acknowledgment of such testimonial aspects of physical acts, however, it does not, in most cases, extend Fifth Amendment protection to the act of production of evidence. On occasion, however, when the communication implicit in the act of production is a central feature of the utility of the evidence, the Court does hold that the Fifth Amendment applies.

The Court has indicated, for example, that when the government requests a document that may or may not exist, the Fifth Amendment protects against the "act of production." Therefore, if the government were to ask you for any books containing your recording of criminal transactions, you could refuse to produce such books on Fifth Amendment grounds. But suppose the government independently knows that such a book does, in fact, exist. It then could demand production of the book only if it also granted you immunity. This immunity would mean that the government would not be able to utilize in court the fact that you produced the book as evidence either (1) that the book exists, (2) that the book is authentic, or (3) that the book was in your control at the time that you produced it.

Encryption Password

In Boucher, the magistrate judge observed that providing a password to one's computer files communicates that one has control over the contents of those files. The magistrate judge reasoned that by providing his password, Boucher would therefore be communicating, by compulsion, an incriminating fact - that he was in possession of files that likely contained child pornography. If production is testimonial, then, it follows that any files uncovered would be the fruit of compelled, self-incriminating testimony and accordingly inadmissible at a criminal trial against the defendant.

The difficulty in the court's reasoning, however, is that the government already knew that the files belonged to Boucher and it already was fully aware that he knew the relevant password, in part because he essentially admitted as much when they first talked with him at the Canadian border. Therefore, the incrimination that follows from Boucher's typing in of his password is simply the content of his newly-accessible computer files. In the words of another Supreme Court precedent, Boucher's knowledge of the password was a "foregone conclusion," thus meeting an exception to the Fifth Amendment's coverage of acts of production.

This matters because the evidence that will ultimately derive from the entry of the password - the child pornography - will not be a product of compelled communication by the defendant. For example, the government will not be forcing the defendant to let the officers know that he is linked to the computer files; he voluntarily told the government as much already. Thus, the evidence will instead be the product of lawful investigation followed by a demand for a password that everyone already knew the defendant had. What the defendant had to do, in other words, was surrender a password rather than tell the officers something they did not already know.

In discussing the question of whether the demand for a password should implicate the Fifth Amendment, Justices on the U.S. Supreme Court have sometimes referred to the distinction between demanding a combination to a safe, versus demanding a key - deeming the answer to the former but not the latter demand testimonial. It is in part because of this example that the magistrate in Boucher decided as he did: Inputting a password is more like inputting a combination to a lock than it is like opening a lock with a key.

As we have seen above, however, producing either a key or a combination could be testimonial if the government were essentially asking a suspect, "Do you have control over this locked (and criminally-suspicious) item? In Boucher, however, the government simply wants to access the files - files that it has legal authority to access, though its technological limitations make that access almost impossible without a password. In this context, the magistrate judge erred when he held that the Fifth Amendment protected Boucher's refusal to provide the password.


Sherry F. Colb, a FindLaw columnist, is a Visiting Professor at Columbia Law School. Her book, When Sex Counts: Making Babies and Making Law, is currently available on Amazon.