Encryption and the Fifth Amendment
The Weekly Focus looks at a new court case involving the limits of data encryption and privacy.
Ramona Fricosu is a Colorado woman accused by federal authorities of taking part in a small-scale mortgage scam. Her case seems rather ordinary, yet has garnered national attention due to the novelty of one particular legal concept. Fricosu’s computer, which prosecutors believe contains evidence of the fraud, is encrypted. This Weekly Focus takes a look at this rather remarkable case and what implications it has for the Fifth Amendment as applied to technology far more advanced than the Constitution’s founders could have ever imagined.
Fricosu secured the data on her computer by encrypting it, a process which takes digital data and breaks it into blocks of a certain size. Each block is scrambled using a mathematical algorithm such that the data can only be reassembled by using a “key” to unencrypt it. Encryption software, like the Pretty Good Privacy (PGP) used by Ms. Fricosu, is readily available and reportedly unbreakable by law enforcement authorities at every level. Prosecutors have only ever used PGP-encrypted evidence in court by compelling users to turn over their passwords.
Turning over her password is precisely what Ms. Fricosu refuses to do. Colorado authorities have charged her with obstructing a lawful search, in an effort to force her to turn over the information. The prosecution argues that Fricosu must assist them in searching her encrypted hard drive because they have a previously issued search warrant regarding her role in a fraud case. Fricosu’s lawyer, as well as the Electronic Frontier Foundation in an amicus brief, argues that compelling her to provide the password necessary to unencrypt her hard drive would violate the Fifth Amendment assurance that no one “shall be compelled in any criminal case to be a witness against himself.” While there is little precedent regarding encryption, there are many cases involving the right against self-incrimination. At the trial, Judge Robert Blackburn of the US District Court in Colorado determined that the All Writs Act allowed his court to “issue orders to effectuate an existing search warrant” and determined that Fricosu’s encrypted hard drive was within the purview of that warrant.
Blackburn ruled that Fricosu must assist the prosecution in effectuating their search warrant and provide an unencrypted version of the hard drive. Fricosu was compelled to provide the contents of her hard drive, but not the password to the laptop. This ruling attempted to draw the line between what is covered under an existing warrant (the information being pursued, but not the password) and the protection against self-incrimination.
The Fricosu case raises a thorny legal question. Does revealing a key or password to encrypted documents constitute self-incrimination? The judge in this case ruled no, stating that Ms. Fricosu's production of a password is identical to producing a document identified by the prosecutor. In the judge’s opinion, an exchange wherein the prosecution is aware of the existence of evidence and merely requests it from the defendant—rather than attempting to force the defendant to divulge the existence of evidence—is not protected under the Fifth Amendment.
There is an alternative view however, which may already have precedent in the 2000 Supreme Court ruling United States v. Hubbell. In that case, the Court ruled that prosecutors were not allowed to use the defendant to locate and categorize types of documents to be turned over as evidence if they wished to use the material as part of a criminal case. Essentially, this means that the Fifth Amendment protects an individual from being forced to reveal something of value like confirmation that a certain document exists or is controlled by a particular person.
In the case of Ms. Fricosu, her password would seem to be something of value as the prosecutor cannot say with any specificity what it expects to find on the laptop. Revealing or using the password would force Ms. Fricosu to introduce new information into the case which would incriminate her and is therefore protected under the Fifth Amendment.
This case, while not significant with respect to the crime, may hold broad ramification on appeal. The use of encryption to protect personal and business data has increased markedly over the last decade. The latest version of both Mac OS X and the Windows operating system support the sort of full-disk encryption Ms. Fricosu was using, allowing individuals to secure their entire hard disk with the click of a button. Modern encryption algorithms are too strong to be broken with brute force computing and, as an increasing number of individuals are brought to trial with encrypted hard disks as evidence, the courts will be forced to determine where the line of Fifth Amendment protection should best be drawn. Too broad a protection could leave law-enforcement agencies unable to reach legitimate evidence obtained in legal searches. Too narrow and the rights and protections of individuals could be placed in jeopardy.