Pennsylvania Supreme Court Holds No Compelled Disclosure of Computer Passwords
On November 20, 2019, the Pennsylvania Supreme Court in Commonwealth v. Davis held that a defendant in a criminal case cannot be compelled to disclose a password protecting an encrypted computer under the so-called foregone conclusion exception to the doctrine of self-incrimination in the Fifth Amendment.
The case involved a defendant accused of disseminating child pornography and a laptop protected by Truecrypt 7.1 (an open source data encryption tool). [slip 3-4] (NOTE: In 2014 around the time of the Snowden situation, TrueCrypt was suddenly discontinued over allegedly unfixed data security issues.) The defendant declined to disclose the 64 character password protecting the Truecrypt, encrypted volume.
The case involved important, broader constitutional issues ( in the context of child pornography) regarding the so-called foregone-conclusion exception to the Fifth Amendment privilege protecting against self-incrimination and testimonial evidence. The foregone-conclusion exception suggest that if documents are already substantially known to the government, then compelling production related to those documents does not violate the privilege against self-incrimination. [see slip 5-6] The Fifth Amendment further protects against compelled testimony—where testimony is typically statements by an accused or the accused’s “own mind” and root of the colloquial “taking the Fifth.” Courts have created all types of artifices to re-frame evidence as non-testimonial to undermine the Fifth Amendment. Both issues are important legal protections (but the revulsion to child pornography makes seeing the broader legal issues difficult).
Lower Superior Court’s Troubling Analysis in 2017
Putting the child pornography aside, the Superior Court, a lower court, held [Sup.Ct. slip 9-15] that a password, in this case, was not testimonial. The lower court, in a somewhat crabbed, boot-strapped logic, raised the foregone conclusion exception. [Sup.Ct. slip 12-13]. The court focused on the password and concluded
disclosing the password at issue would not communicate facts of a testimonial nature to the Commonwealth beyond that which [the defendant] has already acknowledged to investigating agents.
[Sup.Ct. slip 13]. The lower Superior Court assumed a priori that the password itself could not be testimonial and instead focused on the disclosure “unlocked” by the password. Thus, according to the lower court, compelling disclosure of the password is not testimonial and the foregone conclusion exception applies. [Sup.Ct. slip 15] Again, a child pornography case does not elicit much sympathy, but the implications of the lower court’s flawed analysis should trouble anyone. The analysis allows double-boot-strapping. If the government suspects what might be on a computer, then the government can force someone to disclose the password to “unlock” the suspected contents and use the “discovered” evidence against the accused.
The analysis deeply troubled many who better understand electronic data. The password itself can be testimonial and the case suggests, but does not resolve, that the government can then simply compel the accused to enter the password—thus not disclose it (which raises authentication issues because the accused is the only one who presumably knows the password or assuming the password somehow uniquely allows access). The holding vastly expanded the foregone conclusion exception, which addresses disclosure of known documents, to any information.
2019 Pennsylvania Supreme Court Corrects—No Compelled Disclosure of Passwords
The Pennsylvania Supreme Court lays a foundation
- the law distinguishes between physical and testimonial production where only testimonial is protected;
- however, an act of production may be testimonial when the act expresses some explicit or implicit statement of fact that certain materials exist, are in the defendant’s custody or control, or are authentic and whether the government compels the defendant to use the “contents of his own mind” in explicitly or implicitly communicating a fact;
- the vast majority of compelled oral statements of facts will be considered testimonial, as they convey information or assert facts acknowledging the deeply rooted concern with the “cruel trilemma” ; and
- whether the government compels the accused to “use the contents of their own mind,” seen as a critical distinction between disclosing a key to a lockbox versus disclosing a combination to a lock
The Pennsylvania Supreme Court reminded that testimonial means more than a mere statement by an accused.
The primary policy undergirding the Fifth Amendment privilege against self-incrimination is our country’s “fierce ‘unwillingness to subject those suspected of crime to the cruel trilemma of self-accusation, perjury or contempt’ that defined the operation of the Star Chamber, wherein suspects were forced to choose between revealing incriminating private thoughts and forsaking their oath by committing perjury. … This being the case, “the definition of ‘testimonial’evidence articulated in Doe must encompass all responses to questions that, if asked of a sworn suspect during a criminal trial, could place the suspect in the ‘cruel trilemma.’
[slip 11-12](internal citations omitted] The Supreme Court cites, at length, the origins of the so-called foregone conclusion exception emphasizing that the caselaw suggests a narrow exception related to known documents in possession of a third-party. [slip 12-14, 18-19, 21, 23-24] The Supreme Court also carefully analysis past constitutional law on the foregone conclusion exception distinguishing between physical acts and mental acts.
such compulsion is more like ‘be[ing] forced to surrender a key to a strongbox containing incriminating documents’ than it is like ‘be[ing] compelled to reveal the combination to [petitioner’s] wall safe.’
[slip 15](emphasis in original) The testimonial aspect relates to the act of disclosure not to the contents of the documents themselves. [slip 16]
Using this four-part foundation, the Pennsylvania Supreme Court reversed the lower court and concluded that compelling disclosure of a password, an act of production, is testimonial. [slip 19] The Court concluded that the disclosure of a computer password is analogous to compelling disclosure of a wall safe combination and thus the product of his mind. Such compelled disclosure is protected by the Fifth Amendment and the foregone conclusion exception does not apply because such compulsion is testimonial (being the product of the mind).
The Pennsylvania Supreme Court’s analysis appears sound. Besides the implications for computer passwords, the Pennsylvania Supreme Court re-emphasized that the foregone-conclusion exception generally is “extremely limited” and arises only related to business and financial records (documents) specifically already known to the government. [slip 21]. The Court reminds:
the [s]tate which proposes to convict and punish an individual produce the evidence against him by the independent labor of its officers, not by the simple cruel expedient of forcing it from his own lips. [slip 22](internal citations omitted)
The government, even if a burden for the government, can expect little accommodation or latitude do to the foundational character of the Fifth Amendment. [slip 22, 23]
This case helps correct the concerns expressed by many over the increasing breadth of the so-called foregone-conclusion exception and double-bootstrapping approach suggested by government prosecutors. The government increasingly, using cases like those involving child pornography where there is no community sympathy for an accused, tried to expand the foregone-conclusion to effectively swallow the Fifth Amendment entirely. Yet, the same expanded rules apply to any case, not just child pornography. The inflated foregone-conclusion exception, until now corrected, could compel disclosure of business records, family records, copyright infringement, employment records, photos, website posts,hard drive contents, etc. merely on government suspicion. For now, in Pennsylvania, that is not the case and the foregone-conclusion, while still problematic, is at least narrowed back to its constitutional boundaries.