US ruling: Disclosure of passwords is unenforceable

On Thursday, the United States Court of Appeals for the Eleventh Circuit ruled that, under US law, the decryption of data can be regarded as giving testimony (US vs. John Doe). The Fifth Amendment to the US Constitution states that US citizens can't be forced to incriminate themselves. As a result, an individual who has been suspected of possessing child pornography by the prosecuting attorney has walked free.

The defendant, who is referred to only as John Doe, has never been charged, but has served eight months in prison for contempt of court after refusing to decrypt seven computer hard disks. The prosecution suspects that the disks contain child pornography. Doe invoked his constitutional privilege against self-incrimination, which has now been confirmed.

Trading data for immunity

Doe may still be forced to disclose the contents of the hard disks if the prosecution can prove that Doe is in a position to do so. However, the responsible court would need to grant the suspect immunity in terms of using the files and the information obtained from them.

The public prosecutor and original court had only assured Doe that he would not be charged for the act of decrypting and releasing the data. The investigators did intend to use any relevant data they may have found against Doe. However, the Court of Appeals wasn't satisfied with this minimal immunity. It rejected the attempt to grant immunity for making a statement but treat the resulting information as "manna from heaven".

Testimony or not

One deciding factor for the decision was that the prosecution is not aware of whether data, and if so, what data is stored on the disks. Therefore, Doe would have to use the "contents of his own mind", which is equivalent to giving testimony, said the court. Things would be different if the investigators already knew which files are stored where (even without giving any actual file names), that the suspect possesses the files, and that the files are authentic. The judges said that, in such a case, revealing a password would be the same as handing over a safe key or combination. According to a ruling by the US Supreme Court, this is not considered a testimony and is, therefore, not covered by the Fifth Amendment.

The Court of Appeals lists several examples: in re Boucher, the defendant who was later found guilty had shown relevant videos to a customs officer but later refused to decrypt the files again. In the ongoing Fricosu v. US case, Ramona Fricosu, who is suspected of fraud, admitted in an intercepted phone conversation that incriminating documents are stored on her laptop. The Court of Appeals for the Tenth Circuit refused to re-examine the original court's ruling that the data must be disclosed. Should Fricosu be found guilty, she can still try to (renew her) appeal against the use of her data as evidence.

US Court of Appeals rulings are only binding for the lower courts in their circuit, but not for the judges of other circuits.

(Daniel AJ Sokolov / crve)