A federal district court in Colorado has handed down an unfortunate early ruling (pdf) in a case in which the government is attempting to force a criminal defendant to decrypt the contents of a laptop.

In United States v. Fricosu, the government seized several computers from the home of a woman charged with mortgage fraud, including a laptop containing encrypted information. Prosecutors asked the court (pdf) to force the woman to either type an encryption passphrase into the laptop to decrypt the information or turn over a decrypted version of the data, relying heavily on the fact that the government recorded a conversation between Fricosu and her ex-husband in which the government says she admitted that the laptop was hers and she knew the password.  EFF filed an amicus brief (pdf) in July, arguing she had a Fifth Amendment privilege against self-incrimination that prevented the government from compelling her to disclose the data.

The Fifth Amendment protects a person from being forced to be a witness against herself in a criminal case, a right often called the privilege against self-incrimination. The privilege doesn't prevent the government from gathering evidence from a person, but rather protects a person from being forced to make communications that would reveal the contents of her mind. The Supreme Court has held that it also applies to actions that communicate something of value—for example, producing records that would confirm the existence or authenticity of certain information, or the fact that a particular person had control over that data.

Regardless, the government can overcome the privilege by offering immunity that matches the scope of the protected right, since any information revealed after that wouldn't be incriminating. The government can also bypass the privilege if it already knows about existence, location and possession of the evidence it seeks, such that forcing a person to turn over that information won't tell the government anything more than it already knows. The government claimed that it had defeated Fricosu's privilege in both of these ways.

In the order issued yesterday, the court dodged the question of whether requiring Fricosu to type a passphrase into the laptop would violate the Fifth Amendment. Instead, it ordered Fricosu to turn over a decrypted version of the information on the computer. While the court didn't hold that Fricosu has a valid Fifth Amendment privilege not to reveal that data, it seemed to implicitly recognize that possibiity.  The court both points out that the government offered Fricosu immunity for the act of production and forbids the government from using the act of production against her. We think Fricosu not only has a valid privilege against self-incrimination, but that the immunity offered by the government isn't broad enough to invalidate it. Under Supreme Court precedent, the government can't use the act of production or any evidence it learns as a result of that act against Fricosu.   

The court then found that the Fifth Amendment "is not implicated" by requiring Fricosu to turn over the decrypted contents of the laptop, since the government independently learned facts suggesting that Fricosu had possession and control over the computer. Furthermore, according to the court, "there is little question here but that the government knows of the existence and location of the computer's files. The fact that it does not know the specific content of any specific documents is not a barrier to production." We disagree with this conclusion, too. Neither the government nor the court can say what files the government expects to find on the laptop, so there is testimonial value in revealing the existence, authenticity and control over that specific data. If Fricosu decrypts the data, the government could learn a great deal it didn't know before.

In sum, we think the court got it wrong. Regardless, the result is a very specific to the facts of this case and is unlikely to have far-reaching consequences, even if it stands.

Professor Orin Kerr has more thoughts about this case here.