Judge says defendant must decrypt files, Fifth Amendment not at issue

By | January 23, 2012, 9:14pm PST

Summary: A federal case that may have helped define constitutional law in the digital age turns not on the defendant’s rights in regard to her encryption password, but on the fact that evidence clearly showed she owned a laptop in question and had access to its contents.

In what was thought to be a precedent setting case in the digital age, a federal judge ruled Monday that a woman arrested in a mortgage scam must give authorities access to her encrypted hard drive.

The defendant, Ramona Fricosu, argued that exposing the contents of the hard drive by entering her password and decrypting the files would violate her Fifth Amendment rights against self-incrimination.

The judge in the case, which was heard in U.S. District Count in Denver (Colo.), found that was not the situation and gave Fricosu until Feb. 21 to produce an unencrypted hard drive.

“I find and conclude that the Fifth Amendment is not implicated by requiring production of the unencrypted contents of the Toshiba Satellite M305 laptop computer, ” wrote U.S. District Judge Robert Blackburn.

The laptop in question, Blackburn said, more likely than not belonged to and was used by Fricosu. The one piece of damning evidence was a jailhouse conversation Fricosu had with her ex-husband, Scott Whatcott, who also was arrested in the case. Blackburn’s ruling included a transcript of the conversation, which he said proved Fricosu owned and had access to the computer.

Blackburn also noted that the defendant had been granted immunity and that federal prosecutors would not use her act of producing the laptop’s contents in the case against her.

The case drew interest from civil rights groups who argued that current law needs to evolve to meet the nuances of the digital age. The case, however, did not turn on the question if Fricosu’s encryption password was something she had or something she knew but on the jailhouse conversation with her ex-husband.  If the password was found to be a key, she would have been compelled to give it up. But if it was ruled something she knew, she was protected by the Fifth Amendment.

That password question as it relates to the Fifth Amendment will have to be tackled head-on by future cases.

The Denver Post reported that Fricosu’s attorney, Philip Dubois, told the judge in an earlier hearing that if the password is treated like a key “the meaning of ’search warrant’ will be stretched and the rights to privacy and against self-incrimination shrunk.”

The Post also reported that Patricia Davies, an assistant U.S. attorney, told the court during the same hearing that allowing Fricosu to hide behind a password will signal that “encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers.” She said such a situation would make prosecution impossible.

The Electronic Frontier Foundation (EFF) filed a brief in the case arguing that if the government forces people to turn over their encryption passwords that it is forcing people to be witnesses against themselves in a way that violates the constitution.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

John Fontana is a journalist focusing in identity, privacy and security issues. Currently, he is the Identity Evangelist for cloud identity security vendor Ping Identity, where he blogs about relevant issues related to digital identity.

Disclosure

John Fontana

First and foremost, John is employed as an Identity Evangelist by Ping Identity, which provides cloud identity security software to enterprises and cloud service providers. In his role, he tracks the identity industry and relevant issues. He does not have financial interests in any companies he covers, and opinions expressed are his own.

Biography

John Fontana

John Fontana is a journalist focusing in identity, privacy and security issues. Currently, he is the Identity Evangelist for cloud identity security vendor Ping Identity, where he blogs about relevant issues related to digital identity. Prior to Ping, John spent 15 years as a senior reporter for a variety of publications, including Communications Week, Internet Week and Network World, where he focused on enterprise topics including collaboration, directories, network infrastructure, databases, open source, ERP and security. He covered IBM, Microsoft, Cisco, Oracle, Red Hat, Google among other enterprise vendors. His work has also appeared in the New York Times, CNN, CIO and Mashable.

Talkback Most Recent of 19 Talkback(s)

  • The moral of the story
    is that if you're smart enough to encrypt your hard drive but dumb enough to have an incriminating conversation in jail you're still not protected.
    ZDNet Gravatar
    matthew_maurice
    23rd Jan
  • RE: Judge says defendant must decrypt files, Fifth Amendment not at issue
    @matthew_maurice - There is another big issue here. There is no independent verification of what the data means. When I discover a paper record, I have some means of verifying what was written, and a way to interpret it. But with encrypted data, how do I know it was decrypted correctly? If it fails to produce the evidence desired by the prosecution, can they continue to push for contempt or obstruction punishments?

    Given the different forms and sophistication of encryption, it's possible to hide not only the data itself, but the very nature of the data. This presents a problem that has yet to be addressed.
    ZDNet Gravatar
    terry flores
    24th Jan
  • Just because you BRAG about committing a crime .....
    ..... does not prove you did it!
    Look at all the high school kids bragging about their imaginary conquests!
    ZDNet Gravatar
    kd5auq
    24th Jan
  • True .... but when you are were already on trial for the same crime ...
    @kd5auq ... then bragging about it while in jail is about the same as ADMITTING the crime.

    Sorry, but the excuse that all he was doing was bragging is completely ridiculous and cheap.
    ZDNet Gravatar
    wackoae
    24th Jan
  • RE: Judge says defendant must decrypt files, Fifth Amendment not at issue
    Here is my proposition going forward... Since the actual information to be handed over is the object questioned with regard to 'self incrimination'... One new textual addition to anyone's password combination should then include the wording "I'm Guilty" to then make it incontravertable that such 'information' itself is, in fact, self incriminating. (did anyone follow that?, it makes sense).

    In essence, handing over this password would, in itself, be an act of self-incrimination, thus, you have a protected right not to do so.
    ZDNet Gravatar
    FuzzyBunnySlippers
    23rd Jan
  • The hard drive does not exist in a tertiary domain, it's right here.
    @FuzzyBunnySlippers

    This isn't complicated. The data on the drive is the same as papers in a safe. The hard drive is subject to a warrant. Just because you plug in a computer doesn't mean it exists in a different realm of reality. No one would argue she shouldn't have to open a safe, and it's rather pinheaded to say that a hard drive is any different. Making your password "I am Guilty" sounds like something my five year old niece would say. From her, it's cute. From an 'adult', it just sounds stupid.

    If your going to operate a criminal enterprise, don't keep records where they could be found.
    ZDNet Gravatar
    pishaw
    24th Jan
  • RE: Judge says defendant must decrypt files, Fifth Amendment not at issue
    @pishaw

    Oh, I see. The "it sounds stupid" defense, wrapped within an attempt at an insult to serve as some form of proof. The act of turning over a key is not self incriminating. Turning over a statement "I am guilty" actually is. So, your five year old neice may have something on you.

    BTW, where does this even come into play regarding my statements, "Just because you plug in a computer doesn't mean it exists in a different realm of reality."? I called out your straw man on that. I suppose changing what I've said to that made it somewhat easier to argue against. Good job killing your own straw man... now let's talk about what I've actually proposed.
    ZDNet Gravatar
    FuzzyBunnySlippers
    31st Jan
  • This is the same as turning over stuff in a bank safe
    @FuzzyBunnySlippers If a criminal stores incriminatory evidence in a safe at a local bank, the judge can grant a subpoena for everything and the defendant has to turn over the contents. It is the same as forcing a defendant to turn over a key for an encrypted hhd.

    There is plenty of precedence to support the decision ....
    ZDNet Gravatar
    wackoae
    24th Jan
  • RE: Judge says defendant must decrypt files, Fifth Amendment not at issue
    @wackoae

    Reread what I've written. Turning over a key is NOT self incriminating. Turning over a statement/password "I am guilty" is.

    Also, the defendant (in this case) has turned over the contents. Unfortunately for the prosecution, the contents have been encrypted. There is no (AFAIK) provision for the state of, or readability of said 'contents'. If the contents were written in a dead language, Latin, encrypted, or otherwise, the truest form of contents have been handed over. Inability of the prosecution to read or derive information from these contents is NOT the burden of the defendant.

    As for "plenty of precendence...", why have you not included one reference? Being that this case is just breaking this ground, I am of the opinion that your statement is not fully based in fact.
    ZDNet Gravatar
    FuzzyBunnySlippers
    31st Jan
  • RE: Judge says defendant must decrypt files, Fifth Amendment not at issue
    Honestly, she should ignore the judge's orders and appeal. If there is something on her hard drive that is incriminating, she has a right to refuse giving it as testimony.

    That's one problem with our judicial system, some judges interpret the law differently - many times in error - so you have to change your venue and argue the semantics in front of SCOTUS. Precedence changes fairly often; therefore, obedience to authority should not be a gut reaction for fear of suffering a longer sentence.
    ZDNet Gravatar
    Vapur9
    23rd Jan
  • ZDNet Gravatar
    FuzzyBunnySlippers
    23rd Jan
  • RE: Judge says defendant must decrypt files, Fifth Amendment not at issue
    @Vapur9

    One thing that has been postulated with regard to this case... the fact that the accused does have apparent knowledge of method to unlock further evidence, in past this may be considered either a key, or actual evidence within the case. Withholding evidence is criminal, and a key (seemingly physical based on case-precedence, although this seems to be the crux) would need to be forfeited. This case has risen to a level that the 'object' to be forfeited to the courts is the specific item of a password (non-physical entity), and is the specific item (not the information gathered post-forfeiture), that is being held against the terms of the 5th amendment, self incriminating. In short, does the knowledge of, and withholding of this password pose as withholding evidence, as obstruction of justice, or is it (in itself) a self-incriminating entity?

    If the entity does not incriminate the defendant, but the use of this entity serves to incriminate the defendant, does that qualify (of itself) as self-incriminating. The only method of defense (IMO) is to assure the entity DOES incriminate by including within it's very being, the wording as I proposed earlier. (separate post where I proposed including the wording "I'm Guilty".)

    In short, the simple inclusion of guilt within the password would act as a method of self-incrimination, and therefore, also as grounds to never accede to forfeiture of knowledge (under the 5th amendment) of contents of said password.
    ZDNet Gravatar
    FuzzyBunnySlippers
    24th Jan
  • RE: Judge says defendant must decrypt files, Fifth Amendment not at issue
    @FuzzyBunnySlippers

    Good idea; change all passwords and hints to contain the words, "I'm guilty" regardless if it was meaningful. This would help prevent the intrusion of complicated judicial logic. Of course, there could also be a need to have some semblance to the crime, such as "I committed this crime here on this date ..." as a password hint.

    I wonder if changing her password to or from something like that would be destroying evidence ...
    ZDNet Gravatar
    Vapur9
    24th Jan
  • RE: Judge says defendant must decrypt files, Fifth Amendment not at issue
    @FuzzyBunnySlippers - Actually withholding evidence is not a crime in itself, if you are the one accused. That's the essence of the 5th Amendment protection of self-incrimination. The government is allowed the power of search and seizure of physical evidence, but they cannot compel you to speak or act against yourself. There has been some creep in the interpretations of "obstruction of justice" but they mainly apply to active intervention (false or misleading statements, spoliation of evidence) as opposed to non-cooperation or maintaining silence.
    ZDNet Gravatar
    terry flores
    24th Jan
  • Everyone's missing a crucial legal weasel-wording here
    The fifth amendment only applies to *self* incrimination. Since the prosecution gave her immunity for anything discovered on the encrypted drive she *can't* incriminate herself, thus providing the password is not self-incrimination. happy

    The judge made no decision about password and the fifth amendment at all!
    ZDNet Gravatar
    wolf_z
    24th Jan

Talkback - Tell Us What You Think

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources