Landmark decision allows child-porn suspect to plead Fifth in password case

In what will likely become a landmark case for the digital age, a federal appeals court has ruled that a suspect in a child pornography case is protected under the Fifth Amendment from disclosing a password that would decrypt his computer files.

It is the first time a suspect has been granted Fifth Amendment protection in a case involving a password used to encrypt computer hard drives.

The Fifth Amendment protects against self-incrimination.

The U.S. Court of Appeals of the 11^th Circuit, which is based in Atlanta, ruled that “the Fifth Amendment protects [the man's] refusal to decrypt and produce the contents of the media devices. The suspect is only referred to as John Doe in court documents.

The court found that by revealing the password the man would be disclosing something he knew, i.e. testifying against himself, as opposed to producing something that he had, say a key to a safe, that could be considered evidence.

“The government’s attempt to force this man to decrypt his data put him in the Catch-22 the 5th Amendment was designed to prevent - having to choose between self-incrimination or risking contempt of court,” Marcia Hofmann, senior staff attorney for the Electronic Frontier Foundation said on the group’s Web site. “We’re pleased the appeals court recognized the important constitutional issues at stake here, and we hope this ruling will discourage the government from using abusive grand jury subpoenas to try to expose data people choose to protect with encryption. ”

The court wrote: “We hold that Doe’s decryption and production of the hard drives’ contents would trigger Fifth Amendment protection because it would be testimonial, and that such protection would extend to the Government’s use of the drives’ contents.”

The ruling in the case, which began in Santa Rosa County, Fla., and ended with an arrest in California, goes against two lower court rulings in similar cases - one in Denver and the other in Vermont. Neither court would allow the Fifth Amendment defense. In both cases, police had some knowledge of what they might find on computer hard drives and used a “forgone conclusion” argument.

The woman in the Colorado case is scheduled to turn over a password on Tuesday although her lawyer says she does not know or cannot remember it.

But in the 11^th Circuit case, it was clear that investigators had no knowledge of the contents of two laptops and five hard drives and, therefore, could not claim a forgone conclusion as to the contents of millions of encrypted files.

The court concluded that the suspect proved the three conditions that fall within the scope of the Fifth Amendment: compulsion, a testimonial communication or act, and incrimination.