Encrypt Everything

The government loves to search our stuff. What are the limits of this power? The Constitution, of course. In a month or so, the United States Supreme Court will render a decision regarding law enforcement’s search a citizen’s cell phone upon arrest. Keep in mind, it is customary for the police to search the personal items of an arrestee, like a wallet or purse. Sometimes, a man’s wallet contains photos of his family, and it is legal for an officer to flip through these items upon arrest. However, does this right to search extend to a cell phone? Not in Florida. As of last year, the Florida Supreme Court ruled that these cell phone searches violate the Fourth Amendment. Smallwood v. State, 113 So. 3d 724 (Fla. 2013). Locally, Central Florida was left with a bad decision in State v. Glasco, which followed the original Smallwood decision and ruled that cell phone searches were constitutional. As you might expect from me, I didn’t agree that these searches were legal, and months before these cases were overturned I wrote an article explaining why they were bad law. Yes, I got this one right, thank you very much, but even the blind squirrel finds a nut, and a broken clock is right twice a day. Got it.

Anyway, technology is exposing some cracks in our laws, permitting the government to squeeze through until the court system catches up with them. In particular, Central Florida has witnessed a significant increase in home searches pursuant to the witch hunt for child pornography. The problem is, when the government seizes a computer that is encrypted (I’ve had a few of these cases), they can’t retrieve the child porn. That’s because some encryption codes cannot be cracked by the government. Not even the NSA. Really. Seriously. So, under these circumstances, may the government compel a citizen to hand over their hard drive, decrypted?

First, let’s spell out what we mean by encryption. A citizen may secure the data on a phone or computer by using software such as Pretty Good Privacy (PGP). No one can crack the code of PGP, so the only way the government can view the data on a PGP encrypted hard drive would be if the citizen discloses his secret key. I can hear you computer geeks moaning that, theoretically, a computer out there could attempt every single pass code possible (called a Brute Force attack) and eventually discover the correct pass key. However, such a hack would take millions of years to process at current computer speeds (but, If you’re dumb enough to use common words and phrases in your pass code, a dictionary attack on the pass phrase may decrypt your data in no time at all. The lesson here is to select your pass phrase wisely).

Can the government force a citizen to decrypt a hard drive to reveal its incriminating contents? This can be a real problem if you’re accused of, say, possession of child pornography. Decrypting your hard drive will lead to many years in prison. Not just any prison sentence, but a dreaded sex offender prison sentence. Nobody likes a sex offender in prison. So, they say that there are no solutions, only trade offs. In this case, you can be held in contempt of court for failing to obey a court order, or take a prison sentence as a sex offender. Susan McDougal refused to answer some questions regarding Bill Clinton, and that got her 18 months in prison–but to no one’s surprise, Clinton gave her a full Presidential pardon in the final hours of his presidency. Assuming you don’t have friends in high places, refusing to obey a court order may be trouble, but still, not as much trouble as being labeled a sex offender in prison. I’m just saying.

In United States v. Doe (in re Grand Jury Subpoena Duces Tecum), 670 F.3d 1335 (11th Cir. 2012), John Doe’s computers were seized by the government. The government couldn’t view the contents of the computer because it was encrypted. So, the government obtained a court order demanding Doe produce unencrypted hard drives. He refused to decrypt the drives, asserting his Fifth Amendment privilege against self-incrimination, and was held in contempt of court. An appealed followed and the higher court held that the defendant was not required to produce unencrypted data to the Government.

John Doe asserted his Fifth Amendment right against self-incrimination, as no person “shall be compelled in any criminal case to be witness against himself.” The broader issue surround the Fifth Amendment goes to the heart of our Constitution. The government has the burden of proving their case against a citizen. The citizen is not required to do anything. To require a citizen to decrypt a hard drive–which will then be used against him–violates the core of what the Fifth Amendment seeks to protect, even though such an act doesn’t fit a very narrow reading of what it means “to be a witness against himself”.

And just such a narrow interpretation of the Fifth Amendment can be found in U.S. v. Fricosu. Here, the court required Fricosu to turn over decrypted data on her laptop because “the Fifth Amendment does not independently proscribe the compelled production of every sort of incriminating evidence.” 841 F. Supp. 2d 1232, quoting Fisher v. United States, 425 U.S. 391 (1976). Naturally, I disagree with this opinion, though it can be conceded that the government to force citizens to produce potentially incriminating evidence (fingerprint exemplars or hair samples, for example).

The government’s battle to sift through our cell phones is drawing to a close, and we can only hope that Supreme Court will strike down cell phone searches incident to arrest, as the Florida Supreme Court has already done. The next battleground is encryption. The next battleground is the Fifth Amendment, and it is of grave concern that the Fifth Amendment is being watered down by decisions like Fricosu. When the Fifth Amendment was added to the Constitution, it was meant to protect against the Government forcing we citizens to furnish evidence against ourselves. Plain and simple. It doesn’t matter the form of evidence the government seeks to compel, a defendant shouldn’t be forced to provide evidence against himself.