The New Jersey Supreme Court has made the Fifth Amendment discussion surrounding compelled production of passwords/ passcodes more interesting. And by interesting, I mean frustrating. (h/t Orin Kerr)
The issue is far from settled and the nation’s top court hasn’t felt like settling it yet. Precedent continues to accumulate, but it’s contradictory and tends to hinge on each court’s interpretation of the “foregone conclusion” concept.
If the only conclusion that needs to be reached by investigators is that the suspect owns the device and knows the password, it often results in a ruling that says compelled decryption doesn’t violate the Fifth Amendment, even if it forces the suspect to produce evidence that could be used against them. Less charitable readings of this concept recognize that “admitting” to ownership of a device is admitting to ownership of everything in it, and view the demand for passcodes as violating Fifth Amendment protections against self-incrimination. The stronger the link between the suspect and the phone, the less Fifth Amendment there is to go around.
This decision [PDF] deals with a crooked cop. Sheriff’s officer Robert Andrews apparently tipped off a drug dealer who was being investigated. The dealer tipped off law enforcement about Andrews’ assistance with avoiding police surveillance — something that involved Officer Andrews telling the drug suspect to ditch phones he knew were being tapped and giving him information about vehicles being used by undercover officers.
Two iPhones were seized from Andrews who refused to unlock them for investigators. Investigators claimed they had no other option but force Andrews to unlock them. According to the decision, there was no workaround available at that time (at some point in late 2015 or early 2016).
According to the State, its Telephone Intelligence Unit was unable to search Andrews’s iPhones — an iPhone 6 Plus and an iPhone 5s — because they “had iOS systems greater [than] 8.1, making them extremely difficult to access without the owner/subscriber’s pass code.” A State detective contacted and conferred with the New York Police Department’s (NYPD) Technical Services unit, as well as a technology company called Cellebrite, both of which concluded that the cellphones’ technology made them inaccessible to law enforcement agencies. The detective also consulted the Federal Bureau of Investigation’s Regional Computer Forensics Laboratory, which advised that it employed “essentially the same equipment used by” the State and NYPD and would be unable to access the phones’ contents. The State therefore moved to compel Andrews to disclose the passcodes to his two iPhones.
Apple implemented encryption-by-default in September 2014. Andrews was arrested in July 2015. This would be about the same time the DOJ was trying to force Apple to crack open an iPhone for it in the San Bernardino shooting case. This was ultimately resolved by an outside contractor (most likely Cellebrite), but it appears that no one had a workable solution when investigators in this case attempted to crack the seized phones.
Andrews challenged the compelled production of passcodes, claiming this violated his Fifth Amendment rights. The trial court disagreed, as did the state appeals court. The state’s top court arrives at the same conclusion.
The state argued it actually knew far more than what’s needed to clear the “foregone conclusion” bar.
[T]he State argues that communication between co-conspirators has no special privacy status, that the State “has established . . . that it already knows what is on the phone[s],” and that the State has a superior right to the contents of the phones because of the unchallenged search warrant.
The court finds in favor of the state, but it does recognize that passcodes are more testimonial than fingerprints or other biometric features used to unlock devices.
A cellphone’s passcode is analogous to the combination to a safe, not a key. Communicating or entering a passcode requires facts contained within the holder’s mind — the numbers, letters, or symbols composing the passcode. It is a testimonial act of production.
It also recognizes there may be no clear way to distinguish between passcodes and biometrics when dealing with compelled production.
We also share the concerns voiced by other courts that holding passcodes exempt from production whereas biometric device locks may be subject to compulsion creates inconsistent approaches based on form rather than substance. The distinction becomes even more problematic when considering that, at least in some cases, a biometric device lock can be established only after a passcode is created, calling into question the testimonial/non-testimonial distinction in this context.
The court says the state has proven enough to be granted the “foregone conclusion” exception to the Fifth Amendment.
The State’s demonstration of the passcodes’ existence, Andrews’s previous possession and operation of the cellphones, and the passcodes’ self-authenticating nature render the issue here one of surrender, not testimony, and the foregone conclusion exception to the Fifth Amendment privilege against self-incrimination thus applies. Therefore, the Fifth Amendment does not protect Andrews from compelled disclosure of the passcodes to his cellphones.
The dissent disagrees. It says that although the tech has changed, the underlying principles of the Fifth Amendment haven’t. And it’s not just the dissent saying this. It’s also the nation’s top court, which has never held that the compelled production of incriminating testimony complies with the Constitution.
In a world where the right to privacy is constantly shrinking, the Constitution provides shelter to our innermost thoughts — the contents of our minds — from the prying eyes of the government. The right of individuals to be free from the forced disclosure of the contents of their minds to assist law enforcement in a criminal investigation, until now, has been an inviolate principle of our law, protected by the Fifth Amendment and our state common law. No United States Supreme Court case presently requires otherwise. No case from this Court has held otherwise. That protection deserves utmost respect and should not be lessened to authorize courts to compel a defendant to reveal the passcode to a smartphone so law enforcement can access its secured contents.
Given the current split in both federal district courts and state courts on the issue, the dissent says the New Jersey Supreme Court shouldn’t be an enabler of potential Fifth Amendment violations in the absence of US Supreme Court precedent.
Until the Court clarifies its intentions about application of the act of production doctrine in this setting, I would follow the only sure directional signs the Court has given…
Things may be slightly harder for investigators at the moment, but it’s not the court’s role to make things easier for the government. They’re supposed to be a check against government power grabs, not an ally in its attempts to limit the protections it supposedly granted to its citizens. We live in a “golden age of surveillance.” There’s more information available in unencrypted form than there’s ever been. And the arms race between device makers and encryption crackers is ongoing. It hasn’t ended and device encryption has not been declared the winner.
Law enforcement must find another means of obtaining access to the encrypted substantive information on two cell phones whose contents it wishes to search and for which the government has a search warrant. Technological barriers must be overcome without sacrificing constitutional, deep-seated historical protections against governmental intrusions forcing individuals to become assistants in their own prosecutions. Modern technology continues to evolve, bringing new problems; but it also may bring new solutions.
But that’s just the dissent. The majority says the Fifth Amendment can be bypassed if the state can find enough connective tissue between the locked device and the person who refuses to unlock it.