A 17-year veteran and former sergeant of the Philadelphia Police Department who’s suspected of – but not formally charged with – possession of child abuse images has been found in contempt of an order to decrypt two hard drives.
The “John Doe” has already been imprisoned for 7 months in Philadelphia’s Federal Detention Center.
He’ll stay locked up indefinitely until he decrypts the drive, the court has ordered (PDF), saying that he “[carries] the keys to his prison in his own pocket.”
His lawyer has argued (PDF) that producing the passcode, stored as it is in his client’s brain, would violate his Constitutional rights regarding self-incrimination:
… the order transgresses the Fifth Amendment guarantee that no person shall be compelled to be a witness against himself.
The attorney, Federal Public Defender Keith Donoghue, urged a federal appeals court on Tuesday to release his client immediately, pending the outcome of appeals:
Not only is he presently being held without charges, but he has never in his life been charged with a crime.
This is yet another case in which prosecutors are focused on getting past Apple’s encryption: the suspect’s drives are encrypted with Apple’s FileVault software.
The government is taking the same legal tactic here as it did in cases involving iPhones of the San Bernardino terrorist and a Brooklyn drug dealer: it’s citing the All Writs Act to compel decryption.
The All Writs Act, a statute that’s been around since 1789, allows courts to issue writs (orders) “necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.”
In the first case, the government was trying to get at data on the phone of a shooter in an attack that left 14 dead in San Bernardino, California, in December. It used the All Writs Act as it tried to compel Apple to write a backdoor to get around a security feature that wipes a device after 10 failed password attempts.
The government withdrew the case after reportedly paying a mysterious third party to do the backdooring that Apple refused to do.
In the case of the Philadelphia child porn suspect, Donoghue argues that the Supreme Court has already said – in cases from 2000 and 1988 – that suspects can’t be forced to disclose the sequence of numbers that will open a combination lock.
That “clearly” points to a similar decision regarding compelled disclosure of the sequence of characters constituting an encryption passcode, the attorney wrote.
But as Ars Technica’s David Kravets notes, a federal appeals court ruled in 2012 that a bank-fraud defendant could be compelled to decrypt her laptop. Similar to the fight over the San Bernardino iPhone, that ruling wasn’t enforced, given that prosecutors got the password elsewhere.
The Philadelphia case began last year, with a local investigation into an anonymous file-sharing network called Freenet.
The government’s relying on the testimony of two witnesses. One was John Doe’s estranged sister, who claims that she looked at child abuse imagery with him on his computer. The other was a forensic examiner who said it was his “best guess” that the hard drives would contain illegal sexual content.
The Electronic Frontier Foundation (EFF) and the American Civil Liberties Union (ACLU) have filed a friend-of-the-court brief (PDF) in which they backed up the suspect’s Fifth Amendment argument, saying that…
…compelled decryption is inherently testimonial because it compels a suspect to use the contents of their mind to translate unintelligible evidence into a form that can be used against them. The Fifth Amendment provides an absolute privilege against such self-incriminating compelled decryption.
The court, for its part, is bypassing arguments over the Fifth Amendment altogether, arguing (PDF) that courts have the authority to hold persons in contempt, without a trial:
Civil contempt orders are intended to be coercive or compensatory in nature, and do not require… a jury trial.
Image of Jail courtesy of Shutterstock.com
“Civil contempt orders are intended to be coercive or compensatory in nature, and do not require… a jury trial.”
what? this doesn’t sound write to me. I’m sorry i don’t support any form of child abuse, but this guy hasn’t been convicted of a crime. I do not support any judge that decides to throw a man in jail until the end of time because the investigators haven’t found the evidence they need. I don’t believe that a man should be forced to pour out the entire contents of his digital life that was always intended to be private for any reason.
If this guy truly took part in this kind of disgusting acts, the investigators should be able to prove it in other ways, and we know that there are other ways for them to do it.
Good guy or bad guy, i believe we all have the rite to privacy. I do understand this is not a popular option, but its a very slippery slope telling people that the court has this power.
Thank you for the comment. I agree with you. It sucks that at times the law is on the side of some real terrible people but we have to be careful not to give to much power to the government who is not always looking out for the common interest. But, the guy wants to play the game then he has to play it to the fullest with contempt charges…it apart of the game.
The problem is, I feel, is that in cases where individuals refuse to decrypt their devices, that the courts will attempt to prolong their incarceration via contempt charges. In a way this is a legal loophole, but until this issue gets sorted out that is the game everyone passionate about privacy/security/government intrusion must play.
this is true, but i don’t believe its the correct thing for us (as a people) to do. one of the principles of our (I assume your an American) country is a rite to a fair and speedy trial. as far as i see this order goes against both of those points.
What i would like to see is people given a choice. you unlock your device (phone, drive, or whatever) or you face charges….. something. the something will have to be determined. But to lock someone up and say they will be in there forever is unreasonable. i think its cruel and unusual punishment.
on second thought maybe contempt of court is the correct charge, but still there needs to be a limit to it. there are people who have murdered multiple people that got out of prison, why should this guy potently get a longer sentence for not showing his private data that may or may not have illegal data on it? and even more so, why should i pay to keep him locked up for a crime he may or may not have committed?
Either way we need to get this all figured out sooner than latter.
P.S. Thanks for bringing up a reasonable point of view.
@ Heavyjunk562
“… It sucks that at times the law is on the side of some real terrible people…”
It sucks that at all times the law is on the side of a tyrannical government. Just as with so-called “civil forfeiture,” due process is a dead letter.
Warm up the tar and pluck the chickens!
It IS a popular opinion to have a right to privacy for all who are innocent until proven guilty and that includes those charged with a crime. Its the people who seek tyrannical power that say things like “Do you want a pedophile to be protected?” Until he or she is convicted of being a pedophile, they are an innocent citizen just like you or me.
I once worked as a lawyer, defending other lawyers named in civil case which arising out of bank and securities fraud. I can see why a person might be surprised that claiming the Fifth Amendment right not to incriminate oneself would not allow this person to refuse to turn over his password, but- like most things in the law- the constitutionally right not to provide evidence is subject to limits that most lawyers who haven’t worked with it aren’t even familiar with.
I found an article that provides a reasonable and accessible overview of why ‘invoking the Fifth’ is not an absolute privilege to disobey a court order: “HOW CAN PEOPLE BE HELD IN CONTEMPT AFTER INVOKING THE 5TH AMENDMENT?” Here’s the link: http://www.todayifoundout.com/index.php/2014/01/can-people-held-contempt-invoking-5th-amendment/
The ‘right to privacy,’ also based in the First and Fourth Amendments is a subject that has been litigated in countless Supreme Court court cases, and evolves to adapt to new issues- like whether a person can refuse entry to their computer based on the Fifht Amendment. Think of it this way: if the police showed up to this man’s front door, with a civil warrant, and he said “No, you can’t come in, because you might find something that would incriminate me in a crime.” The fact that it’s his computer that’s locked is no different than a locked door to the house.
Anyway, hope this info is helpful,
In that scenario, the resident shouldn’t be compelled to give the combination to the front door lock. With a legal warrent, they can break down the door with a ram.
Same deal with the encryption. Go ahead and decrypt it if you can, but the suspect shouldn’t be forced to give the key.
So what you’re saying is that court orders like search warrants have no purpose because you can just ignore them. Then it’s the court’s problem to figure out how to bypass the block you have placed on the search. Therefore the court has no authority, because you can treat it with contempt without penalty.
Presumably you also think that traffic stops should be optional, even if there is very strong evidence you just did someting both illegal and dangerous, like crashing a red light. You should just drive away, and then it’s up to the cops to chase you down (and to hell with the danger to other road users) and then…er, then what? Drive you off the road? Pop caps in your fuel tank? Ask you even more politely to stop this time?
Not being an American, you don’t understand the concept of American liberty. You’re out of your element in this argument.
This isn’t really about liberty, American or otherwise. (American liberty seems to involve a lot of talk about statutory privileges, all the while locking people up at four times the rate of the UK. So perhaps it is you who doesn’t understand the concept of British liberty, which my dictionary defines in a rather uncomplicated way as “the state of not being imprisoned”?)
I’d say this is an interesting tension between the Fourth and Fifth amendments, and about how much power a court should have to deal with what the law would unexceptionably consider contemptuous behaviour if the search involved brick walls or safe-deposit boxes.
Ironically, sorting this one out so that lawful search and seizure and the right to silence come out of tension might be an interesting way of winning (or at least of putting on hold) the argument that says it’s a very, very, very bad idea to put mandatory backdoors in encryption products.
Perhaps we’re in some alternate universe… What happened to innocent until proven guilty? And where is the right not to incriminate oneself?
If he is truly guilty, then I don’t condone his acts at all and he should be punished – after due course. But now it sounds like the court is trying to get criminals to line up and rat themselves out.
I must admit, I’m shocked any prosecutor or judge would think this is right and consistent with the Fifth Amendment. I sincerely hope this case makes good law as the police officer sitting behind bars has already paid way too much for it.
I’m interested that Lisa didn’t mention the Fourth Amendment. I’m neither a lawyer nor an American, but it seems to me that cases like this are about failing to comply with a search warrant rather than about the right to silence.
It seems that the court hasn’t ordered that the password be divulged but rather that the data be decrypted. That can be done without revealing the password, so no “testimony” is required.
AFAIK you can’t “take the Fifth” to avoid compying with a lawfully-issued search warrant requiring you to open a safe or to unlock a cupboard, and you can be held in contempt if you refuse to comply.
I’ll ignore the issue of whether courts should be allowed to compel you to decrypt files or not, and just say that it’s not clear how the Fifth comes into this one, given that testimony is not a necessary part of complying with the court order. The suspect wouldn’t be a witness against himself. The data would.
Score! For a non-American, non-lawyer, you show an excellent grasp of the our Constitution. There is a difference between evidence and testimony. The Fifth Amendment protects you from being compelled to testify against yourself, but you CAN be compelled to produce evidence; that’s what search warrants are for. The possible evidence stored on the device is just that: potential EVIDENCE, not testimony. And providing the credentials to unlock it does not require testimony either. This is just a typical legal maneuver by the defense attorney.
Thing is, he wouldn’t even even have to provide the credentials to unlock the device. It would almost certainly be possible for the suspect to enter his own passcode to unlock the Apple Core Storage volume, and then copy the data off to an unencrypted disk. That way, the FBI would never know any part of any key that had been in use.
(As an interesting aside: if he had a printed copy of the FiewVault recovery key as a backup, rather than just a passcode in his head, would he be able to take the Fifth in respect of the printout of the key, and have it suppressed? If so he’d be claiming that handing it over the printout – of a password he didn’t think up himself and had never “known” in any real sense – would count as testimony.)
Silly argument. If you think the government would give him enough privacy to “enter his own passcode to unlock the Apple Core Storage volume, and then copy the data off to an unencrypted disk”, you’re slipping away into an alternate universe.
He only has to unlock the Core Storage volume. Someone else can copy the data off once it’s unlocked. If your attorney isn’t up to the job of negotiating a suitably objective way of doing this, following a procedure that would as good as remove the chance of the actual password being videod or keylogged along the way, then you need a new attorney :-)
(As a vaguely related aside, read the court order in the FBI-versus-Apple case. The FBI was IMO fairly canny in that document about providing for a “neutral zone” in which the court order could be complied with. Apple’s objection, of course, wasn’t about those provisions, but at a higher level about backdoors.)
Anyway, you only really get to make your argument after you’ve agreed to submit to with a search that complies with the Fourth…then you get to argue about how to decrypt the data without getting tricked into giving away something you know under false pretences.
It would be interesting to know how “the government” (you guys use that word a lot, though I’m not sure quite what it means here? judiciary? law enforcement? DOJ?) responds to a requests for a neutral way to decrypt data without fear of being “phished” for the Fifth-amendment-protected passcode.
Does anyone know how they do this? It must have come up before now…it seems to me very similar to the issues of how you ensure and assure privacy for attorney-client meetings while the client is remanded in custody.
Sorry, Steve. This is an argument from a Public Defender, who as a group typically don’t have as much sway as elite attorneys. He is nevertheless correct, and you and your British bloke are lost in the weeds. Innocent until proven guilty. Not “presumed guilty until proven innocent”.
Hopefully, you don’t have an estranged sister who may accuse you some day.
This is precisely why the fifth amendment was added. Otherwise the defendant can jailed indefinitely for not remembering the passcode. The judge says, “tell us the thing that will send you to jail or we will send you to jail until you do.”
The judge is feigning ignorance by saying that the defendant needs to produce the unencrypted information, but that’s like saying, “you don’t have to confess, you just have to provide a written confession; how you produce it isn’t the court’s concern.”
The rule in the US is this: the contents of your mind cannot be subpoenaed. Not directly, not indirectly. This judge is going to get slapped down by a superior court and with good reason.
But this case isn’t about the suspect (he is not a defendant yet) being detained for forgetting his passcode. That’s a red herring! He’s being detained for contempt of court: the court has ordered him to comply with a search warrant by decrypting his data and he is refusing to do so.
If he has genuinely forgotten his passcode, then that’s that. He *can’t* comply with the warrant. Of course, that’s a dangerous gamble for any suspect if they *haven’t* forgotten the passcode. For example, there may well be evidence elsewhere that would convince a jury that the computer was used by the suspect after the time they claimed to have forgotten the passcode, and that would not end well. (Of course, it’s a gamble you might take if you were guilty and the penalty for perverting the course of justice were lower than the penalty for what the disk would surely prove you did.)
Your claim that decrypting the data is like being forced to produce a written confession instead of a verbal one is wrong. The suspect isn’t being asked to confess to anything, so using that word is a furphy.
What is covered by the search warrant, as far as I can see, is *not* the “contents of his mind.” Quite the opposite: what has been subpoenaed is entirely objective (and might exonerate the suspect for all we know), the contents of his hard disk. And, hey, subpoena means “under penalty,” which is what has happened.
In short: this whole issue is much more than just the “right to silence”.
Carrying the logic of the judge who jailed this suspect to its logical conclusion, any witness in a courtroom or a police interrogation room who invoked his fifth amendment rights by refusing to answer a question could be held in contempt and jailed without trial. This effectively repeals the Fifth Amendment. I think this is a rather egregious case of overstepping judicial authority. This judge is not only legislating from the bench, he/she is amending the constitution!
The offence is a bit of a red herring here and detracts from the argument. Distil it down – man jailed indefinitely because he won’t or can’t produce an encryption key.
How many of us have forgotten passwords?
What if he had been using TrueCrypt with it’s hidden volume options? If this man produces ‘a’ password which decrypts something does that fulfil the requirements of the order? Would he then stay in jail until he produces the ‘right’ answer.
I don’t know the answer but it’s certainly interesting.
I keep all my passwords in a text file encrypted with TrueCrypt ( which may or may not be breakable ). I also use it to encrypt my work data on my laptop. I also use a hard drive password. All in case my laptop gets stolen. I should have the right not to be compelled to unlock any of those by any person or entity for any reason. As we have seen time and time again, folks in a position of authority are not always people of high moral and ethical standards.
Surely the right not to incriminate oneself is really just the right to say “no comment”? If a search warrant is obtained for premises and (say) photographs of child pornography are found, then that is evidence. Why should encryption provide protection against this? I understand the arguments of “innocent until proven guilty” but it does seem to me that we have to draw the balance between privacy and justice.
He may not have indecent images on the computer, but could have something else there. But that is really no different to anything else police would find executing a physical search under warrant.
Perhaps we could consider an independent (and I do mean independent) service where the police say what they are looking for, the suspect provides the password and the independent service checks for what the police have asked for, and confirm that it doesn’t exist, or if it does exist, only supply what was requested. This protects the suspect from an intrusion into privacy beyond what is in the search warrant (thus preventing “fishing expeditions”).
Let’s remove the “child porn” charge for just a moment, because that’s the eternal argument of the tyrannical class – “it’s for the CHILDREN”! Let’s say it’s … an accusation against a reporter known for her liberal sympathies. Her estranged brother – a Trump supporter – claims to have viewed a document on her laptop that details a plot for Trump’s slow and painful death. A forensic examiner has weighed in, stating that it is his “best guess” that death threats would be found on the computer. The judge demands she decrypt her hard drive, and jails her on a contempt charge. Does this still pass the sniff test?
(I know this is reaching, but there have been similar situations)
What if someone is charged with withholding evidence, but isn’t?
The plot of another person to jail the accused for personal reasons. Abusing the legal system to commit the crime of kidnapping and indefinite detention.
This is why “innocent until proven guilty” is part of the US legal system. (Unfortunatly due to the former Patriot Act, and the new Freedom Act, this right no longer exist if accused of a supposed terrorist plot, activity – with no legal definition)