BURLINGTON, VT – A case now before the U.S. District Court in Vermont has far-reaching implications beyond the child-pornography charges that originally spawned it.At issue is whether forcing a suspect to unlock encrypted files on his computer’s hard drive is tantamount to mandating self-incrimination of the sort that violates the Fifth Amendment. Privacy advocates and constitutional scholars say it is; some law enforcement officials say it isn’t.
The debate, which emanates from what is believed to be the first case of its kind, surrounds the government’s desire to view encrypted files on a laptop computer belonging to Sebastien Boucher, a 30-year-old Canadian citizen who is a legal resident of Vermont. In December 2006, he was arrested after a U.S. Customs and Border Protection inspector believed he had found child-pornography files on a laptop Boucher was carrying as he attempted to re-enter the U.S. from Canada. For more than a year, the federal government has been trying to decrypt the suspicious files, which are protected with Pretty Good Privacy (PGP), a software application that is available free online. According to the government, the only way to access the files is with the password Boucher used to encrypt them, and so far he has refused to provide it. Attempting to unlock the code by brute force could take years, the government said.
Boucher’s refusal prompted the feds to ask a court to force him to type in the password — which he said he uses not to hide child porn but to protect the rest of his computer from accidentally downloaded viruses — but on November 29th, a federal magistrate ruled that compelling Boucher to reveal the password would violate his Fifth Amendment rights. Unlike the key to a safe, which is a physical item that defendants can be compelled to provide, the password is stored in Boucher’s head, making revealing it a “testimonial” act protected by the Fifth Amendment, Magistrate Judge Jerome J. Niedermeier ruled.
“If Boucher does know the password, he would be faced with the forbidden trilemma: incriminate himself, lie under oath, or find himself in contempt of court,” the judge wrote.
The government has appealed Niedermeier’s ruling. In the meantime, the debate about the underlying principles has intensified. At issue is whether the government’s responsibility to protect the public from terrorism and other crimes outweighs the rights of individuals who are suspected of committing those crimes. FBI and Justice Department officials have said terrorists and other criminals can use privacy software to communicate covertly, and without the ability to compel them to assist in investigations, the government is hobbled.
Criminals are using “relatively inexpensive, off-the-shelf encryption products,” FBI Assistant Director of Public Affairs John Miller told the Washington Post. “When the intent… is purely to hide evidence of a crime… there needs to be a logical and constitutionally sound way for the courts [to allow law enforcement access to the evidence].”
Mark D. Rasch, a privacy and technology expert with FTI Consulting and a former federal prosecutor, added, “If [the ruling] stands, it means that if you encrypt your documents, the government cannot force you to decrypt them. So you’re going to see drug dealers and pedophiles encrypting their documents, secure in the knowledge that the police can’t get at them.”
Privacy advocates say that may be true, but it’s one of the prices a free society pays for its freedom. The government just needs to step up its technology.
“The consequence of this decision being upheld is that the government would have to find other methods to get this information,” Electronic Privacy Information Center Executive Director Marc Rotenberg told the Post. “But that’s as it should be. That’s what the Fifth Amendment is intended to protect.”
If he is convicted of the interstate or foreign transportation of child pornography charges facing him, Boucher could face up to 20 years in prison.
