Suspect can’t be compelled to reveal “64-character” password, court rules

The Fifth Amendment to the US Constitution bars people from being forced to turn over personal passwords to police, the Pennsylvania Supreme Court ruled this week.

In a 4-3 ruling, justices from Pennsylvania’s highest court overturned a lower-court order that required the suspect in a child-pornography case to turn over a 64-character password to his computer. The lower-court ruling had held that the compelled disclosure didn’t violate the defendant’s Fifth Amendment rights because of statements he made to police during questioning.

“It’s 64 characters and why would I give that to you,” Joseph J. Davis of Pennsylvania’s Luzerne County told investigators in response to their request for his password. “We both know what’s on there. It’s only going to hurt me. No fucking way I’m going to give it to you.”

A foregone conclusion

Prosecutors in the case said a legal doctrine known as the “foregone conclusion exception” permitted the compelled disclosure of Davis’s password. The doctrine, which originally applied to the compelled production of paper documents, said Fifth Amendment protections against self-incrimination don’t apply when the government already knew of the existence, location, and content of the sought-after material.

In requiring Davis to turn over his password to investigators, the lower-court agreed with prosecutors that the password demand fell under the foregone conclusion exemption. The lower court said the exception applied because, under previous US Supreme Court precedent, the password was tantamount to a key or other tangible property and didn’t reveal the “contents” of the defendant’s mind.

The majority for the Pennsylvania Supreme Court disagreed. Writing for the majority in a ruling handed down on Wednesday, Justice Debra Todd wrote:

Based upon these cases rendered by the United States Supreme Court regarding the scope of the Fifth Amendment, we conclude that compelling the disclosure of a password to a computer, that is, the act of production, is testimonial. Distilled to its essence, the revealing of a computer password is a verbal communication, not merely a physical act that would be nontestimonial in nature. There is no physical manifestation of a password, unlike a handwriting sample, blood draw, or a voice exemplar. As a passcode is necessarily memorized, one cannot reveal a passcode without revealing the contents of one’s mind. Indeed, a password to a computer is, by its nature, intentionally personalized and so unique as to accomplish its intended purpose―keeping information contained therein confidential and insulated from discovery. Here, under United States Supreme Court precedent, we find that the Commonwealth is seeking the electronic equivalent to a combination to a wall safe—the passcode to unlock Appellant’s computer. The Commonwealth is seeking the password, not as an end, but as a pathway to the files being withheld. As such, the compelled production of the computer’s password demands the recall of the contents of Appellant’s mind, and the act of production carries with it the implied factual assertions that will be used to incriminate him. Thus, we hold that compelling Appellant to reveal a password to a computer is testimonial in nature.

https://arstechnica.com/?p=1622515