I recently came across a story in the news about a woman who has been ordered by a judge to produce the unencrypted contents of her hard drive by February 21 or be charged with contempt of court. The woman, Ramona Fricosu from Colorado, claims that doing so is a violation of her Fifth Amendment right to not incriminate herself, but the judge has ruled otherwise. He says producing the unencrypted contents of the hard drive is not a violation of the Fifth Amendment.
Before reading this article, I had never given much thought to how digital evidence is handled in criminal cases. I always assumed the property of the defendant was seized, and then the officials turned it over to computer forensics experts who recover the necessary evidence. However, it is very easy today and getting more common to encrypt one's entire hard drive. If done properly, recovering the information on the hard drive is nearly impossible without the password.
It has been argued before the forcing the defendant to give up their password violates their constitutional rights, but this judge is circumventing that issue by simply requiring the defendant to provide the unencrypted contents of the hard drive. That means Ramona would be the one entering her password, and she would still be able to keep her password a secret.
The defendant's lawyer, Phil Dubois, had a great response. He said that his client may be unable to decrypt the drive's contents for any number of reasons (like conveniently forgetting her password). If so, Phil states "we'll report that fact to the court, and the law is fairly clear that people cannot be punished for failure to do things they are unable to do." Oh, lawyers. Still, he's got a point. It is very critical that our law system remains that way. If the court punished Ramona for not producing her hard drive unencrypted, and it really was because she had forgotten her password, that would be terrible indeed.
But what about the judge's order to Ramona? Do you think he's right? Is it a violation of the Fifth Amendment right to order you to produce your hard drive unencrypted? There's no easy answer to this question. If it is a violation of the Fifth Amendment and no one can be forced to do so, every digital criminal out there has to simply keep their hard drive encrypted and prosecution becomes much more difficult. If it isn't, that gives the government a scary amount of authority. The idea of the government being able to seize your digital information at will is something people all over the Internet have been fighting for decades. But it's not so different from the court issuing a search warrant of your property and entering your home uninvited.
In the end, I side with Ramona. I have no idea if she's guilty or not. But I do feel asking the defendant to produce evidence for the prosecution to use against them is sort of asking for self-incrimination, and that violates the Fifth Amendment. Yes, that would make prosecuting other digital criminals much harder, but not impossible. Digital encryption is not always implemented correctly, and there are ways to capture the data as it flows in and out of the suspect's machine (assuming the court has authorized some sort of wire tap). Sometimes our justice system lets the guilty go free, but I would rather two guilty men go free than an innocent person spend their life behind bars.
It really should be the same as any other physical evidence: requiring a warrant. If someone has a safe in their house that an officer has a warrant for, the individuals are required to open it. If not (even if the combination has been forgotten), entry into said safe might be forced to get at the contents. No Fifth Amendment rights violated.
ReplyDeleteSimilarly, I believe that Ramona really should be required to empty the contents of that "safe" for the court, but only if a proper warrant has been prescribed.
Right. I agree that its perfectly fair for the police to seize the person's computer and data on the computer. I'm still not convinced that the law can require the defendant to produce their digital data unencrypted. How could they enforce that? What if the defendant really does forget the password? And is the act of changing the data from encrypted data to evidence self-incriminating? However, I'm all for the government seizing and doing all they can by other means to decrypt/recover the data.
ReplyDeleteLike I mentioned, it's perfectly legit if someone forgets the password, just as if they forgot the combination to a padlock. If true, then they can hack their way in the hard way. Contempt of court if they are found out to be lying, etc., etc.
ReplyDeleteChanging the data from encrypted data to unencrypted data is no worse than changing a document from being inside a safe to outside a safe. That's my opinion on the matter, and I feel it's a fair analogy. :)