A federal judge in Colorado has ruled that decrypting a computer hard drive does not count as self-incrimination under the Fifth Amendment. Judge Robert Blackburn has ordered Ramona Fricosu, who is charged with fraud, to release the contents of her computer's encrypted hard drive. Fricosu had argued that doing so would require her to essentially testify against herself, something which is prohibited by the US Bill of Rights.
The case is one of a handful in the past few years that have addressed whether defendants can be legally forced to provide access to encrypted information. In March 2010, a Michigan district judge rejected a subpoena to force Thomas Kirschner to give up access to his computer on Fifth Amendment grounds. In Vermont, however, Sebastien Boucher was required to decrypt an incriminating hard drive — the court reasoned that although the password might be considered protected information, the contents of the drive itself could be considered evidence. This second case was cited by Blackburn in his ruling.
Although a precedent is far from established, groups like the Electronic Frontier Foundation have argued that "this could be a very important case in applying Americans' Fifth Amendment rights in the digital age." So far, no ruling has required the password itself to be given up, but this case suggests that keeping the contents of an encrypted drive secret is far from an unassailable right.
Image Credit: M Thierry (Flickr)

There are 39 Comments. Add yours.
Honestly, it seems fair to me. The whole point of the fifth amendment is to prevent a suspect having to be a witness against themselves, something which is defined as to give testimony, whether written or oral. Providing the pass key to your digital files seems no different to being forced to provide a code for a safe or the keys to your lock up, both of which happen all the time.
Posted on Jan 23, 2012 | 10:17 PM EST reply Recommend Flag actions
Do they? That’s what I was wondering about and came here to see if anyone had answered. If the government in a trial could force you to give up the records of your correspondence, your archived files, your diary/journal, and whatever else in paper terms, then this seems consistent.
Posted on Jan 23, 2012 | 10:37 PM EST reply Recommend (2) Flag actions
I tend to agree, at least in regards to the information itself. The fact that this is digital information doesn’t mean it’s not evidence, and you can’t withhold evidence. However, I think their argument is that the act of saying the password itself as it were is the same as testifying against oneself. And here I’m not sure exactly where I sit, it’s a bit of a grey area. After all, let’s say you robbed the place, but when they ask you where you were you can plead the fifth (if my understanding is correct), so then is providing the password the same or not?
Posted on Jan 23, 2012 | 10:40 PM EST reply Recommend Flag actions
The Fifth Amendment does not take into account the current digital age we currently live in. When the constitution was written there was no such thing as encryption. With that being said giving access to files encrypted which you know would implicate you is the same as testifying. I feel this ruling was made under flawed understanding of the situation.
Most of these judges are old and are not up to date with technology and how it is implemented and affects judicial rulings. The courts understanding of tech needs to be improved to catch up with the current century
Posted on Jan 23, 2012 | 10:47 PM EST reply Recommend (8) Flag actions
Uhh yes, you idiot, they did have encryption. As well as keys for the codes. The founding fathers them selvs used them a lot. As did ancient civilizations thousands of years ago.
Posted on Jan 24, 2012 | 7:21 AM EST reply Recommend (2) Flag actions
I’m not American, but what if one used Ancient Chinese or something as simple as Caesar’s code to ‘encrypt’ one’s diary? Do you think one should be forced to reveal how the data is encrypted? I don’t think so. They have the disk, let them do with it what they won’t but providing password to the data seems to be invading one’s rights (of course I have no idea what is the Fifth Amendment about… – just a layman’s opinion).
Posted on Jan 24, 2012 | 8:42 AM EST reply Recommend (1) Flag actions
This is exactly the issue. Revealing your password or encryption key is testimony. I can’t be compelled to testify as to the code to my safe or its contents any more than my digital accounts. If the government wants to build a case against someone, the burden of proof falls on them. The degree to which modern law enforcement assumes it has authority to go through people’s personal property, lives and knowledge is sickening. The only reason this is an issue is because the Fourth Amendment is totally eroded, now they’re just moving on to the Fifth by way of this encryption tactic.
Posted on Jan 24, 2012 | 12:48 PM EST reply Recommend (1) Flag actions
While not law, most courts have held the opinion that being forced to provide the combination to a safe is unconstitutional as it is a “product of the mind,” whereas a key is physical evidence. I would argue that a pass phrase for encryption is a “product of the mind.”
Also, (and this is a real question. not rhetorical) what would happen if the dependent simply said, “I’m sorry your honor, I can’t remember the pass phrase?”
Posted on Jan 23, 2012 | 11:12 PM EST reply Recommend (3) Flag actions
Probably the same thing that happens when you lose a key?
I don’t know what that might be.
We need Nilay in here to explain everything to us :(
FTR, I’m pretty sure in the UK it’s illegal not to disclose your encryption keys if the law calls for it. I remember a huge controversy about it ten years or so ago.
Posted on Jan 24, 2012 | 12:27 AM EST reply Recommend Flag actions
I agree.
I think the court should have the right to compel the evidence be made available.
Yet I think the prosecution should be precluded from using the fact that the defendant knew the password as grounds to say the information contained was theirs.
That, to my mind, mitigates the idea that the defendant is testifying against themselves by opening the lock.
They should be able to state it was encrypted though, just not how they unencrypted it.
On the other hand – if the police find the password to the drive written on a piece of paper in the person’s wallet (and that is found with a valid search) then that should be admissible as evidence that the person had access to the information.
Posted on Jan 24, 2012 | 10:06 AM EST reply Recommend Flag actions
First prove the drive is actually encrypted. It could just be pseudorandom numbers meant to look like encryption.
Posted on Jan 23, 2012 | 10:27 PM EST reply Recommend (4) Flag actions
This is why you should always use a “hidden volume”. Two passwords, so when you “give in” to the judge, they get the “public” decrypted volume, not the real (hidden) one
Posted on Jan 23, 2012 | 10:32 PM EST reply Recommend (6) Flag actions
Or just don’t put yourself in a position where you need to hide information from a judge. That works too.
Posted on Jan 23, 2012 | 10:34 PM EST reply Recommend (11) Flag actions
That kind of logic leads to 1984.
Posted on Jan 23, 2012 | 10:46 PM EST reply Recommend (15) Flag actions
Not in a society that allows the government to put an asterisk next to Constitutional rights as it sees fit, it doesn’t. When you can be named an enemy combatant and detained indefinitely without a trial or any sort of recourse, one can never be certain that one isn’t in possession of information that will lead to incarceration if disclosed or even acknowledged.
Posted on Jan 23, 2012 | 10:48 PM EST reply Recommend (11) Flag actions
You don’t think you’re doing anything wrong now. Wait until someone in power thinks differently…and they have the power to act on it.
Posted on Jan 23, 2012 | 11:12 PM EST reply Recommend (1) Flag actions
The Verge commenters seem overly paranoid to me…
Posted on Jan 23, 2012 | 11:22 PM EST reply Recommend (1) Flag actions
Yeah I think I have a much bigger risk of an elderly fella’s heart stopping on the interstate, running me off the road and sending me to my grave as opposed to the government destroying my life on some bogus information.
Posted on Jan 24, 2012 | 12:04 AM EST reply Recommend (1) Flag actions
It’s not about the likelihood of any one person being the victim of government missteps and overreaching, it’s about the injustice of anyone being subject to it. I sound like a crazy libertarian when I start talking about constitutional rights, but I really do think when it comes to these investigatory powers, we should do all we possibly can to make it harder for them to go through our lives, ship us to military prisons, and generally run roughshod over any idea of common law.
Posted on Jan 24, 2012 | 12:51 PM EST reply Recommend Flag actions
“If you’re not doing anything wrong, you have nothing to hide.”
I love the smell of authoritarian logic in the morning. There are generally two options: have Person X prove that they should have access to Person Y’s material, or prove that Person Y should not have to provide access to Person X.
Guess which one is easier? Hint: proving a negative is much more difficult.
Posted on Jan 26, 2012 | 9:26 AM EST reply Recommend Flag actions
From SOPA to the recent Defense bill that allows the indefinite detention of US citizens….for the past few years we’ve been walked not up to the line but over it. Patriot Act was bad enough but we are advancing even past that.
I’m just starting to feel uneasy about rights in general. As we confront these unique issues in the digital and information age liberty really is more often than not on the losing end when Washington gets involved.
I just hope this isn’t a time where we look back in 30 years and say “that’s when we began to lose our way as a nation”.
Posted on Jan 23, 2012 | 10:52 PM EST reply Recommend (4) Flag actions
How does SOPA fit into laws that affect Americans? I would think that you would use the NET Act of 1997 and DMCA of 1998 as examples. I trust you know what you’re talking about, so I’m open to an explanation.
Posted on Jan 23, 2012 | 11:50 PM EST reply Recommend Flag actions
We have no “rights”. Rights can’t be taken away. Everything we considered to be a “right” already is being taken away. This is not a free country. It’s a police state.
Posted on Jan 24, 2012 | 12:52 AM EST reply Recommend Flag actions
re: indefinite detention of US citizens:
to piggy back on what @NanoGeek above… “Or just don’t put yourself in a position where you need to [be detained]. That works too.”
uber sarcasm. we live in scary times peeps.
Posted on Jan 24, 2012 | 1:29 AM EST reply Recommend Flag actions
This is a tough one, and I had to give it some thought. In the end, I’ll have to side with the given verdict. A criminal who thought of encrypting their drive shouldn’t get away with a crime while a criminal who didn’t encrypt their drive gets penalized. Like someone above said, it’s just like having to unlock a door. The fact that it’s digital shouldn’t suddenly shift the issue from an “physical object” analogy to a “speech” analogy.
Posted on Jan 23, 2012 | 11:17 PM EST reply Recommend Flag actions
“…doing so would require her to essentially testify against herself, something which is prohibited by the US Bill of Rights.”
Incorrect. Under the US Bill of Rights, specifically the Fifth Amendment (because the other 9 aren’t relevant in this discussion), you are allowed to prevent yourself from testifying in a way that would incriminate yourself. You have that right to “plead the Fifth”. You also have every right to testify against yourself if you’d like to. The Fifth Amendment doesn’t prohibit you from testifying against yourself.
Posted on Jan 23, 2012 | 11:39 PM EST reply Recommend Flag actions
You’re misreading it. The entire phrase “require her to essentially testify against herself” specifies what is prohibited, not just “testify against herself”.
Posted on Jan 24, 2012 | 12:36 AM EST reply Recommend Flag actions
Not a difficult thing to misread, though.
Posted on Jan 24, 2012 | 12:52 PM EST reply Recommend Flag actions
does anyone know if there is any precedent in regards to shorthand or a cipher? I’d guess that an ‘encrypted’ ledger would be an older equivalent which must have come up at some point in the past.
Posted on Jan 23, 2012 | 11:50 PM EST via mobile reply Recommend (1) Flag actions
Have you ever stopped to think why the protection against self-incrimination even exists? Why should that part of the Fifth Amendment even exist? Why should people be protected from themselves anyway—shouldn’t the goal of the legal system be to get to justice without arbitrary rules? Here is some history.
It’s damn interesting.
One thought: it may go back to English law and protection of one’s faith.
Another thought: the testimony may be for someone else’s trial — your testimony may be self incriminating. For the sake of thoroughness in the first case, you may be conferred immunity to give up your right to remain silent.
Posted on Jan 24, 2012 | 12:23 AM EST reply Recommend Flag actions
I like how the “All Writs Act, a 1789 statute” is used to apply to 21st century technology.
Posted on Jan 24, 2012 | 12:46 AM EST reply Recommend Flag actions
If you were to use a password that would incriminate you such as: “I buried the body behind the saw mill” it would qualify under the fifth amendment.
Posted on Jan 24, 2012 | 12:47 AM EST reply Recommend Flag actions
There should be a massive new amendment dealing with technology. If this would ever happen, they better not get it fucked up or all hell will break loose. Hahaha.
Posted on Jan 24, 2012 | 12:48 AM EST reply Recommend Flag actions
What if you simply forgot the password?
Do any encryptions self destruct after 3 failed attempts…mmm
Posted on Jan 24, 2012 | 12:55 AM EST reply Recommend Flag actions
Just to be clear, encryption our cryptology has been around for thousands of years. Im sure these issues have come up in the courts before.
Posted on Jan 24, 2012 | 12:55 AM EST via mobile reply Recommend Flag actions
From Wikipedia:
In the U.S., the only way for one to protect one’s rights fully is to refuse answering any questions beyond giving one’s name and identifying papers if requested and to refuse giving consent to anything (such as a search) prior to one’s arrest.20 Law enforcement officials do not have to tell civilians the truth on any subject. They can make any promises and claims they like in order to induce a person to incriminate herself or himself or to allow the officer to perform a search, and law enforcement officials are not bound by anything they promise to suspects or witnesses (i.e. promises of aid or protection).21 Raffel continues to be upheld in U.S. Courts despite the apparent contradictions with Miranda. In Re Grand Jury Subpoena to Sebastien Boucher,22 the U.S. District Court for Vermont ruled that because the defendant had already cooperated as far as he had and already potentially incriminated himself, by stating his ownership of his laptop and providing law enforcement with partial access to it prior to his arrest, that he must now surrender complete access to all information on that laptop, even encrypted and potentially self-incriminating or confidential information.23 Because the defendant had cooperated in part already, the Court ruled that the defendant must continue cooperation and provide the decrypted and potentially harmful information to the government. This is particularly noteworthy since prior U.S. Supreme Court rulings normally protect suspects even after conviction from the requirement of revealing self-incriminating information such as locations of their victims’ bodies and/or property.
http://en.wikipedia.org/wiki/Right_to_silence#United_States
The moral of the story seems to be don’t give any consent at all for anything or you can be forced to comply… I’m not sure how it is that it makes sense that your 5th admendment rights can be nullified by an act of good faith but from what I’ve seen of the legal system (on the “good” side) it’s par for the course.
Posted on Jan 24, 2012 | 1:02 AM EST reply Recommend Flag actions
huh? So if you incriminate yourself a little bit, you have given up the rights in the 5th and the court can then require you to continue doing so? Makes so sense, I need to go read that.
Posted on Jan 24, 2012 | 1:28 PM EST reply Recommend Flag actions
As I understand it, partial compliance is considered a waiver of your fifth admendment rights.
Posted on Jan 24, 2012 | 1:35 PM EST reply Recommend Flag actions
Tools like truecrypt allow you to do something called plausible deniability. It’s a second, hidden partition that has a separate password. If the feds ask you to turn over the password you give them the second one and they get a bunch of junk files that you put there. But when you enter in the correct password it opens up to all of your data. Also, since the whole encrypted container is full of random bits, no one should ever be able to know that there was a second partition.
Posted on Jan 24, 2012 | 4:44 PM EST reply Recommend Flag actions
Something to say? Choose one of these options to log in.