For years, being compelled to decrypt a hard drive as part of a criminal investigation has been fuzzy legal territory, with conflicting district court decisions and no national standard. Now, another case has been added to the mix, as the US Eleventh Circuit Court of Appeals has ruled that a defendant cannot be forced to decrypt a drive if the contents are not known. The unnamed defendant was appealing an order to decrypt the contents of several laptops and external hard drives, which he said violated his Fifth Amendment rights by forcing him to testify against himself. The Appeals Court ruling agreed, saying that while simply producing the contents of a drive would be a method of handing over evidence, the act of actually entering the password would count as a form of testimony, since it would prove that the defendant had the ability to decrypt the files.
While this ruling is different from a the result of a similar decryption case in Vermont, the two are not necessarily contradictory. In that case, prosecutors had proof that the defendant was able to decrypt the drives and had seen files on the encrypted drive, so the act of producing the files provided evidence, not testimony. For this recent case, however, the court said "nothing in the record before us reveals that the Government knew whether any files exist or the location of those files on the hard drives; what’s more, nothing in the record illustrates that the Government knew with reasonable particularity that Doe was even capable of accessing the encrypted portions of the drives."
Another recent ruling may make the standard hazier, though. Last month, a federal judge in Colorado decided that Ramona Fricosu would be required to decrypt a drive on her computer based on proof that she owned the computer and was capable of decrypting the files, even though the actual contents weren't known. That case has not yet been appealed, so no decisive ruling has been reached. But if the Second Circuit Court of Appeals upholds the decision, this may create confusion over what is required for decryption to be truly "testimonial," making it more likely that the US Supreme Court could step in to clarify the standard.