The NACDL’s Compelled Decryption Primer: If a Phone is Locked or Encrypted Can Cops Compel You to Unlock or Decrypt it?

From [NACDL] The Supreme Court recognized in Riley v. California that cell phones are unlike other types of physical objects. 134 S.Ct. 2473 (2014). Instead, the Court held, they are minicomputers that contain the most intimate details of life. Due to their immense storage capacity, combined with the many distinct types of private data they contain, the Court held that the Fourth Amendment requires law enforcement to get a warrant to search a cell phone, even incident to arrest.

But if a device is locked or encrypted, can law enforcement compel a suspect to unlock or decrypt it? This primer outlines the state of the law on compelled decryption and offers a guide for defense lawyers on this important emerging issue.

The majority of Americans now own several devices that are encrypted until unlocked by a passcode or biometric mechanism. A passcode can be a secret number, pattern, or alphanumeric password. Biometric locks may use a fingerprint or face scan. These locks serve to make their contents inaccessible and unreadable until unlocked and decrypted by an authorized user.

While the lawfulness of a device search is a Fourth Amendment issue, the Fifth Amendment privilege against self-incrimination is the central safeguard against compelled decryption. To successfully assert this right, the act of decryption must be compelled, incriminating, and “testimonial.” While the first two requirements are often easily met, the key question is whether decryption is testimonial.

Is Compelling Decryption “Testimonial”?

The majority of Americans now own several devices that are encrypted until unlocked by a passcode or biometric mechanism. A passcode can be a secret number, pattern, or alphanumeric password. Biometric locks may use a fingerprint or face scan. These locks serve to make their contents inaccessible and unreadable until unlocked and decrypted by an authorized user.

While the lawfulness of a device search is a Fourth Amendment issue, the Fifth Amendment privilege against self-incrimination is the central safeguard against compelled decryption. To successfully assert this right, the act of decryption must be compelled, incriminating, and “testimonial.” While the first two requirements are often easily met, the key question is whether decryption is testimonial.

The act of decrypting a device may be “testimonial” under the Fifth Amendment if it explicitly or implicitly conveys the fact that certain data exists or is in the possession, custody, or control of an individual. See In Re Grand Jury Subpoena Duces Tecum, 670 F.3d 1335 (11th Cir. 2012). Such an “act of production” may itself be incriminating or effectively concede the “existence, possession and control, and authenticity” of potentially incriminating evidence on a device. Id. at 1343. This analysis often hinges on the type of lock employed.

Numeric or Alphanumeric Locks: Courts have generally found that compelling individuals to provide their numeric or alphanumeric passcode is potentially testimonial under the Fifth Amendment, as it forces the defendant to reveal “the contents of his own mind.” In Re Grand Jury Subpoena Duces Tecum 670 F.3d at 1345; see also U.S. v. Apple MacPro Computer, 851 F.3d 238 (3d Cir. 2017). It is analogous to compelling production of the combination to a wall safe, which is testimonial, as opposed to surrendering the key to a strongbox, which is not. See Doe v. U.S., 487 U.S. 201, 220 (1988). However,evenifacourt ndsthatprovidingthepasscodeis“testimonial,” itmaystillfallunderthe“foregoneconclusion” exception, which is addressed on the next page.

Biometric Locks: Some courts have found nothing testimonial under the Fifth Amendment about compelling the production of biometric keys, such as a fingerprint, similar to tests that gather physical evidence. See, e.g., State v. Diamond, 905 N.W.2d 870 (Minn. 2018); Matter of Search of [Redacted] Washington, D.C., 317 F. Supp. 3d 523 (D.D.C. 2018); Commonwealth v. Baust, 89 Va. Cir. 267 (Va. Cir. Ct. 2014). Recently, however, others have begun to hold that compelling the production of a biometric key is just as testimonial as a numeric one. See Matter of Residence in Oakland, California, 354 F. Supp. 3d 1010, 1016 (N.D. Cal. 2019); In Re Application for a Search Warrant, 236 F. Supp. 3d 1066 (N.D. Ill. 2017). From this perspective, “biometric features serve the same purpose of a passcode, which is to secure the owner's content, pragmatically rendering them functionally equivalent.” 354 F. Supp. 3d at 1015.

Is it a “Foregone Conclusion”?

Even if the act of decryption is potentially testimonial, it may not violate the Fifth Amendment if the implicit facts conveyed by doing so would be a “foregone conclusion” that “adds little or nothing to the sum total of the government's information.” U.S. v. Hubbell, 530 U.S. 27, 45 (2000). As a general rule, the “foregone conclusion” exception applies if the government can show it knows the location, existence, and authenticity of the purported evidence with reasonable particularity. Id. at 27. But the Supreme Court has never applied the exception beyond business documents, indicating an unwillingness to do so where more private and personal documents, like a diary, are at issue. Fisher v. U.S., 425 U.S. 391, 401 & n.7 (1976) (citing U.S. v. Bennet, 409 F.2d 888, 897 (2d Cir. 1969)). It is therefore essential to challenge whether the doctrine applies at all in the digital context. The Court has repeatedly emphasized that cell phones are not like ordinary closed containers or physical objects. See Riley, 134 S. Ct. at 2491 (“[A] cell phone search would typically expose to the government far more than the most exhaustive search of a house”); Carpenter v. U.S., 138 S.Ct. 2206, 2220 (2018) (requiring a warrant for historical cell phone location information). Indeed, the breadth and depth of private information contained in modern electronic devices simply did not exist when the Court established the foregone conclusion rule. Defense counsel should argue that it does not apply in the context of digital devices, just as the Court declined to apply the search-incident-to- arrest rule in Riley and the longstanding "third-party doctrine" in Carpenter.

In the alternative, the critical question is whether the government already knows of the existence and location of relevant files and can show that the client can access them. In Re Grand Jury Subpoena Duces Tecum, 670 F.3d at 1346. Lower courts are currently split on the test for deciding this question in the context of digital devices. Each of the tests is addressed below: [MORE]