District Court Opinion Rejecting Fifth Amendment Act of Production Claim by Password Holder for Encrypted Devices (5/4/18)

In United States v. Spencer, 2018 U.S. Dist. LEXIS 70649 (N.D. Cal. 2018), here, the Court (District Judge Charles Breyer) rejected a Fifth Amendment claim to being compelled to decrypt three devices--phone, laptop, and an external hard drive--after the Government seized them pursuant to search warrant. The issue involves the act of production doctrine and the foregone conclusion exception to the act of production doctrine.

In the excerpts below, I use the "cleaned up" technique here to eliminate unnecessary noise in quotations and citations.

Judge Breyer explains the standards as follows:

The Fifth Amendment to the United States Constitution provides that "No person . . . shall be Compelled in any criminal case to be a Witness against himself." It applies only when the accused is compelled to make a Testimonial Communication that is incriminating.  Accordingly, the Fifth Amendment is not violated whenever the government compels a person to turn over incriminating evidence. Instead, it is only implicated when the act of production itself is both "testimonial" and "incriminating." 

The act of production is neither testimonial nor incriminating when the concession implied by the act adds little or nothing to the sum total of the Government's information by conceding that he in fact has the evidence—that is, where the information conveyed by the act of production is a "foregone conclusion." It is important to stress the limited scope of the "foregone conclusion" rule. It only applies where the testimony at issue is an implied statement inhering in the act of production itself. Otherwise, the government cannot compel a self-incriminating statement, regardless of whether the contents of the statement are a "foregone conclusion."  

For instance, the government could not compel Spencer to state the password itself, whether orally or in writing. But the government is not seeking the actual passcode. Rather, it seeks the decrypted devices. Spencer argues that production of the devices would not fall within the act-of-production doctrine because producing the devices would require him to enter the decryption password. In other words, Spencer argues that because the government cannot compel him to state the passwords to the devices, it cannot compel him to decrypt the devices using the passwords, either. This argument has some superficial appeal, and finds support in a dissent by Justice John Paul Stevens, who once contended that a defendant could not be compelled to reveal the combination to his wall safe either by word or deed. While the analogy is not perfect, we may assume that storing evidence in encrypted devices is equivalent to securing items in a safe protected by a combination, and that Justice Stevens' reasoning applies equally to the situation at hand.

But a rule that the government can never compel decryption of a password-protected device would lead to absurd results. Whether a defendant would be required to produce a decrypted drive would hinge on whether he protected that drive using a fingerprint key or a password composed of symbols. Similarly, accepting the analogy to the combination-protected safe, whether a person who receives a subpoena for documents may invoke the Fifth Amendment would hinge on whether he kept the documents at issue in a combination safe or a key safe. But this should make no difference, because opening the safe does not require producing the combination to the government. Whether turning over material, either in the form of documents or bits, implicates the Fifth Amendment should not turn on the manner in which the defendant stores the material. 

So: the government's request for the decrypted devices requires an act of production. Nevertheless, this act may represent incriminating testimony within the meaning of the Fifth Amendment because it would amount to a representation that Spencer has the ability to decrypt the devices. Such a statement would potentially be incriminating because having that ability makes it more likely that Spencer encrypted the devices, which in turn makes it more likely that he himself put the sought-after material on the devices. 

The next question is whether the foregone conclusion rule applies. There is some confusion in the case law regarding what exactly the relevant "foregone conclusion" must be where the government seeks decryption of hard drives. The Eleventh Circuit has held that the government must show that it is a foregone conclusion not only that the defendant has the ability to decrypt the device(s), but also that certain files are on the device(s). The court denied the government's attempt to compel the defendant to decrypt the device at issue in that case because it ha[d] not shown that it had any prior knowledge of either the existence or the whereabouts of the files on the device.  

The Eleventh Circuit was relying on precedent in which the government requested specific documents from a defendant pursuant to subpoena. In Fisher, compliance with the subpoena tacitly conceded the existence of the papers demanded and their possession or control by the defendant. Not so in cases like the one at hand, in which the government seeks entire hard drives. Turning over the decrypted devices would not be tantamount to an admission that specific files, or any files for that matter, are stored on the devices, because the government has not asked for any specific files. Accordingly, the government need only show it is a foregone conclusion that Spencer has the ability to decrypt the devices. That the government may have access to more materials where it seeks a hard drive through a search warrant than it would have had if it sought specific files through subpoena is simply a matter of the legal tool the government uses to seek access. To the extent Spencer contends that the government has not adequately identified the files it seeks, that is an issue properly raised under the Fourth Amendment, not the Fifth. 

The only remaining question insofar as the applicable legal framework goes is what standard the Court must apply in evaluating whether Spencer's knowledge of the passwords is a "foregone conclusion." In the context of requests for specific documents, the government is required to establish independent knowledge of the existence, possession, and authenticity of subpoenaed documents with reasonable particularity before the communication inherent in the act of production can be considered a foregone conclusion. The "reasonable particularity" standard appears to have been derived from the standard courts use to evaluate whether a warrant is sufficiently specific under the Fourth Amendment. 

Courts have continued to apply that standard to cases involving compelled decryption under the Fifth Amendment. But it is nonsensical to ask whether the government has established with "reasonable particularity" that the defendant is able to decrypt a device. While physical evidence may be described with more or less specificity with respect to both appearance and location, a defendant's ability to decrypt is not subject to the same sliding scale. He is either able to do so, or he is not. Accordingly, the reasonable particularity standard cannot apply to a defendant's ability to decrypt a device. (In any event, "reasonable particularity" is not really an evidentiary standard at all. It is better viewed as a substantive standard that helps to ensure that any testimony at issue really is a "foregone conclusion.") 

The appropriate standard is instead clear and convincing evidence. This places a high burden on the government to demonstrate that the defendant's ability to decrypt the device at issue is a foregone conclusion. But a high burden is appropriate given that the "foregone conclusion" rule is an exception to the Fifth Amendment's otherwise jealous protection of the privilege against giving self-incriminating testimony.

Then, based on these standards, Judge Breyer concludes:

The question, accordingly, is whether the government has shown by clear and convincing evidence that Spencer's ability to decrypt the three devices is a foregone conclusion. It has. All three devices were found in Spencer's residence. Spencer has conceded that he owns the phone and laptop, and has provided the login passwords to both. Moreover, he has conceded that he purchased and encrypted an external hard drive matching the description of the one found by the government. This is sufficient for the government to meet its evidentiary burden. The government may therefore compel Spencer to decrypt the devices. Once Spencer decrypts the devices, however, the government may not make direct use of the evidence that he has done so. If it really is a foregone conclusion that he has the ability to do so, such that his decryption of the device is not testimonial, then the government of course should have no use for evidence of the act of production itself.

For other blogs on some of the subjects of this opinion, see (reverse chronological order):

• Article on Fifth Amendment Act of Production and Greenfield (Federal Tax Crimes Blog 4/16/18), here.
• Important CA2 Opinion on Foregone Conclusion Required To Overcome Fifth Amendment Act of Production Assertion to Summons Production of Foreign Documents, Including Bank Records (Federal Tax Crimes Blog 8/1/16), here.
• Further on the Foregone Conclusion Exception to the Fifth Amendment Act of Production Doctrine (Federal Tax Crimes Blog 6/7/16; 6/8/16), here.
• Court Orders Compliance with Formal Document Request Upon Taxpayer Motion to Quash (Federal Tax Crimes Blog 12/30/15; 12/31/15), here.
• Required Records IRS Summons Enforced Again (Federal Tax Crimes Blog 1/23/14), here.
• NInth Circuit Holds that Government Established Foregone Conclusion as to Documents to Override the Act of Production Privilege (Federal Tax Crimes Blog 1/9/13), here.
• Fifth Amendment Act of Production Privilege and Encrypted Data Files (Federal Tax Crimes Blog 2/25/12), here.
• Court Blurs Analysis of the Fifth Amendment and Document Production (Federal Tax Crimes Blog 5/12/11), here.
• What is the Foregone Conclusion To Overcome the Fifth Amendment Act of Production Doctrine? (Federal Tax Crimes Blog 7/27/10), here.
• Summons Power to Force Summonsed Party to Gather Records from Third Parties (Federal Tax Crimes Blog 9/30/09), here.
• Act of Production Doctrine and Particularity (Federal Tax Crimes Blog 3/12/09), here.

One side note:  Judge Charles Breyer's Wikipedia page is here.   That page notes that Judge Breyer is the brother of Supreme Court Justice Steven Breyer.  Both are giants in the law.