Can the government force you to give up your password in the course of an investigation against you?
That’s the controversial debate that’s shaping
up in U.S. District Court in Colorado. Ramona Fricosu has been charged with bank fraud and the case seemingly hinges on an encrypted computer. Prosecutors argue that Fricosu should have to decrypt the computer, essentially giving investigators access to whatever is behind password protection. Fricosu’s attorney says that’s a violation of her right to privacy and her right against self-incrimination as protected by the Bill of Rights.
Fricosu is one of a group of people accused of bank fraud connected to a mortgage scam that targeted people facing foreclosure, allegedly to the tune of hundreds of thousands of dollars. Fricosu denies the charges. Her attorney, Philip Dubois, says that during the course of the 2010 investigation, federal authorities seized six computers from the home she shared with her then-husband, who was also named in the charges.
Authorities were able to access information in five of the computers, but haven’t been able to decrypt the sixth one, a laptop, which is protected by a hard-to-crack encryption program that’s available to the public.
Prosecutors argue that there could be key evidence on the laptop that they can’t access because they don’t know her password. They want her to provide them with it, but her attorney argues that would violate her Fifth Amendment rights, which protect an individual against self-incrimination (“no person … shall be compelled in any criminal case to be a witness against himself”).
There is little precedent for a case such as this, one that takes place on a digital realm. So it basically boils down to comparing analogies from cases that have been decided.
The Fifth Amendment, among other things, protects people from being compelled to give from the content of their mind evidence against themselves – called “testimonial” evidence. The court can, however, compel one to give up “non-testimonial” evidence, which includes things like DNA, blood, voice and handwriting samples.
The analogy being argued then is this: Is a password more like a key to a lockbox (non-testimonial) or a combination to a safe (testimonial)? The law allows authorities to compel you to give up the key, but not the combination.
“The Fifth Amendment means the government can’t compel you to turn over testimonial information that would reveal the contents of your mind and tend to incriminate you,” Marcia Hofmann, a senior staff attorney at Electronic Frontier Foundation, which filed a brief in support of Fricosu, told ABC News. “A password is something you know, something that’s in your mind. It’s a different thing entirely than turning over a physical key.”
Prosecutors contend a password is more like a key, and if Fricosu doesn’t hand it over, it could set a dangerous precedent.
“Failing to compel Ms. Fricosu,” Assistant U.S. Attorney Patricia Davies wrote in a court filing, “amounts to concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) that encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers … and thus make their prosecution impossible.”
Prosecutors also say it isn’t the password that matters to them, that they don’t even need to know it. It’s what’s behind the password that they care about. “The government seeks the strongbox’s contents,” Davies wrote, “not the ability to open the strongbox for itself.”
Dubois argues, on the other hand, that a decision forcing Fricosu to give prosecutors access to the computer could be potentially more dangerous.
“If we establish a precedent that says you can be forced to help the government convict you and find your private stuff, then that is a watershed moment,” Dubois told ABC News. “It would be a change in the fundamental principles in criminal law in this country since its inception.”
Both sides are awaiting a judge’s decision in a hearing on the “ownership issue”: whether the government has proven that the computer is actually Fricosu’s. Depending on the judge’s decision, the case could be finished, or could be appealed to a high court.
Hofmann says whatever happens in this case, this certainly won’t be the last the courts hear of the issue.
“In a day and age when we carry computers around, when our phones are little computers, it’s important to have basic security precautions in place,” Hofmann said. “People should and will use encryption more commonly, so these types of situations will come up more and more often. The courts should stand up for the constitution privileges people have protecting their privacy and right against self incrimination.”
