Historically, the United States Supreme Court opens its new term for the year on the first Monday in October. The Supreme Court has discretionary review, so it picks the cases it wants to hear. And every year, that opening day inevitably sees a flood of certiorari denials from the backlog of cases as the Court returns to work. These are the cases that the Court rejects. This year, that flood contained a case with special significance in our modern world: whether the police can force a suspect to provide the password to unlock an electronic device.
We all live on our devices these days. Whether it is a smart phone, tablet, laptop, or desktop; we are all attached to our devices. Social media, online shopping, streaming videos, Google, email, and all the rest are just part of our lives. And all of it requires accounts and passwords—dozens if not hundreds of passwords spread across just as many accounts. The question is when can police force you to divulge your password.
Last fall, the Pennsylvania Supreme Court ruled in Comm. v. Davis that a person cannot be forced to disclose the password protecting their encrypted computer even though it was almost certainly containing child pornography. Davis was suspected of using his personal computer to view child pornography but had taken steps to safeguard his computer. Rather than use Wi-Fi, he had a hardline internet connection and had an encryption vault program that contained the actual data on the computer. Investigators could tell two things: the computer used windows and had the encryption vault software.
After he was arrested, Davis refused to tell investigators his password. As a result, investigators sought and received a court order requiring Davis to provide the password. Davis, however, filed an interlocutory appeal of the order. The intermediate appellate court affirmed the order, but the Pennsylvania Supreme Court decided to review the case. At issue was whether divulging the password would be testimonial in nature—the Self-Incrimination Clause only protects testimonial statements—and whether the foregone conclusion exception would apply.
In its opinion, the Pennsylvania Supreme Court outlined the existing caselaw on from the United States Supreme Court on testimonial acts. The Pennsylvania Court particularly focused on language from both the majority and dissenting opinions in Doe v. United States, 487 U.S. 201 (1988), otherwise known as Doe II. Doe II concerned the whether a suspect could be compelled to authorize foreign banks to disclose records. The majority opinion held that the authorization was not testimonial in nature and, therefore, not protected by the Fifth Amendment.
Justice Stevens dissented because in his view, compelling a suspect “to use his mind to assist the prosecution of convicting him of a crime” would violate the Fifth Amendment’s Self-Incrimination Clause. According to Justice Stevens forcing a suspect to provide the authorization required the suspect to use his mind to assist his prosecution. Notably, the majority explained in a footnote that it agreed with Justice Stevens’s analysis: forcing a person to use the contents of their mind to assist in his or her prosecution would violate the Fifth Amendment. The opinions simply disagreed on whether Doe II involved forcing the suspect to use his mind. For the majority compelling the suspect to provide authorization was “more like ‘be[ing] forced to surrender a key to a strongbox containing incriminating documents than it is like ‘be[ing] compelled to reveal the combination to [petitioner’s] wall safe.’”
The Pennsylvania Supreme Court in Davis “conclude[d] that compelling the disclosure of a password to a computer, that is, the act of production is testimonial” because “the revealing of a computer password is a verbal communication, not merely a physical act that would be nontestimonial in nature.” In that sense, demanding a password to a computer is analogous to demanding a safe combination rather than demanding the key to a lockbox.
The Pennsylvania Supreme Court isn’t alone on this issue. The Eleventh Circuit Court of Appeals has held that compelling a person to decrypt hard drives is a testimonial act that would violate the Fifth Amendment. Other courts have held that similar acts—such as requiring a person to unlock a password protected cellphone—are testimonial. This is different from ordering someone to unlock their cellphone with a fingerprint, which courts have held is not protected by the Fifth Amendment.
Where courts have split is on whether the “foregone conclusion” exception applies in such cases. That exception to the Fifth Amendment applies when the knowledge sought “adds little or nothing to the sum total of the Government’s information.” In other words, when investigators know what is on the computer or in the cellphone and unlocking it would result in nothing more than confirmation, the Fifth Amendment isn’t violated. New Jersey, Indiana,Oregon, and the Eleventh Circuit have applied the foregone conclusion exception test to cases involving passwords, but the Pennsylvania Supreme Court expressly held that the exception is limited and does not apply in cases like this. But even courts that have held that the foregone conclusion exception can apply have not necessarily held that it applies to the facts presented in those cases.
So far, neither the Alabama Supreme Court nor the Alabama Court of Criminal Appeals has addressed this issue. And with the denial of certiorari, the Supreme Court of the United States has declined to intervene for now. What is clear is that at some point this issue will come up in Alabama courts; and that, sooner or later, the United States Supreme Court will almost certainly have to resolve conflicts among the lower courts regarding the Fifth Amendment’s right against self-incrimination and electronic passwords.
1 The full list of cases was 55 pages long. https://www.supremecourt.gov/orders/courtorders/100520zor_3204.pdf
2 Comm. v. Davis, 220 A.3d 534 (Pa. 2019).
3 Doe, 487 U.S. at 219-20 (Stevens, J., dissenting).
4Doe, 487 U.S. at 210, n. 9.
5 Davis, 220 A.3d at 547.
6 In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, 670 F.3d 1335,1346 (11th Cir. 2012).
7 State v. Pittman, 300 Or. App. 147 (Or. Ct. App. 2019)
8 State v. Diamond, 905 N.W.2d 870, 873-75 (Minn. 2018)
9 Fisher v. United States, 426 U.S. 391, 411 (1976)
10 State v. Andrews, 2020 WL 4577172 (N.J. August 10, 2020)
11 Seo v. State, 148 N.E.3d 952 (Ind. 2020)
