Massachusetts Supreme Court Looking To Define Where The Fifth Amendment Ends And Compelled Decryption Begins

(Mis)Uses of Technology

from the let-a-new-wave-of-'wall-safe'-analogies-wash-over-this-land dept

Another case attempting to define the contours of the Fifth Amendment as it pertains to cellphones and passwords has arrived in the Massachusetts Supreme Judicial Court. The case involves sex trafficking allegations and a phone seized from the defendant at the time of his arrest. Testimony from a person who said she was trafficked suggested the phone seized belonged to the defendant Dennis Lee Jones. The state sought to compel Jones to unlock the seized phone, but this motion was denied by the trial court, resulting in the state’s appeal.

While the lower court did express some concern that unlocking devices can result in the production of evidence to be used against the person unlocking it, the standard for compelled password production has nothing to do with the eventual recovery of evidence. All the state* needs to reach is a reasonable certainty the defendant knows the password to the seized device. This is called a “foregone conclusion” — the defendant “telling” the state what it already “knows:” that the phone belongs to him and he can unlock it. The potential evidence held inside the phone may eventually be used against the defendant, but the Fifth Amendment question isn’t about this evidence, but rather the simple act of producing a password, which isn’t considered testimonial if the government can tie the phone to the accused.

*Yes, I realize Massachusetts is technically a commonwealth. There’s no need to point this out in the comments.

In this case, it appears the state failed to meet that standard. The opinion being appealed says the government hasn’t been able to conclusively show the phone belongs to Jones or that he knows the password. It may have shown evidence relevant to the case resides on the device, but that’s not enough to move forward with compelled decryption.

In this case, the Commonwealth has established with reasonable particularity that information relevant to the charges against Mr. Jones exists on the LG Phone, and that it is authentic, satisfying two of the three elements of the “foregone conclusion” analysis. For example, the 7119 Number is linked to the LG Phone; online listings for alleged prostitution reference the 7119 Number; and police have possession of text messages from the 7119 Number related to commercial sex acts. In short, the Commonwealth has established independently that information connected to the charged sex trafficking activity is on the LG Phone.

The Commonwealth, however, has not demonstrated with reasonable particularity that Mr. Jones possesses the PIN number for the LG Phone or has access to what that phone contains.

[…]

The phone is not registered to Mr. Jones or to his address. A female voice (McNeill’s) answers voice calls to the 7119 Number. The Commonwealth has provided no evidence of Mr. Jones accessing or entering the PIN number into the LG Phone. The Commonwealth does not suggest that any law enforcement officer called the LG Phone and heard Mr. Jones answer the phone. In addition, Mr. Jones has not admitted to owning or controlling the phone. In short, the Commonwealth has offered no evidence akin to the strong evidence offered in Gelfgatt, where the defendant admitted to encrypting (and being able to decrypt) the computers at his home office.

The Commonwealth relies mainly on statements from Ms. Fortin, who lists the 7119 Number in her phone’s contact list as “Dennis,” and claims the 7119 Number belongs to Mr. Jones. I have not seen a statement from Ms. Fortin that shows she witnessed Mr. Jones using the LG Phone, nor did she describe the physical characteristics of the phone (such as model, color, or general appearance) in a way to suggest she has seen Mr. Jones physically use or enter a PIN into the phone. Defendant challenges Ms. Fortin’s credibility. The Commonwealth seems tacitly to acknowledge Ms. Fortin’s credibility issues, indicating in its search warrant affidavit that it seeks access to the contents of the LG Phone to “corroborate or fail to corroborate” the “key aspects of Ms. Fortin’s statement.”

Because it hasn’t reached the “foregone conclusion” standard, the state’s demand for a password makes this act testimonial.

In seeking to compel Mr. Jones to provide the PIN for the LG Phone, the Commonwealth is asking Mr. Jones to admit that he owns and/or controls the LG Phone, a fact the Commonwealth believes to be true, but does not know, and has been unable to establish independently.

Law prof Orin Kerr, who has written volumes on Fourth and Fifth Amendment issues, has filed an amicus brief [PDF] in this case. Citing his own draft paper [PDF] on the Fifth Amendment and compelled decryption, Kerr’s argument mainly focuses on setting the confines of the “foregone conclusion” standard. His brief rejects both the stricter standard suggested by the defendant and lower standard asked for by the government. (h/t ReleasetheKraken)

The defendant argued for “proof beyond a reasonable doubt” he knew the password to the phone. But Kerr points out that’s a standard for convictions, not accessing potential evidence.

Due process requires that the government must prove every element of a crime beyond a reasonable doubt because an individual’s freedom is at stake. Assigning such a high burden acts as “a prime instrument for reducing the risk of convictions resting on factual error.”

In contrast, “the basic purposes that lie behind the privilege against self-incrimination do not relate to protecting the innocent from conviction, but rather to preserving the integrity of a judicial system[.]” The individual must plead the Fifth and have a court assess the privilege before (often long before) any trial might occur. Although the individual must show that an answer would be incriminating, the individual may not even be a criminal suspect at that time. The Commonwealth could reasonably know only a small part of the evidence that it would later learn before deciding to bring a criminal case against the individual. For these reasons, the trial standard of proof beyond a reasonable doubt standard is not well-suited for the foregone conclusion doctrine.

According to Kerr, obtaining a password only ties the accused to the unlocked device. Whatever is on the phone may help the government prove its case, but it would not be able to use the suspect’s compelled cooperation against him in court. It’s not much of a protection, but it’s something. It would prevent the government from making inferences about the phone’s ownership and instead have to rely solely on the evidence found on the phone. The evidence must make the connection on its own without the government’s help.

The government argued for a lower standard, one that would allow it to get its motion to compel granted. It wants a “preponderance of evidence” standard applied to “subsidiary facts.” With this, the government could use the evidence provided by the victim to meet the standard needed to compel password production without having to prove on its own that Jones owned the phone it’s seeking to unlock. Kerr rejects this as well, saying it introduces an evidentiary standard not needed when evidence is still being sought.

Identifying a standard for “subsidiary facts” arises when a trial court must determine what facts to consider to assess whether evidence is admissible at trial. But as explained above, Gelfgatt motions do not involve trial evidence. The only question is whether the Commonwealth can show by clear and convincing evidence that the subject of the order knows the passcode needed to unlock the device. There are no subsidiary facts to consider.

[…]

Adopting the Commonwealth’s preponderance standard for “subsidiary facts” would only water down the clear and convincing evidence standard. To see why, imagine a reliable informant previously told an officer that a criminal suspect regularly used one of two phones found in an abandoned car. But there’s a catch: The officer’s memory is hazy about which phone the informant identified. Based on the officer’s uncertain testimony, the trial court concludes that there is a 51% chance that the informant identified a particular phone as the one the suspect regularly used.

Now imagine the Commonwealth obtains a Gelfgatt order, the suspect pleads the Fifth, and the reviewing judge must determine if the Commonwealth has proven the suspect’s knowledge of that phone’s password by clear and convincing evidence. How should the court treat the officer’s uncertain testimony? Under the Commonwealth’s approach, the judge must treat as 100% certain that the informant identified that particular phone as the one regularly used by the suspect. Because the Commonwealth established the identification of that phone by a preponderance of the evidence, the judge would have to assume it as a true “subsidiary fact” and consider whether the identification showed by clear and convincing evidence that the suspect knew the phone’s password. That would make little sense.

Doubt about the existence of subsidiary facts should not be ignored simply because the existence of those facts is more likely than not.

Here’s what Kerr believes the standard should be for compelled decryption:

A clear and convincing evidence standard strikes me as a fair approximation of a burden needed to eliminate that advantage. When the government can show by clear and convincing evidence that it already knows the facts implicit in the suspect’s testimonial acts, it is highly unlikely that the government will obtain any trial advantage from the testimony implicit in that act. The clear and convincing standard is sufficient to be confident that the government need not and will not rely on the testimonial act at trial to prove its case.

If that’s the standard, it’s unlikely the government has met it. It is lacking several establishing facts tying Jones to the phone seized from him during his arrest. If so, it cannot compel decryption.

The standard for compelled decryption is continually shifting. There’s no on-point precedent from the US Supreme Court standardizing this across federal courts and every state has its own Constitution to consider as well during state-level prosecutions.

This will have to be taken up by the Supreme Court at some point, because producing passwords may not be technically testimonial if the government can meet the “foregone conclusion” standard, but it does lead to the production of evidence the government would have had access to otherwise. Analogies about wall safes and combinations only go so far when phones contain far more potential evidence than could possibly fit into a physical hole in the wall.

Then again, the Fifth Amendment only guards against self-incrimination. What’s on locked devices may be incriminating, but unlocking a device only proves you can unlock it. If this element can’t be used against a person in court, the government must still link evidence found to the criminal charges sought without drawing inferences from the compelled decryption itself. In many cases, this act won’t prove essential to the government’s case, even if the wealth of information unveiled ultimately helps secure a conviction.

Since the lines are still muddy, it may be in law enforcement’s best interest to seek outside help cracking cellphones, rather than relying on something some courts may find testimonial, or otherwise determine the government hasn’t met its burden to compel decryption. The future is going to filled with cases like these, and there’s a good chance courts will need to spend more time discussing the implications of other security measures — like fingerprints and facial recognition — in terms of Fifth Amendment protections. For now, though, there’s a poorly-defined standard making life more difficult for everyone involved in the judicial process to determine what can or can’t be done without violating rights.

Filed Under: 5th amendment, compelled decryption, dennis lee jones, encryption, massachusetts, passwords