11th Circuit:Court Cannot Compel the Decryption of Computer Files

The Fifth Amendment of the U.S. Constitution guarantees that no citizen shall be compelled in any criminal case to be a witness against himself.  The protection involves any act that can be considered “testimony” and is most commonly invoked in the context of refusing to speak to police or electing not to testify at trial.

In United States v. John Doe, 670 F.3d 1335 (11^th Cir. 2012). law enforcement officers obtained a search warrant on an anonymous citizen, Doe, to search his hotel room which he allegedly used when posting and sharing photos and videos of underage girls on the internet. The officers seized multiple laptops and hard drives from the room which were later examined by the FBI. The FBI, however, was unable to access certain encrypted portions of the hard drives. A grand jury subpoena was then issued to compel Doe to produce the encrypted contents of the hard drives. Doe refused to comply with the subpoena, was held in contempt by the District Court and taken into custody.

In reversing the District Court’s contempt order, the 11^th Circuit held that forcing Doe to decrypt the hard drives and reveal the contents constitutes “testimony” that is protected by the Fifth Amendment.

The Court explained that when determining whether an act such as an order to produce documents is “testimonial,” the issue turns on whether an individual is being asked to produce a physical object, or use the “contents of his own mind” to explicitly or implicitly communicate a statement of fact. Thus, compelling a physical act, such as a blood sample, a handwriting sample, a voice sample, standing in a line up, or providing the key to a lock box are not testimonial. Nor is compelling the production of specific documents the government already knows about and can independently verify, such as tax records.

The Court in Doe held that requiring Doe to use a decryption password uses the contents of the individual’s mind and involves the production of documents or files the government does not already know about. The Court stressed that the Government did not know whether any files actually existed on the hard drive at all, or whether Doe even knew how to decrypt the files.

The Court also distinguished the case from other recent cases involving production of computer files.  In those cases, U.S. v. Fricosu, 2012 WL 182121 (D. Colo. Jan. 23, 2012) and In re Boucher, 2009 WL 424718 (D. Vt. Feb. 19 2009), the government knew that files did in fact exist on the computer or drives, or the Defendant had already admitted that the files existed.

Decryption of sensitive computer data is becoming quite common in the digital age so this decision will undoubtedly have a significant impact on federal and state child pornography investigations in Georgia for years to come.