Friday, February 08, 2008

Does Providing Access to One's Own Computer Files Raise Self-Incrimination Concerns?

USA Today reports on a case concerning computer passwords and an individual's Fifth Amendment right against self-incrimination. Sebastien Boucher was crossing the U.S.-Canada border when he was stopped and searched by agents. He consented to the search and initially gave access to his computer.

Among the files reviewed by the agents was child pornography. Mr. Boucher was arrested and, following his arrest, officers attempted to access an area of the hard drive that was password protected. Mr. Boucher refused to provide the password and is defending his position by relying on the Fifth Amendment.

The USA Today article points to a couple previous cases that are somewhat related. In a federal court case concerning the search of a man's laptop in the LA airport, the federal judge suppressed the evidence gathered, ruling that electronic storage devices are extensions of the human memory and should not be opened to inspection without cause.

In Mr. Boucher's case, federal Magistrate Jerome Niedermeier followed a similar logic. According to a quote in the USA, Niedermeier held that, "Producing the password, as if it were a key to a locked container, forces Boucher to produce the contents of his laptop. . . . The password is not a physical thing. If Boucher knows the password, it only exists in his mind."

I'm no champion of law enforcement's rights of search and seizure and am generally opposed to several currently permissible searches (e.g., abuses of probable cause in traffic stop situations, overly broad searches incident to arrest, etc). I also strongly oppose the use of certain invasive search techniques for investigative purposes, such as key-stroke recorders and data communication monitoring.

However, I fail to see the correlation between the right against self-incrimination and providing access to a password. The court makes too much of the intellectual nature of a password - that the password only exists in Boucher's mind is far less important than what the password is. I also fail to see the logic behind a sweeping statement that electronic storage is an extension of the human memory. Both of these positions warrant certain judicial consideration, but not in Boucher's case.

First, a password is nothing more than a key. It is itself not incriminating unless the mere knowledge of that password could implicate someone in a crime. For instance, knowing the password to a secure server that was used for an unlawful purpose could in itself be evidence of the crime. Requiring this admission should be scrutinized under the Fifth Amendment.

The mere knowledge of the password in Boucher's case, however, has nothing to do with the crime for which he is charged. He might as well have the key to an indestructible bank safe that is believed to contain a murder weapon. His lawful possession of the key is immaterial, as it is the contents of the safe that are sought. We would have no problem compelling him to produce that key. Why should its intangible counterpart be any different?

The status of electronic storage as an extension of the human memory could be a closer call but is nonetheless inapplicable to Boucher. It could be argued that electronic documents authored by the defendant are essentially his own thoughts and recollections and can be self-incriminating. However, they are also no different than private notes or papers written by the defendant in pen and ink. If any such handwritten materials could be produced at a trial, their digital equivalent should have no greater (nor any less) protection.

In Boucher's case, the question is not one of personally authored material, or at least we should hope not. What the authorities seek is evidence of the crime itself, not his mental state. Possession of child pornography is not a crime of intent so there is no value (other than perhaps to determine length of sentence) to uncovering data concerning whether he intentionally obtained the child pornography. Along the same line, if in fact the authorities believe they might find evidence of Boucher being the author of child pornography, the discovery of those files would be no more self-incriminating since the tapes themselves are the evidence of the crime.

Rather than advocate for a wholesale ban on requiring disclosure of passwords, I hope privacy advocates will focus their attention on more acute questions of self-incrimination by drawing fair and reasonable lines between handing over the keys to a locked location and a disclosure that in itself would constitute (or be evidence of) a crime. I also hope that whatever resources are saved in narrowing their focus will be invested in fighting far more intrusive electronic investigative techniques, which pose a greater threat to a host of Constitutional rights.