Court should rule data decryption as self-incriminating evidence, civil liberty group says

The US Government has asked a federal court in Colorado to force Ramona Fricosu to hand over passwords for her encrypted laptop, or force her to provide unencrypted versions of the protected content on the machine available to it, the Electronic Frontier Foundation (EFF) has said. The US Government's request is "overreaching" the EFF said.

Fricosu faces charges in relation to allegedly fraudulent real estate transactions. The US Government believes data stored on the laptop will help it prosecute Fricosu, according to the civil liberties group.

The court should rule to protect Fricosu's privacy because the US Constitution states individuals should not be forced to incriminate themselves, the EFF said.

"The government makes an aggressive argument here that may have far-reaching consequences for all encryption users," the EFF said in a submission (16-page /150KB PDF) to the court.

"Fricosu will be made a witness against herself if she is forced to supply information that will give prosecutors access to files they speculate will be helpful to their case but cannot identify with any specificity. And while Fricosu has been offered limited immunity, it is not enough to defeat her Fifth Amendment privilege against self-incrimination," the EFF's court submission said.

The Fifth Amendment of the US Constitution states that citizens should not be forced to be a witness against themselves in criminal cases. The Amendment exists to protect innocent people from being forced to give evidence that could incriminate them.

Forcing Fricosu to enter the laptop password or decrypt the data on the computer would imply facts that could incriminate her, the EFF said.

"The act would be an admission that she had control over the computer and the data stored on it before it was seized from her residence – which are critical admissions, particularly considering that she shared her residence with her co-defendant," the EFF said in its court submission.

"The act would also show that she knows the encryption password and was able to access the encrypted data," the EFF said.

The US Government has not provided evidence that the information it is seeking is a "foregone conclusion", the EFF said.

The EFF said that the US Government had to show what information they expected to find in order to prove that Fricosu would only be surrendering information they already knew about, in an act that would not be self-incriminating. This is what the EFF called the "foregone conclusion" doctrine.

"When the existence and location of information are known to the government, and the witness 'adds little or nothing to the sum total of the Government’s information by conceding that [s]he in fact has the [information],' those matters are treated as a 'foregone conclusion'," the EFF said in its court submission.

"Under those circumstances, 'no constitutional rights are touched. The question is not of testimony but of surrender.' In situations where the foregone conclusion doctrine applies, the government typically already has extensive information about the material it seeks," the EFF said.

"The government’s knowledge of the existence, control, location and authenticity of the information must be nearly the same as the witness’s for the doctrine to overcome the [Fifth Amendment] privilege. The government has not made that showing here," the EFF said.

The US Government has offered not to use the evidence of Fricosu actually being able to enter the laptop password or decrypt the data on it against her, the EFF said. But this does not prevent Fricosu from being at risk from incriminating herself, it said.

The Government has to prove that all the evidence it has comes from legitimate independent sources and any immunity it grants leaves it and Fricosu in "substantially the same position" as if Fricosu had been not had to risk incriminating herself, the EFF said.

"The government’s offer of limited immunity – with no guarantee against use or derivative use of the information Fricosu would be forced to supply – is not comprehensive enough to secure Fricosu’s Fifth Amendment rights," the EFF said. "She is therefore justified in refusing to provide the password."

The court should not betray the Constitution's principles because technology provides security of people's data, the EFF said.

"The Court should decide this important constitutional question in a way that recognizes the substantial benefits of encryption to safeguard the security and privacy of digital information stored on computers," the EFF said.

"New technologies present new challenges for law enforcement, but this reality does not justify the abandonment of well-established constitutional protections that secure individuals’ rights," it said.

In 2008 the UK Court of Appeal ordered two men to hand over password information to a computer that the police wanted to access. It said they did not have the right to withhold the passwords from the police because disclosing the password did not constitute giving over incriminating information.

Passwords and the information stored behind them existed outside of and independent of the men, the Court of Appeal ruled.

The men had claimed that forcing them to hand over the key to encrypted data on their computers would be forcing them to incriminate themselves.

The Regulation of Investigatory Powers Act was changed in 2007 to allow police to force people to hand over passwords or keys to encrypted data. Refusal to do so is a criminal offence carrying a penalty of two years in jail, or up to five years if the issue concerns national security.

The change was criticised by human rights campaigners that said people had a right to a fair trial and were allowed to remain silent in order not to incriminate themselves. People are guaranteed the right to a fair trial under the UK Human Rights Act, which is based on the European Convention on Human Rights.