The U.S. Constitution’s Fifth Amendment states no one can be “compelled in any criminal case to be a witness against himself”. Yet Judge Robert Blackburn has ruled in Colorado that courts can force Americans to disclose information that will incriminate them.
The EFF filed a brief last year with a nice explanation of the two sides to this key issue (pun not intended).
Forcing an individual to supply a password necessary to decrypt data is more like revealing the combination to a wall safe than to surrender a key: the witness is being compelled to disclose information that exists in her mind, not to hand over a physical item.
Those who believe that a defendant who knows a password is withholding the equivalent of a physical key argue that they are not protected by the Constitution.
Those who believe a password is information argue that it is protected.
It might be helpful to the debate if the judge would reference how their decision affects the three factors of authentication — something you know, something you have, something you are.
Something you have has not been protected under the 5th Amendement. Blackburn is stating that something you know should also lose protection. CNet quotes the reason offered by prosecutors for the change.
Failing to compel Ms. Fricosu amounts to a concession to her and potential criminals…that encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers to obtain such evidence through judicially authorized search warrants, and thus make their prosecution impossible.
That has a strange tone for many reasons. Here are just a few that jump to mind:
First, it would only be impossible to prosecute if a number of particular and narrow conditions exist. That is hardly a concession to criminals in a broad sense; they already know that if they perform a perfect crime they won’t be caught. There are a number of ways encryption will fail and/or fail protection under the Fifth Amendment.
Second, “make their prosecution impossible” does not seem like a valid argument on its own since the Fifth Amendment clearly carves out situations that are protected. A prosecution already has to work within a limited framework even if it makes prosecution impossible.
Third, refusing to produce something physical seems very different than refusing to reveal something you are believed to know. Forgetting, in my mind, (pun not intended) is very different than the reasons that could lead to the inability to give physical access. This case begs the question of how and why information security differs from physical security; why is logical integrity of a password so different from physical integrity of a metal key?
Perhaps it helps to consider the case like this: Contempt of court for refusal to hand over something that you have should be distinct from refusal to hand over something that you know. Blackburn does not seem to see the difference but I suspect he might change his view if he had to defend it in all cases of authentication.