Deadline Looms for Suspect to Decrypt Laptop, or Go Directly to Jail

If a judge orders you to decrypt the only existing copies of incriminating files, are your constitutional rights against compelled self-incrimination being violated?

That’s the provocative question being raised as a Wisconsin man faces a deadline today either to give up his encryption keys or risk indefinite imprisonment without a trial. The defendant’s attorney, Robin Shellow of Milwaukee, said it’s “one of the most important constitutional issues of the wired era.”

Shellow is making a novel argument that the federal magistrate’s decryption order is akin to forcing her client to build a case for the government. That’s because encryption basically transforms files into unreadable text, which is then rebuilt when the proper password is entered, she said.

“Some encryption effects erasure of the encrypted data (so it ceases to exist), in which case decryption constitutes re-creation of the data, rather than simply unlocking still-existing data,” Shellow wrote in a court filing. (.pdf)

In a telephone interview Monday, she said “this area is a new way of thinking about encryption.”

UPDATE: A federal judge this afternoon halted the decryption order, and demanded further briefing on the constitutional implications.

Though rare, decryption orders are likely to become more common as the public slowly embraces a technology that comes standard even on Apple computers. Such orders have never squarely been addressed by the Supreme Court, despite conflicting opinions in the lower courts.

The latest decryption flap concerns Jeffrey Feldman, who federal authorities believe downloaded child pornography on the file-sharing e-Donkey network. They seized 15 drives and a computer from his suburban Milwaukee apartment with a search warrant. A federal magistrate has ordered Feldman to decrypt the drives by today.

Feldman has refused, citing the Fifth Amendment. A federal judge could find him in contempt as early as today and jail him pending his compliance.

The magistrate in the case stepped aside Monday after Shellow argued that only U.S. district court judges, not magistrates, have the legal power to issue decryption orders. As of now, the new judge in the case has not decided whether to uphold the magistrate’s order.

U.S. Magistrate William Callahan Jr. initially said the Fifth Amendment right against compelled self-incrimination protected Feldman from having to unlock his drives.

But last month, prosecutors convinced Callahan to change his mind. Among other reasons, the authorities were able, on their own, to decrypt one drive from Feldman’s “storage system” and discovered more than 700,000 files, some of “which constitute child pornography,” the magistrate said.

When the magistrate ruled against the government last month, the magistrate said the authorities did not have enough evidence linking Feldman to the data, and that forcing the computer scientist to unlock it would be tantamount to requiring him to confess that it was his. But that theory is now out the door, because the data on the decrypted drive contains pictures and financial information linking Feldman to the “storage system,” Callahan ruled last week.

Among the last times an encryption order came up in court was last year, when a federal appeals court rejected an appeal from a bank-fraud defendant who has been ordered to decrypt her laptop so its contents could be used in her criminal case. The issue was later mooted for defendant Romano Fricosu as a co-defendant eventually supplied a password.

Shellow said it was unclear whether her client even remembers the passwords to the 16 drives the authorities confiscated.

“The government is claiming that our client has the capacity to decrypt them,” Shellow said.

That issue has never been addressed in court. But judges usually view forgetfulness “as a sham or subterfuge that purposely avoids giving responsive answers.”

Prosecutors did not respond for comment.
Wired