It sits in your house, passively recording everything you say. It knows what you like. It knows what you listen to. It knows what you buy. It knows who’s in the room with you. And now, it might tell the police all about it.
“It” is the Amazon Echo, a revolution in the “internet of things.” The Echo is a smart speaker that connects directly to Amazon’s cloud-based personal assistant service, Alexa. It can play music; give you the traffic, weather, and news; handle your shopping; put things on your calendar; play games; and even respond appropriately to a wide array of cultural references, all in response to voice commands. If you have the right add-ons, Alexa can even control your entire home, dimming your lights, adjusting the thermostat, and locking the doors.
It does this by passively listening for a given activation phrase—the default is “Alexa.” Generally, Alexa does not record anything else (although it may store up to sixty seconds at a time in a buffer). Once it hears its name, Alexa will begin recording and will send what follows to Amazon for processing—both to respond to a given request, and to store to improve responsiveness later. On one hand, this means that Amazon is not actually recording everything you say, but only those specific commands directed to Alexa. On the other hand, it means that Alexa is always listening.
This became relevant in a recent murder case in Bentonville Arkansas, in which police obtained a warrant for recordings from Amazon of commands given to the suspect’s Echo. It is far from clear what police hope to gain from these recordings; they have a large amount of traditional evidence and, unless the murderer specifically asked Alexa for help, the recordings are unlikely to be incriminating. Nevertheless, an attempt by police to seek recordings from a device that is virtually always listening to us in our homes is extremely disturbing.
These efforts are made even more concerning by recent court rulings on cell phone location data. According to two federal appellate courts, because cell phones send this information to a third party (that is, to cell phone and app providers), it is not considered sufficiently private for protection from searches and seizures. That means that police can access this data—which often allows an individual to be physically tracked from moment-to-moment—without even requesting a warrant.
If this principle is upheld by the Supreme Court (which, so far, has refused to consider the issue), it would mean that police could access daily recordings from the privacy of your own home on little more than a hunch and an informal request. Though many may say they have nothing to hide, I doubt most of us would be comfortable knowing a police officer was looking over our shoulder twenty-four hours a day.
There is one barrier to that terrifying outcome, which is that Amazon has refused to comply with the Bentonville warrant and officers there have decided not to press the issue. Like Apple, Amazon has taken it upon itself to protect its customers’ privacy. But a private company cannot be expected to be the defender of its customers’ civil rights forever.
But until the law catches up to the state of technology, every one of our devices is capable of being turned into an informant against us. And though Alexa can do a lot, it has yet to learn how to invoke its Fifth Amendment right to remain silent. Until it does, you might want to think twice before inviting Alexa–and potentially the police–into your home.
Recently the Massachusetts Supreme Judicial Court ruled that under certain circumstances, a court may compel a criminal defendant to provide the password to encrypted digital evidence without violating the defendant’s constitutional rights. This is an increasingly prevalent issue that has divided courts across the country and may be presented to the United States Supreme Court for review soon.
Leon Gelfgatt was indicted in 2010 for allegedly operating a mortgage fraud scheme that fraudulently collected more than $13 million. During the investigation, Massachusetts state troopers seized four computers, all of which were protected by encryption software that Gelfgatt refused to remove. Lawyers for the Commonwealth of Massachusetts filed a motion in Superior Court asking the court to compel Gelfgatt to enter the password for his encryption software so that law enforcement could review the contents. The Superior Court denied the motion, stating that the Commonwealth was asking for the defendant’s assistance in accessing potentially incriminating evidence.
In a 5-2 ruling, the Massachusetts Supreme Court reversed the lower court ruling and held that police could compel Gelfgatt to decrypt his files, because he told investigators that the computer belonged to him and he had the encryption key. The majority opinion reasoned that Gelfgatt’s disclosure to investigators that he had the password to access the encrypted materials was sufficient to satisfy the “foregone conclusion” exception to the Fifth Amendment protection against self-incrimination. The court did not specify if Gelfgatt would have been compelled to decrypt the computers if he did not tell law enforcement that he owned the computers and had the ability to decrypt them, which may limit the reach of this opinion.
In a strong dissenting opinion, two justices found compelling a criminal defendant to decrypt the files is the functional equivalent to forced self-incrimination.
After the decision, one of Gelfgatt’s lawyers indicated that they planned to appeal the decision to the U.S. Supreme Court, which has not yet considered the issue that has divided jurisdictions across the country. In 2012, the U.S. Court of Appeals for the Eleventh Circuit held that a man under criminal investigation could not be compelled to decrypt his computer hard drives for the government without a showing by the government of specific knowledge about the contents of the hard drive, an opinion referred to by the dissenting opinion in this case.
In a time when law enforcement is increasingly relying on digital evidence in building cases against criminal defendants, issues regarding encryption and password protected materials will continue to arise. We hope the Supreme Court will grant an appeal and clarify that law enforcement cannot compel criminal defendants to decrypt files without violating the Fifth Amendment right against self-incrimination.
One of the hardest decisions on which a lawyer may be called upon to advise a client in civil litigation is the decision whether to assert the Fifth Amendment privilege. On the one hand, the overlap between pending civil and criminal matters may make it dangerous for the client to make statements that could incriminate him or her in the criminal case. On the other hand, while the assertion of a Fifth Amendment right in a criminal case may not be used against a defendant, the assertion of that right in civil litigation may permissibly lead to an adverse inference against the client in that lawsuit. There are a variety of strategies for dealing with this tension, including seeking a stay of the civil proceeding or a more limited protective order in the civil litigation.
While there are many approaches to dealing with these issues, a recent case in Nevada reinforced the lesson that blanket assertion of the Fifth Amendment may actually harm the client’s interest more than helping it. In Francis v. Wynn Las Vegas, LLC, 262 P.3d 705 (Nev. 2011), the Nevada Supreme Court upheld the lower court’s grant of summary judgment against a defendant on all claims and counterclaims based on the defendant’s overbroad assertion of the Fifth Amendment during his deposition.
In that case, the defendant owed a debt to the plaintiff, a Las Vegas casino, based on his marker. At the time of his deposition, the defendant was a party in the civil litigation and was also being prosecuted by local law enforcement. During the deposition, defendant asserted his Fifth Amendment privilege in response to nearly every question, including whether he was married, whether he lived alone, whether his father was still living and the names of his father and mother. 262 P.3d at 709. After Wynn Las Vegas filed a summary judgment motion, Francis sought to reopen discovery and “gave vague indications that Francis would like to withdraw his privilege. 262 P.3d at 710. The district court denied the request and castigated Francis for his blanket assertion of the privilege:
[Y]ou can’t use the 5th Amendment as a sword and a shield. You can’t sit in a deposition and – what’s your father’s name? Right to remain silent. Do you have a cell phone? Right to remain silent. That’s the most ridiculous exercise of the 5th Amendment I think I’ve ever seen.
Id. The court also refused to permit Francis to withdraw his assertion of the privilege.
On appeal, the state supreme court upheld the district court’s rulings and rejected Francis’ assertions that the court had penalized his exercise of the privilege by not permitting him to withdraw his assertion of the privilege and that the court should have accommodated his privilege by granting his request to reopen discovery. While the Court recognized the importance of protecting the valid assertion of a Fifth Amendment privilege, the Court found that Francis’ overbroad assertion of the privilege was unjustifiable and noted that Francis had not sought any other relief from the district court to protect his privilege (such as requesting that his deposition be sealed). After balancing the prejudice to the plaintiff, the Court found that the district court did not abuse its discretion in the way in which it had balanced the competing interests of the parties.
In Francis, the defendant’s inability to explain why he had conducted no discovery during the discovery period may have doomed him on summary judgment, regardless of his abusive exercise of the privilege against self-incrimination. But the lesson of this case is still one that sounds obvious when you say it out loud: A party in a civil proceeding should only assert the Fifth Amendment privilege when there is a basis to do so, and only as to those questions or other requests which genuinely pose a risk of self-incrimination (as understood in Fifth Amendment jurisprudence).
And while there may be strategic reasons to seek broad protection under the Fifth Amendment, counsel should be prepared to seek alternative means to protect a client’s interest before discovery is completed and before dispositive motions are filed so that the balance of interests will not weigh against the client’s interests in the litigation. Those who instead use a broad-brush approach to the assertion of the privilege will find themselves doing their clients a significant disservice.
Federal Criminal (Other)
A U.S. District Court in Colorado recently considered whether the constitutional privilege against self-incrimination extends to the compelled production of decrypted computer files. It is beyond dispute that the government may not force a suspect to provide an encryption password if the password would provide a necessary link in the chain of evidence leading to the suspect’s indictment. A much more difficult question is whether the government may force a suspect to use the password to produce decrypted computer files that contain incriminating evidence.
In United States v. Fricosu, Judge Robert Blackburn held that the government can indeed force a suspect to use an encryption password if the testimony implicit in the use (i.e., the act of producing decrypted files) is already known to the government and/or the implicit testimony will not incriminate the suspect. The court ordered the defendant to produce decrypted files from her laptop because the government already knew (based on uncompelled testimony) that the files were on a computer that belonged to her and for which she had the password. Judge Blackburn’s decision is the most recent in a growing body of case law that attempts to thread the needle as to when the Fifth Amendment protects against the court-ordered production of computer data.
In 2010, FBI agents investigating a mortgage-fraud scheme executed a search warrant at the home of Ramona Fricosu. The agents seized six computers, one of which was a laptop that apparently belonged to Fricosu. When the agents turned it on, they were able to view the disk encryption screen, which identified the computer by Fricosu’s first name. But without Fricosu’s password, the agents could not access the encrypted files.
The next day, Fricosu’s ex-husband called her from the correctional center. FBI agents recorded the conversation. Several times during the call, Fricosu and her ex-husband referred to the laptop as hers. Fricosu also mentioned that the laptop contained encrypted documents related to the mortgage-fraud scheme. Based on that conversation, the government applied for a warrant to search Fricosu’s laptop, and the court issued a writ requiring Fricosu to produce a decrypted version of her computer files.
The Fifth Amendment guarantees that “[n]o person . . . shall be compelled in any criminal case to be a witness against himself.” Generally, a person may invoke the privilege based on a showing that the government seeks to compel that person to give testimony that would incriminate him or her. If any of these three criteria are not met (compulsion, testimony, and incrimination), Fifth Amendment protections will not obtain.
The Fricosu court distinguished between statements that are not compelled and those that are. For example, statements in files created voluntarily before the investigation was underway were statements the court had not compelled. Thus, they were not protected. By contrast, implicit statements Fricosu would necessarily make by producing the files — statements regarding the existence, location and authenticity of the computer files, for example — were statements that would be compelled and, therefore, subject to constitutional protections.
Courts recognize a Fifth Amendment exception for implicit statements regarding the existence, location and authenticity of computer files. When the government can demonstrate that it already knows the existence and location of items to be produced, this exception precludes an individual from avoiding production based on the Fifth Amendment. In Fricosu, the taped conversation between Fricosu and her ex-husband included their voluntary statements about the existence, location and authenticity of mortgage-fraud documents on the laptop. Court-ordered production of the computer files would compel Fricosu to affirm statements made during the call, but the affirmation would not tell the government anything it did not already know.
Second, the court distinguished between non-testimonial and testimonial evidence. The Fifth Amendment does not protect against the production of non-testimonial evidence. Thus, a person may be required to provide blood samples or handwriting exemplars, appear in a line-up, or speak aloud for voice identification. However, the Fifth Amendment does protect against the production of evidence that discloses the contents of a defendant’s mind, including his or her beliefs and knowledge. Moreover, the amendment protects against any production that would compel a defendant to restate, repeat or affirm the truth of statements contained in documents sought. That is why, for example, a court may not require a criminal defendant to provide an encryption password. The act of producing the password requires the defendant to affirm that the password is correct. Thus, the act of production is deemed to be testimonial and subject to constitutional protections.
The Fricosu court avoided Fifth Amendment issues by ordering the defendant to produce decrypted versions of her laptop files instead of the encryption password. The production of decrypted files was not testimonial because it did not convey any information in the defendant’s mind that the government did not already have, nor did the act of production require the defendant to restate, repeat or affirm statements contained in her files. The Supreme Court has explained that a testimonial act is akin to revealing a combination or password to a wall safe because the combination or password is in the suspect’s mind. A non-testimonial act is like surrendering the key to a strongbox. The act of surrendering gives no indication of the person’s thoughts or knowledge.
Finally, the privilege against self-incrimination applies only if the compelled testimony incriminates the defendant. Testimony is deemed to be incriminating if it would furnish the government with a necessary link in the chain of evidence leading to the suspect’s indictment. The government can (and very often does) preclude a showing of incrimination by offering use and derivative use immunity. This ensures that that the government will not use compelled testimony to further its investigation against the source of the testimony.
In Fricosu, the government sought to avoid any possible Fifth Amendment issues with the writ application by offering Fricosu use immunity. As the court noted, this offer protected Fricosu against self-incrimination by guaranteeing that it would not use her act of producing decrypted computer files against her, whether directly or indirectly.
Federal Criminal (Other)