Password Protected?

A case that got some interest from legal blogs back in December hit the front page of the Washington Post yesterday. Folks often complain that the courts overlawyer what should be simple questions and this case falls into one area where courts' decisions are based on quite subtle distinctions of precedent. I'm not interested in discussing all that here; rather, I'm just curious to know what you guys think the right answer should be in the case and why.

The facts are these:

Sebastien Boucher, an LPR with Canadian citizenship was crossing back into Vermont when he was stopped by Customs and Border Patrol. I don't know what made them suspicious, but they found a laptop in the back seat of his car and wanted to look at it. Boucher said it was his laptop and when the CBP agent opened it he saw the names of files that strongly suggested they were child pornography.

The agent then asked Boucher if there was child pornography on the lappy and if he would show it to them. For whatever reason, Boucher did, navigating to the machine's "drive Z." There, the agents found videos and photos of child porn. Boucher was arrested; the laptop was seized and the hard drive contents copied.

Fastforward a few weeks. The government's forensic analyst wants to look through the copy of drive Z in preparation for the case and discovers that it is encrypted. (They copied the hard disk exactly.) His options are to guess Boucher's password to unlock the drive or break the encryption, either of which has a only a small chance of happening and which would certainly take years to do anyway.

So the government has asked the court to order Boucher to give up the password. He objects, citing the Fifth Amendment right against self-incrimination. So far a magistrate judge has agreed with Boucher, saying, ""If Boucher does know the password, he would be faced with the forbidden trilemma: incriminate himself, lie under oath, or find himself in contempt of court." The government has appealed.

So, what do you think?

On the one hand, we've got a child porn pervert who already showed the government some of the content on drive Z. He certainly has no right against self-incrimination as to that material; he has already voluntarily incriminated himself. That leaves out whatever other child porn is in there, however, and I'd dearly like to see him punished for all of it. And there is the practical problem that it isn't possible for Boucher to hand over access to only that material he has already disclosed.

On the other hand, I'm not a big fan of the government ordering a person to decrypt his or her files no matter what we might suspect they contain. The government obviously has the right to seize the property and poke, prod, and dissect it as it sees fit. But I don't like the idea that they can force a person to help them do it so they can build a case against him.

This is a new question for courts, one which represents the ever-increasing impact of technology on the law. In his decision, the magistrate judge analogized the situation as to a physical safe that can either be opened with a key or with a combination.

I'm curious to know what you think.

posted by Gabriel Malor at 05:50 AM

| Access Comments