January 16, 2008 - Can the government force an individual to give up their computer password if doing so would incriminate them? This is the question that the US District Court in Vermont has had to contend with recently. The case may be the first of its kind and may very well wind up being decided by the Supreme Court. So far the rights of the individual to avoid self incrimination seem to be winning. But if ever there was a case that could stir up mixed emotions about individual rights verses the government's obligation to protect the public, this may be it. The person that the feds are after is accused of trafficking in child pornography.

It's been more than a year since the government arrested Sebastian Boucher as he attempted to cross the border into Canada. When he pulled up to the border crossing, a customs agent noticed a laptop computer sitting on his back seat. He asked Boucher if he could take a look and Boucher agreed.

When the computer was turned on, the customs officer noticed some file titles that led him to believe that the computer contained child porn. After reviewing some files that were contained in the computer's internet cache, the agent arrested Boucher based on the fact that at least one video file appeared to contain images of an underage teen undressing.

Boucher's computer was then sent to a lab for forensic testing. But those tests quickly came to a grinding halt when it was discovered that one of the computer's hard drives was completely encrypted. Boucher had installed a software program called Pretty Good Encryption, or PGP. The program is freely available to anyone who wants to use it. It works so well that even police and intelligence agencies use it to protect their own information.

The government suspects that the encrypted hard drive on Boucher's computer contains all of his stored child pornography. But in order to prove this, they need to gain access to the drive. The only way to do that is if Boucher tells them his PGP password.

Boucher contends that revealing his password would violate his 5^th Amendment right to avoid self incrimination. On November 29^th, 2007, in what may become a landmark ruling, Federal Magistrate Jerome J. Niedermeier agreed that compelling Boucher to reveal the password would constitute a violation of his constitutional rights. "If Boucher does know the password, he would be faced with the forbidden trilemma: incriminate himself, lie under oath, or find himself in contempt of court," the judge said.  

Federal prosecutors have appealed the ruling. If they lose, the government will be faced with a very large dilemma. Virtually anyone can learn to encrypt computer files. If the government can't force people to reveal their encryption keys, it means that everyone from tax cheats to drug dealers will be using PGP and there will be nothing that the government can do to make them turn over their files.

But ruling also provides significant protections to law abiding citizens; giving everyone a tool to avoid undue or unwarranted government snooping.

The government may have a real problem convincing any court to overrule Niedermeier. In his decision, Niedermeier compared Boucher's encryption key with a combination to a safe. Niedermeier said that if a safe has a key, the government can certainly force the owner to present the key because it is physical. But if the safe has a combination, it can't force the owner to reveal it because the combination is stored only in the owners mind. Forcing the owner to make such a revelation is a "testimonial act" and protected by the 5^th Amendment.

by Jim Malmberg

Note: When posting a comment, please sign-in first if you want a response. If you are not registered, click here. Registration is easy and free.

Only registered users can write comments.
Please login or register.