Here’s a Good Reason to Encrypt Your Data

By David Kravets

There’s many reasons to password-protect — or encrypt — one’s digital data. Foremost among them is to protect it during a security breach.

Another top reason is to keep the government out of your hard drive.

The issue is front and center as a federal magistrate is refusing to order a Wisconsin computer scientist to decrypt his data that the authorities seized from kiddie-porn suspect Jeffrey Feldman. The reason is simple: The Fifth Amendment right against compelled self-incrimination protects even those suspected of unsavory crimes, according to U.S. Magistrate William Callahan Jr. of Wisconsin, who wrote:

This is a close call, but I conclude that Feldman’s act of production, which would necessarily require his using a password of some type to decrypt the storage device, would be tantamount to telling the government something it does not already know with ‘reasonably particularity’—namely, that Feldman has personal access to and control over the encrypted storage devices. Accordingly, in my opinion, Fifth Amendment protection is available to Feldman. Stated another way, ordering Feldman to decrypt the storage devices would be in violation of his Fifth Amendment right against compelled self-incrimination. (.pdf)

Hanni Fakhoury, a staff attorney with the Electronic Frontier Foundation, stressed that the decision was important, and not because it might hinder a kiddie-porn prosecution.

“This isn’t just about child porn. It’s about anything on your computer that prosecutors or government officials may want,” he said in a telephone interview.

Federal prosecutors did not immediately respond for comment, but said in court papers they have spent months trying to decrypt the data.

“The FBI is performing admirable in the digital arms race between those seeking to hide evidence of their wrongdoing through encryption and law enforcement officers seeking to uncover that evidence; but the expense in time and resources in investigating cases like this one is beginning to inhibit the provision of justice,” the government said (.pdf) in seeking the magistrate to compel the suspect to unlock the data.

The suspect was not immediately reachable.

To be sure, decryption orders are rare, and they have never been squarely addressed by the Supreme Court despite varying opinions in the lower courts.

Just last year, for example, a federal appeals court rejected an appeal from a bank-fraud defendant who has been ordered to decrypt her laptop so its contents could be used in her criminal case. The issue was later mooted for defendant Romano Fricosu as a co-defendant eventually supplied a password.

Contrary to the Wisconsin child pornography case, however, the Fricosu matter was distinguishable because the authorities had evidence that her hard drive might contain evidence against her, meaning the court felt her Fifth Amendment rights were not at issue. That’s because the authorities had recorded a jailhouse conversation between her and a co-defendant, in which the laptop’s contents were discussed.

It’s worth noting that encryption is not 100 percent effective.

And failing to comply with a judge’s decryption order — or any order for that matter — might result in a contempt charge and land you in jail pending compliance. Alleging you forgot your encryption password is another story.