Pretty Good Privacy is Pretty Legally Protected

A federal magistrate judge has ruled that a criminal suspect has a Fifth Amendment right not to divulge his PGP passphrase. The suspect, Sebastian Boucher, was charged with transporting child pornography on his laptop across the US-Canadian border. Customs agents had searched Boucher's laptop in December 2006 and found kiddie porn on the Z drive without entering a password. Boucher was arrested and the laptop was shut down. When investigators later tried to access the Z drive again, they found it encrypted with Pretty Good Privacy. Prosecutors then got a grand jury to issue a subpoena ordering Boucher to turn over his password. He refused, and prosecutors offered to let him type the password into the laptop with nobody looking. Magistrate Judge Jerome Niedermeier quashed (read as: cancelled) the subpoena, finding that even the prosecutors' compromise would require Boucher to give protected evidence against himself.

The Fifth Amendment protects against self-incrimination, but not everything that might incriminate you falls within that protection. For example, you can be forced to turn over your fingerprints, blood, or handwriting, because it's already obvious that you have fingerprints, blood, and can write. The inquiry hinges on whether the what you're being asked to do is "testimonial," whether it divulges facts about you and what you know. The Supreme Court has analogized the difference between testimonial and nontestimonial acts to the difference between the combination to a lock and a physical key; you can be compelled to turn over a key, but being forced to turn over a combination would reveal that you knew the combination. Revealing the contents of your mind is testimonial, so it's protected by the Fifth Amendment.

Magistrate Judge Niedermeier found the PGP passphrase more akin to a combination, because inputting the password would reveal that Boucher actually knew the password. Whether people have a Fifth Amendment right to keep their passwords private has been debated in legal scholarship for a long time; this is the first published decision to enter the fray. Don't think this settles the issue, though. Magistrate judges are low on the totem pole, so expect this to be appealed.