Are Passwords Protected By The Fifth Amendment? Print E-mail
Written by Keith J. Jones   
Monday, 11 February 2008 18:00

A recent CBS News article highlights a case where an individual, Sebastien Boucher, was stopped at the Canadian/U.S. border.  At that time, Boucher helped border agents initially inspect his laptop computer.  The purpose of the search seems to be unclear.  It was reported that the agent discovered file names consistent with child pornography.  The agency sized the laptop and upon further review, the agents ran into encryption on Mr. Boucher's hard drive.  Here too, the details are a bit unclear as the article reports the following information:

"The laptop was seized, but when an investigator later tried to access a particular drive, he was thwarted by encryption software from a company called Pretty Good Privacy, or PGP."

It is unclear as to how the agent saw the file names of suspect images during his initial search.  If PGP drive encryption was used, the file names should have been encrypted (if it was a separate drive or partition) and they would have never been seen in the initial search.  The only situation that would make sense was if the initial search occurred when the laptop was turned on and the system drive was protected with PGP.  Later, when the agents examined the hard drive while it was turned off, the file names and content would have been encrypted.  

The surprising outcome of this case was that a federal magistrate ruled that forcing Mr. Boucher to reveal his password would be unconstitutional.  It has been argued that a password is something a person knows, which is different than something physical such as a brass key.  Forcing a person to divulge their password forces them to give information that incriminates himself, which ends up being unconstitutional. 

I would assume that if an agent had a search warrant to view the contents of a person's physical safe that could only be opened via a code typed into the digital panel, the code would be protected by the fifth amendment as well.  The difference with a physical safe is that the agent has the luxury of using a safe cracker which could physically open the safe without the use of the code. 

The issue of access to PGP volumes on Mr. Boucher's laptop is a little more difficult than my physical safe analogy above.  PGP volumes are one of the toughest encryption mechanisms to crack.  Unlike other encryption mechanisms, it is not as simple as guessing a small eight character password to get into the volume.  Instead, PGP can be encrypted using long phrases.  Analysis of the payoff of getting into a PGP volume versus the cost/time associated with it usually dictates if someone will even attempt to crack the volume.  Even then, it cannot be guaranteed that the volume will be cracked before it is needed in court or the statute of limitations runs out.