Can the government force you to reveal a password to unlock encrypted files on your computer that are known to contain child pornography? Or would doing so constitute a violate your Fifth Amendment right against self incrimination?
That's the issue in front of a US federal district court in Vermont in what is believed to be the first case to test the issue in the U.S.
The case involves a Canadian citizen, Sebastien Boucher, who is now a legal permanent resident living in Derry, N.H. Boucher was arrested in December 2006 at the Canadian border in Derby Line, Vt. on charges of transporting child pornography on his computer.
According to a description of the arrest in court documents, Boucher was pulled over for a secondary inspection by a Custom and Border Protection officer while attempting to cross into the U.S from Canada. During the secondary inspection, the officer noticed a laptop computer in Boucher's car and proceeded to inspect it for child pornography images.
Of the 34,000 or so image files on Boucher's computer, several appeared to have names suggesting explicit child pornography, including one titled, "Two-year old being raped during diaper change." On being asked by the officer whether the computer contained child pornography images Boucher claimed that he did not know for sure because he had not checked the temporary Internet files folder on his computer.
A special agent who had experience and training in identifying child pornography was then called in to inspect Boucher's computer. That inspection revealed several images of adult and animated child pornography. But when the special agent tried to click on the file with the name suggesting child pornography, he found he was unable to open it. When asked about the file, Boucher stated that he visited various newsgroups from which he downloaded pornographic images. He conceded that some of the files might unknowingly be child porn but added that he deleted those files when he saw them.
Boucher was then asked to show the agent the files that he downloaded from such news groups. Boucher was allowed access to the laptop and he navigated to a section of it called drive Z. An inspection of the files in drive Z revealed several containing graphic child pornography including many involving preteens. The computer was then seized and Boucher himself was arrested.
About two weeks after the arrest, an officer at the Vermont Department of Corrections took custody of Boucher's laptop and created a mirror image of its contents. However when he attempted to access the contents in drive Z, he found that he was unable to do so because it had been encrypted using software from Pretty Good Privacy (PGP).
According to court documents, the files are nearly impossible to open without knowing the password or without any "back doors" to the files. The only way to get access to the files without the password is to use an automated password guessing system but it's a process that could take years, according to the government.
A grand jury subpoenaed Boucher to provide the password for accessing the files. Boucher refused on the grounds that it violated his Fifth Amendment right against self incrimination. Magistrate Judge Jerome Niedermeier, who heard the case this past November, granted Boucher's motion to quash the grand jury subpoena.
In explaining his decision, Niedermeier said that compelling Boucher to enter the password forces him to produce evidence that could be used to incriminate him. "By entering the password, Boucher would be disclosing the fact that he knows the password and has control over the files on drive Z," he said. "If Boucher does know the password, he would be faced with the forbidden trilemma; incriminate himself, lie under oath, or find himself in contempt of court," Niedermeir wrote.
Earlier this month, the government appealed Niedermeier's decision to the U.S. District Court in Vermont, which now needs to make a decision on the issue.
As a test case, the Boucher affair is a messy one, said Michael Froomkin, professor of law at the University of Miami's School of Law in Florida. Giving up the password to an encrypted file automatically ties that individual to the file and its contents, Froomkin said. In this case, it would be akin to Boucher admitting that he knew what the contents of the file were and how to access it, both of which could be considered self-incriminating.