Commonwealth v. Gelfgatt

In a 5-2 decision, the Massachusetts high court ruled that it does not violate a defendant’s Fifth Amendment right against self-incrimination to order a criminal suspect to decrypt files found on a seized computer.

The defendant, who was also an attorney, purportedly devised a scheme to defraud  homeowners by funneling mortgage payments made by the homeowners to himself. According to the state, the defendant would forge mortgage assignment documents indicating that the mortgage had been assigned to companies that the defendant had made up. The mortgagor would then pay its mortgage payment to the defendant’s companies, and thus, to the defendant. The defendant created a total of 17 false assignments that totaled $13 million.

The State believed that the defendant heavily relied on the use of computers in his fraudulent scheme to conceal his identity and effectuate the scheme. The defendant was eventually arrested and police executed a search warrant of the defendant’s home whereupon they found four computers encrypted with “DriveCrypt Plus” software. Unfortunately, the encryption software is virtually impossible to circumvent absent access to the password.

Two years after his arrest, the State filed a motion to compel decryption, asking that the Court order the defendant to decrypt the files. The defendant contended that production of a password to decrypt computer files would constitute an admission of ownership, knowledge, and control. The lower court agreed and denied the motion holding that the request would violate the defendant’s Fifth Amendment rights against self-incrimination. The State appealed.

In its recent decision, the Massachusetts Supreme Judicial Court held that  production of a password to decrypt files on a computer would not violate the defendant’s Fifth Amendment rights because the decryption is not a testimonial communication. As iterated by the Court, “It is well established that ‘the Fifth Amendment does not independently proscribe the compelled production of every sort of incriminating evidence but applies only when the accused is compelled to make a testimonial communication that is incriminating’” or communicative in nature. Fisher v. United States, 425 U.S. 391, 408 (1976).

The Court acknowledged that the act of decrypting the files would, at first blush, appear to be testimonial in nature because the defendant would be acknowledging that he has ownership and control over the computers and their contents. However, the Court held that the defendant’s production of a password loses its testimonial nature under the “foregone conclusion” exception to the Fifth Amendment.  “The ‘foregone conclusion’ exception to the Fifth Amendment privilege against self-incrimination provides that an act of production does not involve testimonial communication where the facts conveyed already are known to the government, such that the individual ‘adds little or nothing to the sum total of the Government’s information.” Fisher, 425 U.S. at 411.

The Court held that the defendant’s decryption of the files added nothing to what the government already was aware of. As a result, the decryption fell under the foregone conclusion exception and was not communicative or testimonial in character to invoke the defendant’s Fifth Amendment privilege against self-incrimination.

Indeed the rulings in these kinds of cases are split among the circuits and are sure to reach the Supreme Court at some point in the near future. For instance, the district court for the Eastern District of Michigan in 2010 quashed a government subpoena requesting that a defendant provide the government access to his personal computer by handing over his password. The Court ruled that seeking the defendant’s computer password required the defendant to “testify” as to incriminating information, which is protected by the Fifth Amendment.

In a similar case, a federal court judge in the Second Circuit ruled that a defendant accused of downloading child pornography did not have a Fifth Amendment right to keep his personal computer files encrypted. Instead, the Court ruled that because the defendant had already admitted ownership of the laptop and the incriminating photos had been previously viewed, the defendant providing the password was not incriminating.