14 DAY TRIAL // A Colorado judge is faced with the decision of whether to order a defendant in a mortgage fraud case to decrypt her own data or not. The case will test if the Fifth Amendment applies to electronic data.
The Department of Justice is seeking a court order that would force Ramona Fricosu to release the password to her encrypted laptop in a case where she is accused of bank fraud, wire fraud, and money laundering. Fricosu faces over 30 years in prison if convicted.
The DoJ says that it doesn't want the actual password, only the decrypted contents of the computer seized during a raid on the defendant's house. They want the judge to compel Fricosu to type in the password herself and hand over the data.
"Failing to compel Ms. Fricosu amounts to a concession to her and potential criminals (be it in child exploitation, national security, terrorism, financial crimes or drug trafficking cases) that encrypting all inculpatory digital evidence will serve to defeat the efforts of law enforcement officers to obtain such evidence through judicially authorized search warrants, and thus make their prosecution impossible," the DoJ claims, according to CNET.
However, lawyers from the Electronic Frontier Foundation feel differently. The digital rights watchdog has filed an amicus brief arguing that compelling Fricosu would violate her Fifth Amendment right.
"Ordering the defendant to enter an encryption password puts her in the situation the Fifth Amendment was designed to prevent: having to choose between incriminating herself, lying under oath, or risking contempt of court," EFF Senior Staff Attorney Marcia Hofmann said.
The question of whether or not an encryption password is protected by the Fifth Amendment has been asked before, but the answer is undecided. The Justice Department compares such passwords with physical keys to file cabinets with incriminating evidence.
Defendants have been compelled to release keys before. However, civil rights supporters argue that a password is only stored in one's mind, the contents of which are protected under the Fifth Amendment.
While in US this is still under debate, in UK the situation is pretty clear. A judge can compel a defendant to decrypt their data or release their password. Refusing to do so represents a violation of the Regulation of Investigatory Powers Act (RIPA) of 2000 and is punished with prison time.