Fifth Amendment; Forgone Conclusion Doctrine; Compelling Disclosure of Digital Password
Commonwealth v. Davis, 176 A.3d 869 (Pa. Super. 2017), allocatur granted Oct. 3, 2018, appeal docket 56 MAP 2018
On October 10, 2015, police executed a search warrant at Davis’ residence after it was determined that a computer with an IP address subscribed to Davis utilized peer-to-peer file sharing network, eMule, to share child pornography. During the search, police seized a password-encrypted computer. Forensics could not examine the contents of this computer due to the “TrueCrypt” encryption program installed on it and Davis refused to provide the password.
On December 17, 2015, the Commonwealth filed a pre-trial “Motion to Compel Defendant to Provide Password for Encryption Enabled Device.” The trial court conducted an evidentiary hearing on the Commonwealth’s motion. Evidence showed that the IP address of the computer had downloaded child pornography on multiple occasions, that Davis had admitted to viewing child pornography multiple times, and that Davis stated he refused to give up the password because police already knew what was on the computer and that it would only hurt him. The trial court compelled Davis to disclose the password, reasoning Davis’s argument under the Fifth Amendment right against self-incrimination is meritless because the password is not testimonial in nature where the information it will provide (presence of child pornography) is a forgone conclusion given the established evidence.
Superior Court affirmed, noting that the question of whether compelling an individual to provide a digital password is testimonial in nature and therefore triggers the Fifth Amendment right against self-incrimination is an issue of first impression. The court reasoned that the Pennsylvania Constitution’s Article I, § 9 right against self-incrimination affords no greater protections than the Fifth Amendment to the United States Constitution, leading Superior Court to look to other courts’ analyses of Fifth Amendment implications of compelling an individual to produce a password key for an encrypted computer and relation to the “forgone conclusion” doctrine. The forgone conclusion doctrine is an exception to Fifth Amendment privilege against self-incrimination. It provides:
that an act of production does not involve testimonial communication where the facts conveyed already are known to the government, such that the individual “adds little or nothing to the sum total of the Government’s information.” For the exception to apply, the government must establish its knowledge of (1) the existence of the evidence demanded; (2) the possession or control of that evidence by the defendant; and (3) the authenticity of the evidence.
Commonwealth v. Gelfgatt, 11 N.E.3d 605 (2014). The Third Circuit Court of Appeals previously explained that for the foregone conclusion exception to apply, the Commonwealth “must be able to describe with reasonable particularity the documents or evidence it seeks to compel.” United States v. Apple MacPro Computer, 851 F.3d 238 (3d. Cir. 2017). The Second District Court of Appeals of Florida addressed a similar issue in the context of a motion to compel a defendant charged with video voyeurism to produce the passcode for his iPhone. State v. Stahl, 206 So.3d 124 (Fla. Dist. Ct. App. 2016). The Stahl court held that requiring a defendant to produce his passcode did not compel him to communicate information that had testimonial significance. It reasoned:
To know whether providing the passcode implies testimony that is a foregone conclusion, the relevant question is whether the State has established that it knows with reasonable particularity that the passcode exists, is within the accused’s possession or control, and is authentic.
. . . .
The State established that the phone could not be searched without entry of a passcode. A passcode therefore must exist. It also established, with reasonable particularity based upon cellphone carrier records and Stahl’s identification of the phone and the corresponding phone number, that the phone was Stahl’s and therefore the passcode would be in Stahl’s possession. That leaves only authenticity. And as has been seen, the act of production and foregone conclusion doctrines cannot be seamlessly applied to passcodes and decryption keys. If the doctrines are to continue to be applied to passcodes, decryption keys, and the like, we must recognize that the technology is self-authenticating—no other means of authentication may exist. If the phone or computer is accessible once the passcode or key has been entered, the passcode or key is authentic.
Applying these principles, Superior Court held that disclosing the password would not communicate facts of a testimonial nature to the Commonwealth beyond that which Davis had already acknowledged to investigating agents. The court reasoned that evidence already established that the Commonwealth knows with reasonable particularity that the passcode exists, is within Davis’ possession and is authentic.
The court also recognized that multiple jurisdictions have held the government’s knowledge of the encrypted documents or evidence that it seeks to compel need not be exact. Here, the evidence showed there is a high probability that child pornography exists on the computer.
The Supreme Court of Pennsylvania granted allocatur on the following issue as stated by Petitioner:
May [Petitioner] be compelled to disclose orally the memorized password to a computer over his invocation of privilege under the Fifth Amendment to the Constitution of the United States, and Article I, [S]ection 9 of the Pennsylvania Constitution?