Hacker News Reader

Comment by geofft | Hacker News Reader

Eugene Volokh has a deeper analysis:

https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

I was surprised to read that he thinks (and previously thought) this would be the right ruling. My non-lawyer tl;dr is that your passcode isn't "testimony": the government knows the passcode exists and that you know passcode, and therefore it isn't subject to the same protection that would apply to telling the government some piece of information that may or may not exist and is inherently interesting. At the very least, he claims, the government is absolutely in the clear to compel you to enter your passcode and not reveal what it is.

View on HN

I would agree with the analysis that "At the very least ... the government is absolutely in the clear to compel you to enter your passcode and not reveal what it is."

As a matter of policy, I can think of three important principles at play:

* If we want encryption that the government and the tech companies themselves cannot decrypt without your consent, then the passcode is the only way to get in.

* The justice system should have a way to see inside locked places if it reasonably believes that there is important/relevant evidence inside.

* The person who might be coerced to give up the passcode is likely the only person who knows the passcode.

I can't think of a better compromise that lets you have all three things without some sort of compromise, and a combination of compelling you to open the box without revealing the passcode as well as some limits on how much the government can examine once inside seems like the best balance.

Hmmm. I agree with this more than I thought I would have.

I think the real thing here is that the reason to protect against self-incrimination is really a protection against abuses of the justice system, against the ability for judges to force false confessions out of people. If you somehow knew that that a piece of testimony would be guaranteed honest and guaranteed uncoerced, is there still an argument for not requiring you to testify about it, just because it's about yourself?

I think we're left with diafygi's argument about muscle memory, that a suspect may have literally forgotten the passcode and the courts shouldn't be able to say "No you didn't."

Exactly. The government can compel you to open a gun safe, and they can compel you to login to your computer. Those are both pieces of "evidence" not "testimony" (or as much as there can be a difference).

Exactly, the key is "testimonial evidence," as in, is the piece of information the government is making you tell them testimonial in nature as defined by case law. Testimonial seems to be defined by case law as giving some kind of real information. . . which to me is a vague standard, I mean, doesn't all communication, aside from incoherent blathering give some kind of information. The court in my reading hasn't really clarified how much or what kind of information has to be given up before becoming testimonial. The supreme court has previously found that signing declarations and consents, (like if they government were to force you to sign a consent to a bank to turn over your banking info), wasn't testimonial because a declaration doesn't communicate any real info. I don't know if the same reasoning can apply to cell phone passwords but they really need a clearer standard.

Just a small addition, the analysis was done by prof. Orin Kerr[1], who is writing for "Volokh Conspiracy". He writes a lot about the intersection of technology and 4th/5th amendment, etc. I don't agree with everything with him, but it is pretty interesting, and he writes clearly.

1. https://www.law.gwu.edu/orin-s-kerr?id=3568

Whoops, I'm not sure how I failed to see the byline. Thanks for the correction!

What if the passcode you use is a confession to another crime?

I continue to not be a lawyer, but my guess is the government will make that particular passcode inadmissible as evidence in the second crime, and then demand it for prosecuting the first crime. My impression is the legal system is generally good at Seeing What You Did There and is rarely amused.

See, e.g., Sega v. Accolade, where it turns out that you can't implement a DRM system that consists solely of forcing people to display your trademark, and then sue them for trademark infringement.

I imagine it would fall under the same category as the police discovering a dead body in your home while performing a legal, unrelated search (you're going to jail).

doesn't matter, if the police stumble onto incriminating evidence in the course of the ordinary and legal investigation of a crime, it can be used in court.

Reply on news.ycombinator.com