Norma Acosta on Encryption and the Fifth Amendment

Hard Disks, Encryption and the Fifth Amendment

Norma Acosta

"Self Incrimination and Cryptographic

"When does public security come before
fifth amendment rights?"

the Department of Justice's "Federal Guidelines for
Searching and Seizing Computers".

Encryption and the Fifth Amendment

Introduction
Modern cryptography can make it virtually impossible to decipher
documents without the cryptographic key, thus making the
availability of the contents of those documents depend on the
availability of the key. I will examine the Fifth Amendments'
protection against compulsory production of the key.

Compulsory Production of Cryptographic Keys and
the Fifth Amendment

Accessibility of Documents

The Fifth Amendment provides: No person shall be
compelled in any criminal case to be a witness against
himself.

The USSC has narrowed the privilege so that it applies
only if the act of producing papers or records has a
self-incriminatory communicative or testimonial
aspect.

If the act of handing over the papers is
noncommunicative--if it neither reveals the
existence of the document nor authenticates
it--then the Fifth Amendment does not apply.

Only natural persons are protected by the Fifth
Amendment, and only for papers that they both own
and control.

Corporations can never claim the privilege, and
neither can natural persons with regard to
corporate records.

Once papers are handed to another, the legitimate
expectation of privacy needed to maintain a claim
under either the Fourth or Fifth Amendments
disappears.

Can a key be "incriminating"?

Fifth Amendment analysis must focus on the disclosure
of the cryptographic key on the assumption that the
key is not written down.

The Fifth Amendment is interpreted to bar only the
production of "testimonial information," so
the protection of the Fifth Amendment
extends only to an incriminating
communication that might "itself, explicitly
or implicitly, relate a factual assertion or
disclose information."

A non-cryptographic key is physical evidence, not
testimonial evidence.

A cryptographic key need not have testimonial content.

A key can be any word, phrase, or a series of
randomly chosen digits.

Although the key has no testimonial content, a statement
concerning the key is testimonial.

One unique property of a cryptographic key is that it
creates communicative content.

Producing a cryptographic key gives the document a
testimonial content by decrypting the
document and returning it into plaintext.

Result: the compulsory production of the
key is the compulsory creation of
testimonial content. Without the key,
the documents would not be useful as
testimony.

Another unique property of a cryptographic key is that it
can operate as a digital signature, thus
authenticating a document.

The Scope of Immunity

Derivative Use Immunity

Definition: Immunity from any use, direct or
indirect, of the compelled testimony and any
information derived therefrom.

The federal government has suggested that it will
seek to grant immunity as a tool for
discovering encrypted documents.

Question: Does immunity extend only to the key
or does it also cover the decrypted document
produced by applying the key to the encrypted
text?

Immunity as a result of unique properties of
cryptographic keys

Creation of communicative content through
decryption

The production of a cryptographic key
indirectly relates the material
contained in the document decrypted
with the cryptographic key and should
therefore lead to immunity under the
Fifth Amendment for the document
produced with the key.

Because the key is a necessary link in the chain, it
gives rise to immunity from documents with
it.

Authentication through decryption

The Fifth Amendment precludes the
compulsory authentication of
documents.

Authentication will be impossible without the key.

Conclusion

Back to the list of student paper topics

Back to the CCP home page