You shouldn't have to surrender your constitutional rights in order to safeguard your electronic privacy.  In a new amicus brief we filed today, we told a federal court in Wisconsin that ordering a man to decrypt the contents of computers seized from his apartment would violate the Fifth Amendment privilege against self-incrimination.

The case involves the FBI's attempts to decrypt the contents of more than ten storage devices and hard drives found in the apartment of Jeffrey Feldman in the course of a child pornography investigation. After spending months trying to decrypt the drives, the government applied for a court order forcing Feldman to provide the government with the decrypted contents of the drives.

The Fifth Amendment protects a person from being "compelled in any criminal case to be a witness against himself." The question here is whether forcing Feldman to decrypt the contents of the computer drives is "testimony" that is protected by the Constitution. The issue ultimately boils down to whether the government is forcing him to reveal the contents of his mind and communicate a fact to the government it doesn't already know. If so, then the Fifth Amendment applies and the only way the government can compel Feldman to decrypt or "testify" is to offer that person immunity from the testimony.

A magistrate judge initially denied the government's request, finding the act of decryption was protected by the Fifth Amendment. The court found the government hadn't sufficiently proven that the drives in question were accessed and controlled by Feldman. That would tell the government something it didn't necessarily know: that the drives -- and their contents -- belonged to and were controlled by Feldman. That testimony would incriminate him and therefore triggered the Fifth Amendment privilege.

A month later, after the government was able to decrypt a portion of one of the drives and found personal files belonging to Feldman, the magistrate reversed its earlier decision, and found that since the government had sufficiently proven access and control to one drive, Feldman could now be compelled to provide the decrypted contents of all the drives. That was because the fact the government would learn -- that the drives belonged to and were accessed and controlled by Feldman -- was essentially a "foregone conclusion" and thus the government would learn no new facts as a result of Feldman's testimony. After Feldman objected, the district court stayed the magistrate's order, agreed to review the order, and asked for new briefing on the issue.

Our brief supports Feldman's argument against decryption, explaining that the act of decryption triggers the Fifth Amendment privilege. The government failed to show Feldman's access and control of the remaining unencrypted devices is a "foregone conclusion" since they were only able to decrypt a portion of one drive -- that fact alone says nothing about the remaining drives. In the absence of any additional information that shows Feldman had access and control of the drives and the content inside, the Fifth Amendment protects him from decrypting. Ultimately, if the government wants Feldman's testimony it must give him immunity that is "coextensive" with the privilege. That means the government can't use the fact Feldman decrypted the drives against him. But it also means they can't use any evidence it derives from the decryption against Feldman in a later criminal case. 

Last year, we scored a major victory before the Eleventh Circuit Court of Appeals which found the act of decrypting a computer was protected by the Fifth Amendment privilege and reversed a contempt of court finding and released a man from jail who refused to decrypt. We hope the court here will follow the Eleventh Circuit's lead and understand that prohibiting the government from forcing Feldman to decrypt the devices preserves Fifth Amendment protections in our digitized world.

At a time where personal data is increasingly generated and stored electronically and online, encryption is a crucial way to safeguard data from prying eyes. Its fast becoming a routine feature in computer operating systems and an integral aspect of exchanging information on the web. But as we've explained to courts before, demanding this common sense data protection shouldn't come at the expense of our right against self-incrimination. Of course the government should have tools to investigate and prosecute serious crimes. But important constitutional rights can't be discarded in that pursuit.