Can the state compel a person to provide the password for a locked device? A recent opinion of the Fourth District Court of Appeal in Florida indicates that the law in the United States and Canada could be moving in the same direction – but for different reasons.

On October 24, 2018, the Florida appellate court released the split majority decision in G.A.Q.L. v State of Florida, No. 4D18-1811, involving two passcodes that blocked the state from gaining access to a cell phone and an iTunes account alleged to belong to a minor charged in an impaired driving case. “Revealing one’s password,” wrote Judge Spencer Levine at p 4, “requires more than just a physical act; instead, it probes into the contents of an individual’s mind and therefore implicates the Fifth Amendment.”

The Fifth Amendment analysis often triggers consideration of the doctrine of foregone conclusion. Where the location, existence and authenticity of evidence is known with reasonable particularity, the contents of an individual’s mind are not used against him and the Fifth Amendment is not implicated. However, writing for himself and Judge Cory Ciklin, Judge Levine concluded that production of a password is testimonial, at pp 5-6: “[T]he state seeks the phone passcode not because it wants the passcode itself, but because it wants to know what communications lie beyond the passcode wall. If the minor were to reveal this passcode, he would be engaging in a testimonial act utilizing the ‘contents of his mind’ and demonstrating as a factual matter that he knows how to access the phone. As such, the compelled production of the phone passcode or the iTunes password here would be testimonial and covered by the Fifth Amendment.”

The state’s argument focused on the password as the target of the foregone conclusion exception rather than the data shielded by it. And, it appears, for a good tactical reason. The state’s subpoena failed to identify specific file locations on the cell phone likely to contain evidence of the alleged offence – impaired driving. Judge Levine therefore held, at p 7, that the state’s argument missed the mark: “[I]t is not enough to know that a passcode wall exists, but rather, the state must demonstrate with reasonable particularity that what it is looking for is in fact located behind that wall. Without reasonable particularity as to the documents sought behind the passcode wall, the facts of this case ‘plainly fall outside’ of the foregone conclusion exception and amount to a mere fishing expedition.”

In a concurring opinion, Judge Jeffrey Kuntz emphasized, at p 10, that the foregone conclusion exception has not been applied to oral testimony. The basis for reversal was therefore “not that the State failed to satisfy the requirements of the foregone conclusion exception” but rather that “the foregone conclusion exception is inapplicable to the compelled oral testimony sought in this case.” [See also: Tim Cushing. Florida Appeals Court Says Producing Passwords Is Testimonial And Protected By The Fifth Amendment. TechDirt. October 30, 2018]

The only reported Canadian case reached the same result. On June 3, 2016, Eric Talbot was arrested and charged with the murder of Francesco Molinaro at Wasaga Beach, Ontario. The police obtained a warrant to search Talbot’s cell phone. But it was locked using a swipe pattern and the use of a chip-off process risked causing the loss of data. The Crown brought an application for an assistance order under s 487.02 of the Criminal Code compelling Talbot to assist the police by providing the passcode. It was a novel application. Assistance orders are most often used to compel third parties, such as cell phone service providers, to assist the police in the implementation of wiretap authorizations.

It is somewhat unclear exactly what the Crown was seeking. It was either the “swipe pattern” or “screen lock passcodes or PIN codes” or both. I will assume that the term “swipe pattern” embraced passcode or PIN code because that is how it was used in argument. The Crown asserted that the court had authorized state interference with Talbot’s privacy interests by issuing the search warrant and there was no informational content “in the swipe pattern that unlocks the cell phone”. Any further interference could be remedied by imposing terms and conditions. Talbot argued that the issuance of an assistance order would compel him “to be used as an instrument of the state” to obtain evidence in order to bolster the case against him contrary to the right against self-incrimination and the presumption of innocence in ss 7 and 11(d) of the Charter of Rights.

The terms and conditions suggested by the Crown included: (a) the use of force by the police for the purpose of enforcing the order under s 25 of the Code; (b) providing the passcode personally or through counsel either orally, in writing or by demonstration of the swipe pattern; (c) use immunity regarding the fact Talbot provided the passcode and for the passcode itself except in the case where he was non-compliant; and, (d) that Talbot be advised he could be charged with disobeying a court order or obstruction of a peace officer if he did not comply.

In a ruling reported as R v Talbot, 2017 ONCJ 814 Justice Cecile Applegate dismissed the application concluding, at para 39, that issuing the order would not be in the best interests of the administration of justice. Justice Applegate began the analysis with the most important organizing principle in Canadian criminal law – the overarching right against self-incrimination under s 7 of the Charter – and went on to hold, at para 38, that Talbot was “being forced to assist in his own prosecution” by “being compelled to communicate information against his will in order to provide a gateway or access to stored evidence”. Thus, a “real and imminent deprivation of his life, liberty and security of the person” existed contrary to s 7. [See: R v R.J.S., [1995] 1 SCR 451 per Lamer CJ, at para 3]

The courts in both G.A.Q.L. and Talbot rejected the reasoning in State v Stahl, 206 So 3d 124, 134 (Fla 2d DCA 2016) where the Second District Court of Appeal in Florida concluded that making the defendant reveal his passcode was not testimonial as the passcode was “sought only for its content and the content has no other value or significance” making communication of the passcode non-testimonial. In G.A.Q.L., Judge Levine followed In re Grand Jury Subpoena Duces Tecum, 670 F.3d 1335 (11th Cir 2012) that I previously discussed in a post to On The Wire titled Fingerprints or Passwords dated January 28, 2017.

The opinion in In re Grand Jury Subpoena is rooted in Doe v United States, 487 US 201 (1988) where Justice John Paul Stevens used this analogy in his dissenting opinion, at p 219: “[A defendant] may in some cases be forced to surrender a key to a strongbox containing incriminating documents, but I do not believe he can be compelled to reveal the combination to his wall safe – by word or deed.” In In re Grand Jury Subpoena, the court likened forced decryption to production of a combination because it is “accompanied by implied factual statements” and utilized the contents of the mind with the final objective of obtaining the files protected by the encryption and not obtaining the decryption for its own sake.

In Talbot, Justice Applegate rejected Stahl, at para 38, because the question is broader than whether a password is of minimal content and of “no other value or significance” and extends to compelling participation of the defendant in the prosecution against himself. “The nature of the compelled participation,” she wrote, “is particularly intrusive when one considers that the accused is being forced to actively participate by communicating information to the police that solely exists in his head as opposed to compelling a person to passively provide some physical characteristics as part of an investigation (i.e., DNA samples, fingerprints, breath samples, etc.).”

The American jurisprudence, then, draws a distinction between the physical act of being compelled to provide a fingerprint and the mental act of providing a decryption code or password. There is an emerging judicial resistance to ordering the latter because it engages the mind and runs against the grain of the Fifth Amendment. In Canada, the law is uncontroversial although Talbot is a trial court ruling. The swipe pattern in Talbot was protected by s 7 because the pattern of the swipe, the decryption code, engaged the mind. It was not the swipe, so much, that the Crown was after but the pattern of it. [See also e.g., Commonwealth of Virginia v Baust, 89 Va Cir 267 (2014); and, State of Minnesota v Diamond, 890 NW 2d 143 (2017)]

The question, however, whether the state can compel a person to provide the password for a locked device is a long way from being authoritatively settled as the Supreme Court of the United States and the Supreme Court of Canada have yet to wrestle with it.