In Commonwealth v. Davis, No. 56 MAP 2018 (PA Supr. Ct. Nov. 20, 2019), the Pennsylvania Supreme Court, by a 4-3 vote, reversed the Superior Court's and trial court's determinations that compelling defendant to disclose his password (or passwords) to his computer, seized by warrant during an investigation of the appellant for distribution of child pornography and criminal use of a communications facility, would not violate the appellant's protection against self-incrimination because of the "foregone conclusion" exception to the Fifth Amendment. In this month's article, I review Davis and discuss its reasoning and what the foregone conclusion exception, in the age of computer passwords, tells us about both computers and the exception.

In Davis, the lower courts had reasoned that the foregone conclusion exception to the Fifth Amendment privilege against self-incrimination, as articulated by the U.S. Supreme Court in Fisher v. United States, 425 U.S. 391, 409 (1976), applied, because the exception held that "an act of production does not involve testimonial communication if the facts conveyed are already known to the government, such that the individual 'adds little or nothing to the sum total of the government's information,' (quoting Fisher, 425 U.S. at 409), and here, the government already knew that the computer seized in the appellant's residence had been used by the appellant to disseminate child pornography, since: the computer had hard-wired internet access only; an internet address used to disseminate child pornography was tracked to the appellant's residence; the computer at issue was TrueCrypt encrypted; the appellant was the only user; he was the only one who knew the password; and, that, by the appellant's uncontested, fully Mirandized admissions that he and the agents "both knew what was on" the computer and that he would "die in prison before giving up the password," the agents knew that child pornography was on the computer. Notwithstanding the lower courts' reasoning, the Supreme Court majority held that the foregone conclusion exception did not apply to the instant matter because a "password manifests from one's mind," and so, by definition, the "foregone conclusion exception to the Fifth Amendment privilege against self-incrimination does not apply to the compelled disclosure of a computer password." Justice Max Baer, writing on behalf of the three dissenting justices, argued that the facts in the matter, particularly the appellant's admissions to the agents and the evidence gathered and seized by them, made the appellant's production of the password a "foregone conclusion."

The Majority Opinion

At the heart of the court's opinion is the distinction that it found the U.S. Supreme Court "has made, and continues to make," between "physical production" and "testimonial production." Governmental compulsion of a physical act "is not testimonial, and the privilege is not recognized" generally, but when "an act of production … expresses some explicit or implicit statement of fact that certain materials exist, are in the defendant's custody or control, or are authentic," that act "may be testimonial." An act of production is testimonial "when the government compels the defendant to use the 'contents of his own mind' in explicitly or implicitly communicating a fact," quoting from Doe v. United States, 487 U.S. 201 (1988).

The court noted that informing the distinction between "testimonial" and "nontestimonial" acts was the "primary policy undergirding the Fifth Amendment privilege against self-incrimination." That policy was "our country's 'fierce 'unwillingness to subject those suspected of crime to the cruel trilemma of self-accusation, perjury or contempt' that defined the operation of the Star Chamber, wherein suspects were forced to choose between revealing incriminating private thoughts and forsaking their oath by committing perjury'" (sources omitted, but again quoting from Doe II). This being the case, "testimonial" evidence that could be compelled in the face of the Fifth Amendment privilege "must encompass all responses to questions that, if asked of a sworn suspect during a criminal trial, could place the suspect in the 'cruel trilemma' of truth, falsity, or silence." The court further noted that the U.S. Supreme Court set forth the following test for a defendant to invoke the Fifth Amendment privilege against the forced provision of information: "a defendant must show the evidence is self-incriminating; the evidence is compelled; and the evidence is testimonial in nature." Thus, the court reasoned, "the government may not force someone to provide an incriminating communication that is 'testimonial' in nature."

Looking for guidance as to what counts as "testimonial" communications, the court distinguished between requiring a defendant's assistance in obtaining data that had been compiled before it was sought by the government and directing a defendant to compile and recite the data, the former not being a Fifth Amendment violation. Returning to Doe II, the court noted that therein "the U.S. Supreme Court … found 'that compelling the defendant" to sign bank disclosure forms releasing forms compiled prior to their being sought "was more akin to 'being forced to surrender a key to a strongbox containing incriminating documents,'" which would be a physical rather than a mental act, "than it was to 'being compelled to reveal the combination to petitioner's wall safe,''' which would be a mental act, and so did not violate the Fifth Amendment.

The court looked to Fisher v. United States 425 U.S. 391 (1976) as another example of forced data production that did not violate the Fifth Amendment. "Under the facts in Fisher," the court reasoned, the U.S. Supreme Court "found that the government was not relying on the 'truth-telling' of the defendant taxpayers to establish the existence of the documents" being produced, "their access to them, or their authentication of them, as they had been produced by accountants, and not the defendant taxpayers themselves." Thus, the U.S. Supreme Court reasoned, "the act of producing the subpoenaed documents did not involve self-incriminating testimony." The "defendant taxpayers' production of the documents was nontestimonial because the government knew of the existence of the documents, that the defendant taxpayers possessed the documents, and that the government could show their authenticity—not through the use of the defendant taxpayers' minds, but through the testimony of others. Thus, the Fifth Amendment privilege did not apply to the third-party production of documents requested."

The court then looked to United States v. Doe, 465 U.S. 605 (1984) (Doe I), for an example of a government subpoena which did violate the Fifth Amendment. In Doe I, the subpoena "did not seek specific, known files, but broad categories of general business records of a sole proprietorship." The Supreme Court found that, "while the contents of the documents were not privileged, the act of producing the business documents could have testimonial aspects and an incriminating effect," because "the enforcement of the subpoena would compel the defendant to admit that the records existed, that they were in his possession, and that they were authentic, which was sufficient to establish a valid claim of privilege against self-incrimination."

The Supreme Court then set forth a telling analogy to explain its reasoning. The Supreme Court majority noted that it "simply disagreed with the dissent's conclusion that the execution of the consent directive at issue here forced petitioner to express the contents of his mind. In our view, such compulsion is more like 'being forced to surrender a key to a strongbox containing incriminating documents' than it is like 'being compelled to reveal the combination to [petitioner's] wall safe.'" Thus, the Supreme Court emphasized a clear physical-mental distinction in the context of a foregone conclusion analysis.

The court then noted that the Supreme Court relied upon the "key v. combination" distinction in United States v. Hubbell, 530 U.S. 27 (2000). In Hubbell, the defendant, "as part of the 'Whitewater' investigation by independent counsel Kenneth Starr during the presidency of Bill Clinton, had pleaded guilty to charges of mail fraud and tax evasion arising out of his billing practices. When the defendant was in prison, a grand jury issued a subpoena demanding that he produce eleven categories of documents. The defendant invoked his Fifth Amendment privilege, but independent counsel obtained an order from the federal district court directing him to comply with the subpoena and granting him immunity against the government's use and derivative use of the compelled testimony. When the defendant delivered 13,120 pages of the specified documents, a grand jury returned an indictment against him for various wire fraud, mail fraud and tax crimes. The defendant asserted his right against self-incrimination and the district court dismissed this new indictment, but the U.S. Court of Appeals for the District of Columbia reversed. The Supreme Court reversed the court of appeals. The Supreme Court reasoned that, while a person may be forced to produce self-incriminating documents, that would occur only when "the creation of those documents was not 'compelled' within the meaning of the privilege." If, however, as in Hubbell, it was "'unquestionably necessary for' the defendant "to make extensive use of 'the contents of his own mind' in identifying the hundreds of documents responsive to the requests in the subpoena," such usage would have been additional incriminating evidence not covered by the grant of immunity and so could not be compelled under the order. Returning to the "strongbox key" metaphor, the Supreme Court reasoned that "the assembly of" the documents under the order "was like telling an inquisitor the combination to a wall safe, not like being forced to surrender the key to a strongbox." Since, then, selecting the documents subpoenaed in Hubbell would have required the defendant to "express the contents of his mind," complying with the subpoena would have been like producing the wall safe combination in that it would have been "testimonial" in nature, while the production of a strongbox key in the metaphor would not have been not have been.

The court concluded that, based upon the discussed Supreme Court cases "regarding the scope of the Fifth Amendment … compelling the disclosure of a password to a computer, that is, the act of production, is testimonial. Distilled to its essence, the revealing of a computer password is a verbal communication, not merely a physical act that would be nontestimonial in nature. There is no physical manifestation of a password, unlike a handwriting sample, blood draw or a voice exemplar. As a passcode is necessarily memorized, one cannot reveal a passcode without revealing the contents of one's mind. Indeed, a password to a computer is, by its nature, intentionally personalized and so unique as to accomplish its intended purpose―keeping information contained therein confidential and insulated from discovery." The court noted that the commonwealth was "seeking the password, not as an end, but as a pathway to the files being withheld. As such, the compelled production of the computer's password demanded the recall of the contents of the appellant's mind, and the act of production carried with it the implied factual assertions that [would] be used to incriminate him. Thus … compelling the appellant to reveal a password to a computer [would be] testimonial in nature."

The court then rejected the argument that production of the password by the appellant would fall within the "foregone conclusion" exception to the Fifth Amendment. The court noted that, "for the exception to apply, the government must establish its knowledge of: the existence of the evidence demanded; the possession or control of the evidence by the defendant; and the authenticity of the evidence." It went on to characterize the exception as "an extremely limited exception to the Fifth Amendment privilege against self-incrimination," noting that the Supreme Court had spoken to it only "on few occasions over the 40 years since its recognition in Fisher, and its application had been considered only in the compulsion of specific existing business or financial records."

The court acknowledged that it appreciated "the significant and ever-increasing difficulties faced by law enforcement in light of rapidly changing technology, including encryption, to obtain evidence." Such appreciation, however, could not lead to holding that compulsion of a computer password fell within an exception to the Fifth Amendment since, "unlike the documentary requests under the foregone conclusion rationale, or demands for physical evidence such as blood, or handwriting or voice exemplars, information in one's mind to 'unlock the safe' to potentially incriminating information" did not "easily fall" within an exception. The court held that "the compelled recollection of the appellant's password was testimonial in nature, and, consequently, privileged under the Fifth Amendment to the U.S. Constitution" and that, until the Supreme Court held otherwise, the foregone conclusion rationale was "one of limited application" and "inapplicable to compel the disclosure of a defendant's password to assist the commonwealth in gaining access to a computer."

With no U.S. Supreme Court precedent on the matter, the Pennsylvania Supreme Court following its interpretation of federal constitutional law and not looking to the commonwealth's constitution, and the Pennsylvania court holding in the instant matter only a 4-3 majority, it is highly likely that Davis will not be the last word in Pennsylvania jurisprudence on the matter.

One can only hope the court will rethink its reasoning, as the distinction it draws between being forced to surrender a key and being compelled to reveal the combination of a wall safe, the former not infringing upon the subject's Fifth Amendment right against self-incrimination because the government does not compel the defendant to use the contents of his own mind in surrendering the key, while  the latter assuredly does compel such surrender, cannot survive analysis and scrutiny.

Leonard Deutchman is a legal consultant retired from one of the nation's largest eDiscovery providers, KLDiscovery, where he was vice president, Legal. Before joining KLDiscovery, he was a chief assistant district attorney at the Philadelphia District Attorney's Office, where he founded the Cyber Crime Unit and conducted and oversaw hundreds of long-term investigations involving cybercrime, fraud, drug trafficking and other offenses.