SAN FRANCISCO — A decision last week by a federal magistrate judge ordering a criminal defendant to decrypt his devices could mark an important shift in Fifth Amendment law in favor of greater government access to encrypted data.

The ruling by U.S. Magistrate Judge Jacqueline Scott Corley of the Northern District of California is not the first time a defendant has been ordered to decrypt his device under what is known as the “foregone conclusion” exception to the Fifth Amendment. But Corley's legal reasoning, if upheld, would make it significantly easier for law enforcement to get similar orders in the future, according to legal experts.

It's also the first time that a court within the U.S. Court of Appeals for the Ninth Circuit has dealt with the issue. If her order is appealed, that may set in motion a fight that could eventually percolate up to the U.S. Supreme Court. The judge adopted a significantly different approach to the “foregone conclusion” question than the one endorsed by the U.S. Court of Appeals for the Eleventh Circuit in a ruling back in 2012.

Though the issue is nuanced, it has big ramifications for law enforcement and civil liberties interests. Those who worry that encryption could stymie investigations into child pornography crimes or other illegal activity say Corley's approach is the correct one. Civil liberties advocates. meanwhile, warn it could erode the right against self-incrimination.

“I think this is a really, really important question for how we deal with encrypted devices in a world in which everything is becoming encrypted,” said Orin Kerr, a professor at the University of Southern California's Gould School of Law, who has written articles in favor of the approach followed by Corley.

The defendant in the case, a California man named Ryan Michael Spencer, has been charged with possession and distribution of child pornography. According to Corley's decision, there isn't any question whether he is the owner of the devices; her ruling said he cooperated in unlocking his iPhone and laptop. But investigators were unable to access encrypted folders on those devices, as well as an encrypted external hard drive.

The question Corley confronted is whether by handing over his passwords the defendant would be providing prosecutors with information they didn't already have, or whether the information is a “foregone conclusion.” Under prior case law, information that is a foregone conclusion may be excepted from the general Fifth Amendment privilege.

Corley ruled that, for the purposes of this inquiry, the relevant information is not what is on the devices, but instead the fact that the defendant knows the password. Because law enforcement officials had already demonstrated through other evidence that Spencer knew the passwords to unlock the devices, his knowledge of the password was already a foregone conclusion. As a result, Corley decided, the defendant can be ordered to unlock his devices without violating his Fifth Amendment rights.

Murky Law

The foregone conclusion doctrine has something of a murky past. In its 2012 decision, the Eleventh Circuit ruled that in order for the doctrine to apply, prosecutors had to show with “reasonable particularity” that they already knew what was on the encrypted hard drives seized during a child pornography investigation. They could not, and so the court reversed a decision by a district judge compelling decryption.

Then, in 2014, the Massachusetts Supreme Court took a different approach, focusing on whether prosecutors already knew whether a defendant in an alleged financial fraud scheme knew the encryption keys to computers it seized. (The defendant told police that “[e]verything is encrypted and no one is going to get to it,” while admitting that he knew the passwords.)

A Florida state appeals court in late 2016 also embraced the password-focused approach in a voyeurism case involving a locked iPhone. In compelling the defendant to unlock the device, it noted that prosecutors were only asking him for the passcode to the phone—which it had a warrant to search—not the photos or videos on it that could be evidence against him.

More recently, in March 2017, the U.S. Court of Appeals for the Third Circuit also compelled the defendant to comply with a request to decrypt his computer, in a decision that seemed to apply both standards. It upheld an order to decrypt based on showings that prosecutors already knew there was child pornography on a defendant's computer. At the same time, in a footnote, the panel said that “a very sound argument can be made” that the foregone conclusion doctrine properly focuses on whether a defendant knows the password.

Corley, in her order, took that footnote from the Third Circuit and ran with it. “[T]he court holds that if the respondent's knowledge of the relevant encryption passwords is a foregone conclusion, then the court may compel decryption under the foregone conclusion doctrine,” she wrote.

High Stakes

Dan Terzian, a lawyer at Duane Morris who has written extensively about the compelled decryption issue, said that's a meaningful shift. With that as the standard, then “99 percent of the time, perhaps 99.9 percent of the time, [the government] is going to be able to get an order to decrypt,” Terzian said in an interview. That's because most of the time in these cases, the government can provide evidence that the accused knows the password. It might be as simple as saying that a phone was in the defendant's pocket, Terzian said.

Mark Rumold, a staff attorney at the Electronic Frontier Foundation— which argued against compelled decryption in the Third Circuit case—said that's a dangerous development for civil liberties and Fifth Amendment precedent.

Rumold agreed that the approach adopted by Corley would make it easier for law enforcement to get access to encrypted data in the future, and said he disagrees with it. But he also argues that the foregone conclusion exception should not apply at all when it comes to encrypted devices. That's because forcing someone to produce a password fundamentally conflicts with the Fifth Amendment, he said.

“The government's getting away with a little sleight of hand here,” he said. “The essential nature of the self-incrimination privilege is that you cannot compel evidence from the minds of the suspects themselves.”

Kerr argued that any civil liberties over compelled decryption concerns should be mitigated by the fact that the government already has a warrant to search the device in these types of cases. But without the encryption key, they can't effectuate it, he noted.

Comparing Corley's recent decision to the Eleventh Circuit approach, Kerr said: “One is a workable standard for law enforcement, one is not … so the stakes are quite high.”

It's not yet clear whether the case will make it up to the U.S. Court of Appeals for the Ninth Circuit. Spencer's attorney, Sacramento-based Christopher Parkhurst, has until April 3 to tell the court whether he plans to appeal Corley's ruling. Parkhurst did not respond to an email seeking comment.

U.S. District Judge Charles Breyer of the Northern District of California is presiding over the criminal case.