Court Case Tests Right To Withhold Passwords

Does the constitutional right against self-incrimination give a criminal defendant the right to withhold computer passwords that law enforcement could used to decrypt a hard drive and obtain evidence against that defendant? That question is at the root of a Colorado court case centering on multiple mortgage fraud schemes, and a defendant's encrypted laptop.

In particular, an indictment returned by a Denver grand jury on Oct. 1, 2010, charged Ramona Fricosu (aka Ramona Smith), 36, of Peyton, Colo., among other defendants, with multiple counts of bank fraud, wire fraud, money laundering, and making false statements to a financial institution.

As part of that investigation, law enforcement agents obtained a search warrant for Fricosu's house, which she shares with her mother, two children, and formerly shared with Scott Whatcott (aka Michael Scott Smith), 36, also a defendant in the case. As part of that search, investigators seized multiple computers and storage devices, including a Toshiba Satellite M305 laptop.

After obtaining another search warrant to search the laptop, investigators found that the contents had been encrypted. Accordingly, prosecutors demanded that Fricosu enter her password into the laptop, enabling them to decrypt the drive, or else provide them with a complete copy of the decrypted data.

But her attorney, Philip L. Dubois, has argued that doing so would violate her Fifth Amendment rights against self-incrimination. Dubois himself is no stranger to encryption, having previously defended Philip Zimmermann, who created Pretty Good Privacy (PGP) encryption software in 1991. Shortly after its introduction, the software became available abroad, which led to a Customs Service investigation in which Zimmermann was accused of breaking the Arms Export Control Act, for exporting strong cryptographic software, which was then classified as munitions. The investigation ended after three years; no charges were filed.

Backing Dubois's position is the Electronic Freedom Foundation (EFF), which filed an amicus brief on Friday, arguing that compelling Fricosu to divulge her password would violate her Fifth Amendment rights. "Decrypting the data on the laptop can be, in and of itself, a testimonial act--revealing control over a computer and the files on it," said Electronic Freedom Foundation (EFF) senior staff attorney Marcia Hofmann, in a statement. "Ordering the defendant to enter an encryption password puts her in the situation the Fifth Amendment was designed to prevent: having to choose between incriminating herself, lying under oath, or risking contempt of court."

According to the EFF, "the government has offered Fricosu some limited immunity in this case, but has not given adequate guarantees that it won't use the information on the computer against her." Notably, anything that prosecutors found on the computer--related to the case or not--could be used against her.

Authorities have accused Fricosu and Whatcott of defrauding multiple financial institutions and commercial lenders, including Wells Fargo Home Mortgage, USAA Federal Savings Bank, and Sun Trust Mortgage. "During the scheme to defraud, Whatcott and Fricosu located sellers in the Colorado Springs area who sought to sell their homes due to imminent foreclosure or the sellers' relocation away from Colorado," according to a statement released by the U.S. Attorney's Office for the District of Colorado. "Whatcott would tell each owner that he wished to buy the home and that he would obtain a new mortgage or assume the existing mortgage."

According to the indictment, after convincing homeowners to transfer their properties to Whatcott, he and Fricosu took over the mortgage payments, while also fraudulently obtaining the title to these homes. "Once the title was obtained, they would sell the property, receiving the sales proceeds without paying the outstanding mortgage," alleged prosecutors.

Prosecutors have argued that Fricosu should be compelled to decrypt the seized laptop hard drive, because taped conversations between her and Whatcott include references to a laptop. But according to the EFF, prosecutors haven't identified the seized laptop as the one referred to in those taped conversations, and furthermore prosecutors don't know what's on the laptop.

"The government cannot identify the evidence it hopes to find with any specificity," according to the EFF's brief. "New technologies present new challenges for law enforcement, but this reality does not justify the abandonment of well-established constitutional protections that secure individuals' rights."

The next hearing in the case is scheduled for July 22.

In the new, all-digital Dark Reading supplement: What industry can teach government about IT innovation and efficiency. Also in this issue: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)