Ride the Lightning

COURT DECLINES TO FORCE SURRENDER OF PGP PASSPHRASE

December 17, 2007

In computer forensics, encryption is usually a killer. You groan when you encounter it. Or sometimes not . . . in a couple of notable cases, we’ve found wonderful documents like “passwords.txt” and (better yet) “stuffnottoforget.doc” which had the decryption keys in them because the doggone things are so long and hard to remember. Sometimes, manna does rain from the heavens.

But what if you’re not lucky enough to have one of those files? Can a court force a defendant to give up his passphrase? A Vermont court declined to do so on November 29th, finding that compelling a defendant to surrender his passphrase would violate his Constitutional right not to incriminate himself. The case involved child pornography, which always inflames the situation, but the essential truth is that case law involving the compulsory surrender of encryption passphrases is quite unsettled, with even the commentators coming down on both sides of the issue. If this case eventually goes up on appeal, it has the potential of being a landmark decision.

The opinion in the case may be found at http://www.volokh.com/files/Boucher.pdf – and thanks to eagle-eyed colleague Jesse Lindmar for sniffing this one out.

E-mail:      Phone: 703-359-0700