The Massachusetts High Court Rules That State Can Compel Password Decryption in Commonwealth v. Jones

According to the Pew Foundation, most Americans lock their cell phones, creating an obstacle for some law enforcement investigations—and especially for state authorities, which have fewer resources than federal law enforcement. In recent years, federal and state courts across the country have grappled with whether ordering a defendant to unlock an electronic device violates the Fifth Amendment privilege against self-incrimination.

Last month, in Commonwealth v. Jones, the Massachusetts Supreme Judicial Court held, for the second time in five years, that the government may compel a defendant to unlock an electronic device under certain circumstances. The court’s decision addressed head-on two crucial constitutional issues facing courts in compelled decryption cases. First, the court determined that the government must “establish that the defendant knows the password to decrypt an electronic device before his or her knowledge of the password can be deemed a foregone conclusion,” and rejected an alternative approach offered by a concurrence. Second, the court established that the government must prove beyond a reasonable doubt that the defendant’s knowledge of the password is a foregone conclusion, making the court only one of two in the nation to have articulated the government’s burden of proof in a compelled decryption case.

This post first explains the foregone conclusion doctrine that underlies compelled decryption jurisprudence. After that, it moves on to discuss the Massachusetts decision, focusing on the court’s application of the foregone conclusion doctrine and its discussion of the burden of proof.

The Fifth Amendment and the Foregone Conclusion Doctrine

The Fifth Amendment guarantees that no person “shall be compelled in any criminal case to be a witness against himself.” Under Supreme Court precedent, “[t]o qualify for the Fifth Amendment privilege, a communication must be testimonial, incriminating, and compelled.”

In general, cases of compelled decryption only raise questions about whether producing a password is testimonial under the Fifth Amendment. To determine whether an act is testimonial, courts look to whether the defendant is forced “to disclose the contents of his own mind.” Relying on that test, Justice John Paul Stevens explained in a 1988 dissent that a defendant may “be forced to surrender a key to a strongbox containing incriminating documents” but could not “be compelled to reveal the combination to his wall safe—by word or deed.”

The authoritative precedent in compelled decryption cases is the Supreme Court’s decision in Fisher v. United States (1976). At issue in Fisher was whether the government could require taxpayers to produce their accountants’ work papers relating to the preparation of contested returns. The court noted that compliance with the government’s request would “tacitly concede[ ] the existence of the papers demanded and their possession or control by the taxpayer” and would “indicate the taxpayer's belief that the papers are those described in the subpoena.”

Nonetheless, the court ruled for the government. The court emphasized that, on the facts presented, the documents sought by the government were of “the kind usually prepared by an accountant” and that the government was “in no way relying on the ‘truthtelling’ of the taxpayer to prove the existence of or access to the documents.” In addition, the court rejected “the possibility that responding to the subpoena would authenticate the workpapers” on the grounds that “production would express nothing more than the taxpayer’s belief that the papers are those described in the subpoena,” which was insufficient to admit the material at trial without additional testimony.

Accordingly, under what has come to be known as the foregone conclusion doctrine, the court concluded that “[t]he existence and location of the papers are a foregone conclusion and the taxpayer adds little or nothing to the sum total of the Government's information by conceding that he in fact has the papers.” In a recent Texas Law Review article, Orin Kerr characterizes the doctrine in the terms of “prosecutorial advantage,” writing: “If the government already knows the fact or belief that is implicitly asserted, and it has some other way to prove it, then it gains no testimonial advantage by obtaining the defendant’s assertions implicit in his compelled acts.”

Since articulating the doctrine, the court has not applied it in any other case. And in a 2000 case, as some have noted, the court “lamented the lack of clarity in the foregone conclusion doctrine,” leaving lower courts without any further guidance.

Factual and Legal Background in Jones

The court explained that, in 2016, police received a tip from a woman whom the defendant, Dennis Jones, had “induced [...] into working as a prostitute.” A subsequent police investigation quickly linked Jones to a particular cell phone manufactured by LG. The woman told authorities that she spoke with Jones while he used that phone. The number associated with the LG phone was listed in the woman’s phone under Jones’s name. An examination of the woman’s phone revealed “several communications between her phone and the LG phone related to prostitution.” And postings on a website advertising the woman as an escort listed the telephone number of the LG phone as the point of contact.

Shortly after opening the investigation, police arrested Jones, who was later indicted on human trafficking-related charges, and found the LG phone in Jones’s pocket. The police obtained a warrant to search the phone, but after discovering that the phone was password-protected, the court explained, the investigators “determined that they did not have the technological capacity to bypass the lock function without the entry of the password and were therefore unable to execute the search warrant.”

The government sought a court order to compel Jones to unlock the LG phone. A judge denied the motion, finding that the government had failed to show that Jones’s knowledge of the password was a foregone conclusion. The next day, the state moved to present additional factual information demonstrating that Jones’s knowledge of the password was, in fact, a foregone conclusion for Fifth Amendment purposes. This information included:

• “the LG phone’s subscriber information that tended to link the defendant to the LG phone”;
• “subsets of the LG phone’s cell site location information records”; and
• “a prior statement the defendant had made to police during his booking in an unrelated criminal matter in which he identified the LG phone as his telephone number.”

While the judge allowed the state to bring in the new evidence, the renewed motion was denied.

The government appealed. After deciding to hear the case, the Massachusetts high court asked the parties to brief three questions, two of which were related to the government’s burden of proof in establishing a foregone conclusion.

Applying the Foregone Conclusion Doctrine

In determining how to apply the foregone conclusion doctrine, the court first looked to its 2014 decision in Commonwealth v. Gelfgatt. In that case, the government sought an order compelling Leon Gelfgatt, a defendant suspected of having committed fraud, to unlock encrypted computers found at his home. In ruling that the order did not violate the Fifth Amendment, the court found:

The facts that would be conveyed by the defendant through his act of decryption—his ownership and control of the computers and their contents, knowledge of the fact of encryption, and knowledge of the encryption key—already are known to the government and, thus, are a “foregone conclusion.”

However, this language did not state explicitly whether the government may demonstrate a foregone conclusion by merely proving the defendant’s knowledge of the password. In a footnote in the Jones ruling, the court acknowledged that the Gelfgatt analysis was not “as clear as [it] might have been” and set out to sharpen up the doctrine.

The court began by asserting that in compelled decryption matters, “the only fact conveyed by compelling a defendant to enter the password to an encrypted electronic device is that the defendant knows the password, and can therefore access the device.” Under that line of reasoning, the court wrote that the government “must therefore establish that a defendant knows the password to decrypt an electronic device before his or her knowledge of the password can be deemed a foregone conclusion.” In another footnote, the court further clarified that Gelfgatt should not be read as establishing that entering a password conveys “the fact of ‘ownership’ of the device or its contents.” Scaling back the Gelfgatt analysis, the court determined: “The fact of knowledge of a password is distinct from the ownership or control of the device and its contents.”

In a strongly worded concurrence, Justice Barbara Lenk (who dissented in Gelfgatt) called the majority’s approach a “death knell for a constitutional protection against compelled self-incrimination in the digital age.” The concurrence would have instead required that “[f]or the foregone conclusion exception to apply, the government also ‘must be able to describe with reasonable particularity’ the documents or evidence it seeks to compel.” Lenk made two arguments supporting that approach. First, she pointed to two federal appellate court decisions (one from the Eleventh Circuit and another from the Third Circuit) that she characterized as acknowledging “that the foregone conclusion doctrine [in the context of compelled decryption] requires a showing, with reasonable particularity, as to the existence and location of incriminating files on a device.” And second, Lenk argued that the Fourth and Fifth Amendments “do not dwell in splendid isolation.” The concurrence seemed to suggest that “reconcil[ing] the Fourth Amendment’s authorization of the government’s taking of evidence with the Fifth Amendment’s limitations on its requiring an individual to produce it” should lead courts to give Fifth Amendment protections “meaningful teeth.”

The majority responded to the concurrence in a lengthy footnote. On the concurrence’s argument about the interaction between the Fourth and Fifth Amendments, the court rejected the notion that the Fourth Amendment was really relevant to the issue at bar since the government had lawfully obtained a warrant. Of the Fourth and Fifth Amendments, the court wrote: “Each has its own purpose, function, and requirements, and they work together to form a double protection of digital privacy before particular files on the phone can be accessed.”

In addition, the majority offered a different interpretation of the federal appellate cases Lenk cited. The majority emphasized that in the Eleventh Circuit case, the government sought to compel the defendant to “produce the unencrypted contents” of a computer and external hard drives, and not their passwords. Regarding the Third Circuit case, the majority emphasized that the appeals court decided the case on a deferential standard of review, explicitly noting that “we are not concluding that the Government’s knowledge of the content of the devices is necessarily the correct focus of the ‘foregone conclusion’ inquiry in the context of a compelled decryption order.”

Despite this disagreement, both the majority and the Lenk concurrence determined that the government had, on their respective standards, sufficiently proven that the foregone conclusion applied to the facts at bar.

Burden of Proof

As the court noted, prior to Jones, only one other court had “meaningfully articulated the standard of proof the government bears to establish that a defendant’s knowledge of the password to decrypt an electronic device is a foregone conclusion under the Fifth Amendment.” In that case, a California federal district court determined that “clear and convincing evidence” was the appropriate standard.

Given the lack of guidance on the government’s burden of proof, the Massachusetts court invited amici to weigh in. The Massachusetts attorney general, a state public defender organization, Professor Orin Kerr and Professor Laurent Sacharoff briefed the court.

In ruling on the government’s burden of proof, the court decided that the state constitution provided greater protection of individual rights than the Fifth Amendment, ultimately landing on the standard of beyond a reasonable doubt—the highest in criminal law. The majority rested its holding on two observations from its precedents. First, the court looked to two of its past criminal cases (one on the voluntariness of a confession and the other on a defendant’s waiver of Miranda rights) in which the court found that “some critical facts implicating a defendant's constitutional rights require proof beyond a reasonable doubt.” Second, the court noted that its precedents had read the text of the state constitution—which protects a defendant from being compelled to “furnish evidence” against himself—to mandate “a broader interpretation of [the right against self incrimination] than that of the Fifth Amendment.”

Moreover, the majority wrote that the beyond-a-reasonable-doubt standard was “necessary to respect the meaning and purpose of the foregone conclusion exception.” Looking back at Fisher, the majority noted that the U.S. Supreme Court’s “discussion suggests that the government must have a high level of certainty that the defendant’s act of production will not reveal any factual information beyond what it already knows for the exception to apply.”

Lastly, the court rejected the state’s proposed lower standard of clear and convincing evidence on more pragmatic grounds. The court reasoned:

Permitting the Commonwealth to prove a defendant’s knowledge of the password to an encrypted electronic device by a standard lower than beyond a reasonable doubt creates a greater risk of incorrectly imputing knowledge to those defendants who truly do not know the password.

***

Applying precedents concerning the production of paper documents to digital evidence is difficult. The recent dialogue between Kerr and Sacharoff, who argue for different approaches on compelled decryption, makes this reality especially clear. This idea is not new: Vivek Mohan and John Villasenor wrote in 2014 that technology “has outgrown the Supreme Court’s Fifth Amendment jurisprudence,” and as two MIT researchers show, the technical boundaries are only getting more complicated. In the meantime, courts are not able to duck the issue. State appellate courts in Missouri and Illinois also decided cell phone encryption cases in March, the Indiana Supreme Court heard oral arguments in another case on April 18, and the Pennsylvania Supreme Court will hold arguments on May 14. According to Kerr, “[T]he U.S. Supreme Court is likely to take on this issue in the next few years.”