Massachusetts’ top court ruled, in a 5-2 decision on Wednesday, that a criminal suspect can be ordered to decrypt his seized computer.

Further Reading Fifth Amendment shields child porn suspect from decrypting hard drives

The Massachusetts Supreme Judicial Court (MSJC) ruling only applies to the state. Various other courts at the state and federal level have disagreed as to whether being forced to type in a decryption password is a violation of the Fifth Amendment right to protect against self-incrimination and its state equivalents (such as Article Twelve of the Massachusetts Declaration of Rights). For example, more than two years ago, the 11th Circuit Court of Appeals ruled that a defendant was not obliged to decrypt his hard drive, as doing so would violate his Fifth Amendment rights. However, that ruling only took effect in the 11th Circuit, which covers parts of the southeastern United States. Just last year, a federal judge refused to force a Wisconsin child pornography suspect to decrypt his laptop. Overall, cases involving decryption are still relatively new and rare. The first known one only dates back to 2007

Privacy advocates lamented the MSJC's new ruling, disagreeing with the court’s judgment that an exception to the Fifth Amendment rule, such as a “foregone conclusion,” applies here.

"The defendant is only telling the government what it already knows"

That exception, the MSJC said, can be invoked when “an act of production does not involve testimonial communication where the facts conveyed already are known to the government, such that the individual ‘adds little or nothing to the sum total of the Government's information.’”

The case involves a Massachusetts attorney named Leon Gelfgatt, who was allegedly involved in mortgage fraud. Prosecutors claimed that in 2009, Gelfgatt made over $13 million as a result of faking mortgage documents to sham companies. He was arrested in December 2009, and state troopers executed search warrants on his home and his vehicle, seizing four computers encrypted with “DriveCrypt Plus” software.

On the day of Gelfgatt’s arrest, after being informed of his right to remain silent, he told the authorities that he was able to decrypt his computers but would not do so.

As the MSJC ruled:

During his postarrest interview with State police Trooper Patrick M. Johnson, the defendant stated that he had performed real estate work for Baylor Holdings, which he understood to be a financial services company. He explained that his communications with this company, which purportedly was owned by Russian individuals, were highly encrypted because, according to the defendant, "[that] is how Russians do business." The defendant informed Trooper Johnson that he had more than one computer at his home, that the program for communicating with Baylor Holdings was installed on a laptop, and that "[e]verything is encrypted and no one is going to get to it." The defendant acknowledged that he was able to perform decryption. Further, and most significantly, the defendant said that because of encryption, the police were "not going to get to any of [his] computers," thereby implying that all of them were encrypted. When considering the entirety of the defendant's interview with Trooper Johnson, it is apparent that the defendant was engaged in real estate transactions involving Baylor Holdings, that he used his computers to allegedly communicate with its purported owners, that the information on all of his computers pertaining to these transactions was encrypted, and that he had the ability to decrypt the files and documents. The facts that would be conveyed by the defendant through his act of decryption—his ownership and control of the computers and their contents, knowledge of the fact of encryption, and knowledge of the encryption key—already are known to the government and, thus, are a "foregone conclusion." The Commonwealth's motion to compel decryption does not violate the defendant's rights under the Fifth Amendment because the defendant is only telling the government what it already knows.

A step back for privacy

Because Gelfgatt already admitted to police that he owned and controlled the seized computers and had the ability to decrypt them, the court found that the act of decryption would not reveal anything new to the police. Therefore, the act of compelled decryption was not “testimonial.” Normally, the Fifth Amendment privilege prevents the government from forcing a witness to disclose incriminating information in his mind (like a password not written down anywhere else)—but only if that is information the police do not already know.

Jessie Rossman, an attorney with the American Civil Liberties Union of Massachusetts, told Ars that her organization is “disappointed in the decision.”

“For example, an individual can be forced to hand over a key to a locked safe if the government already knows that’s your safe—the documents in there have already been created,” she said.

“Your opening that safe, the documents are already there. That’s not new testimonial. But encrypted data needs to be transformed into something new when decrypted. A number of encrypted technology works such that when you look at [a hard drive] you can’t even tell what is empty space or what is not empty space. When you decrypt that computer it’s creating something new and if you didn’t have any knowledge, the act of decrypting tells you something you didn’t know beforehand. We believe that the Fifth Amendment and Article 12 needs to protect not only the act of entering a code but the act of producing decrypted files to the government.”

Marcia Hofmann, an attorney in San Francisco with extensive experience in digital law, told Ars that she also did not agree with the court’s ruling.

“The police think they’re going to find mortgage fraud, but they don’t know what they’re going to find, and they don’t know where that supposed evidence is,” Hoffman said. “That is not a foregone conclusion. They don’t seem to have a good sense. This is a fishing expedition.”

Fred Cate, a law professor at Indiana University, told Ars that this ruling could come with an unfortunate consequence. If someone admits to owning a computer and asserts that they possess the password, “it's only likely effect is to encourage future defendants to be less forthcoming with police.”

“This seems to be an issue likely to head to the Supreme Court where, despite today’s sweeping 9-0 victory for privacy involving searches of cellphones, the outcome is not at all certain,” he added. “Historically, the high court has taken a dim view of efforts to expand the Fifth Amendment privilege against self-incrimination or to apply it in novel ways. In the meantime, we should expect to see both federal and state courts continuing to reach divergent results when faced with this important question.”