Spring til indhold
Hub Nexus

LentisSide 304 af 351

Lentis, Law Enforcement Access to Encrypted Data

Though once considered a munition1], [encrypted communications have become commonplace in commercially available software. Apple’s iMessage system, for instance, is end-to-end encrypted, meaning that no-one (not even Apple) can read a message except the sender and the recipient2]. Apple now also encrypts all data on its [iOS devices,3] and [Google does the same on its Android operating system.4] These systems prevent anyone besides the device owner from accessing the data on the device. Law enforcement agencies have had problems with this technology, however, because it also prevents them from viewing the data on phones, even when they have a search warrant. In one case, Apple refused to open a locked [iPhone for the FBI in a drug investigation,5] stating that doing so was impossible. Law enforcement agencies have argued that tech companies should provide them with a [“backdoor,” a special way to decrypt messages that can only be used by law enforcement and which would require a search warrant.[6] In this chapter, we examine the sociotechnical forces surrounding this proposal in the United States and its allies.

Background

Although relevant today, law enforcement's access to encrypted communications is not a new issue in the United States. As personal digital communication grew more common in the early 1990s, the Clinton Administration began to push for a way to "preserve a government capability to conduct electronic surveillance in furtherance of legitimate law enforcement and national security interests."[7] There have been several subsequent proposals for policies directly addressing the issue, though a variety of technical and social issues have prevented any such policy from taking effect.

Clipper Chip

Clipper Chip that could be included in the hardware of any personal computer or communication device

Clipper Chip that could be included in the hardware of any personal computer or communication device (Image: Travis Goodspeed, CC BY 2.0)

The Clinton Administration's first proposal was the Clipper Chip, a hardware device designed by the United States government that manufacturers would build into their computers. This used a system called "key escrow" where each chip would be given a corresponding key that could decrypt any message encrypted by the chip. The key would be held by the United States government and released to law enforcement when legally required.[8] A variety of social and technical problems, such as the high monetary and economic costs of implementation[9] and weaknesses in the encryption algorithm[8] meant that the Clipper Chip was never adopted.

Key Recovery

Following the Clipper Chip's failure, the Clinton Administration proposed a system it called "key recovery." In this system, trusted third party organizations would hold users' keys and provide them to law enforcement upon request.[9] At the time of this proposal encryption technology was still classified as a munition, making it illegal to export from the United States. With the backing of the CIA, the Clinton Administration proposed weakening these restrictions as long as companies agreed to develop key recovery technology.[9] By doing this, the Administration hoped to make key recovery the standard domestically and globally, giving law enforcement and intelligence agencies access to encrypted data worldwide.

Organized groups within the Clinton Administration had opposing views on this issue. Though the Administration, with the internal backing of the CIA, publicly supported this key recovery plan, the Justice Department internally opposed it, believing that the plan did not go far enough and proposing that the law be modified to only allow the export and import of encryption technology that worked with key recovery systems.[9]

Outside of government, many prominent groups opposed the plan for largely the same reasons that they had opposed the Clipper Chip. Trade groups such as the Institute of Electrical and Electronics Engineers (IEEE) and Association for Computing Machinery (ACM) opposed the plan on economic, technical, and moral grounds. They believed that these restrictions would put American companies at an economic disadvantage while ultimately proving insecure and threatening civil freedoms.[10] Ultimately legislation implementing the proposal never passed the Senate.[11]

EARN IT Act

Following earlier proposals, more recent legislative efforts have taken indirect approaches to the issue of encrypted data. One example is the EARN IT Act[12], first introduced in 2020. Rather than requiring companies to provide direct access to encrypted communications, the proposal focuses on limiting liability protections under Section 230 of the Communications Decency Act for platforms that do not follow certain guidelines related to preventing illegal content. Supporters argue that this approach would help law enforcement investigate serious crimes, while critics contend that it could pressure companies to monitor user communications or reduce the use of end-to-end encryption. Although the proposal has not been fully enacted, it represents a shift toward indirect methods of influencing how companies design and manage encrypted systems.

Recent Developments in Encryption Technology

Since the early proposals such as the Clipper Chip and Key Recovery, encryption technology has changed significantly. Many major communication platforms such as WhatsApp, Signal, and iMessage began adopting end-to-end encryption by default, allowing only the sender and recipient to read messages. This shift made encrypted communication widely respected as the industry standard rather than a new technology. The Signal Protocol is especially notable due to its use of the double ratchet algorithm and asynchronous messaging support, which helped contribute to the widespread trust of end to end encryption algorithms[13]. Many companies have also adopted “zero-knowledge” systems, where the service provider cannot access user data at all. Companies such as Proton AG design their systems so that they do not hold the keys needed to decrypt user information which results in the impossibility with complying with law enforcement.

At the same time, smartphone manufacturers improved device security. Companies such as Apple and Google introduced full-device encryption and secure hardware features that protect data stored on phones. These systems make it difficult to access data even when a device is physically obtained.

Another development is the growth of cloud storage and backups. User data is often stored on remote servers, which may be subject to different forms of access by law enforcement depending on how the data is encrypted. Apple’s advanced data protection launched in December of 2022 extended encryption to iCloud and furthered companies’ initiative to extend security to protect side channels previously used by law enforcement to access data[14].

The widespread use of encryption was even adopted by government agencies as detailed by the NDAA (National District Attorneys Association) in their 2018 Cybersecurity Standards. This proposal was created in the aim of strengthening technical security though restricting use of international products and funding a board to strengthen IT infrastructure.

In response to these changes, law enforcement agencies have developed new methods for obtaining data. Rather than attempting to weaken encryption systems directly, agencies such as the FBI have used techniques such as device hacking and forensic analysis. These methods often target the device itself, where data may be available in unencrypted form.

Current Status

Though there have been many proposals for extending law enforcement's access to encrypted data in the United States, no proposals on the scale of the Clipper Chip or key recovery have come into effect. Companies and individuals can generally develop and use cryptography systems freely.

Encrypted communication has become more widespread in recent years. Many commonly used applications now use end-to-end encryption by default, which limits access to message content. This has increased the difficulty for law enforcement agencies attempting to obtain certain types of digital evidence.

Recent criminal investigations where the United States Justice Department was unable to retrieve encrypted information from phones, along with concerns over terrorist attacks, have led policymakers to renew calls for expanding law enforcement's access to encrypted data, bringing the issue back into the public eye.

At the same time, law enforcement practices have changed. Agencies such as the Federal Bureau of Investigation have made use of alternative methods to access data, including digital forensic tools and device-based investigations. In some cases, agencies obtain data from devices directly or from associated cloud accounts rather than attempting to decrypt communications.

There has also been increased use of tools developed by private companies, such as Cellebrite, which assist in extracting data from locked devices. These developments show that, while encryption presents challenges, law enforcement agencies continue to adapt their methods.

Despite ongoing debate, there is still no clear consensus on how to balance privacy and law enforcement access. As encryption technology continues to develop, this issue is likely to remain an area of discussion in the future.

Support for Expanded Law Enforcement Access

In the United States and abroad, many organized groups want to give government agencies expanded power to read encrypted data in order to prevent and prosecute criminal activity. Government and law enforcement organizations are the most prominent of these groups.

The Obama Administration

In the aftermath of the terrorist attacks in Paris and San Bernardino, President Obama gave a national address about responding to future threats.15] One step in the plan is to prevent criminal activity on encrypted channels.[16] However, it is unclear by what means the administration intends this to be accomplished. Earlier in the year, the Obama administration conceded its fight to make tech companies add a [backdoor to encryption, agreeing that doing so would weaken defenses against foreign governments and cybercriminals.[17] One of the Administration’s fears is that requiring a backdoor for companies in the United States would set a similar precedent for American companies in other countries, such as China.[17]

Federal Bureau of Investigation

The Federal Bureau of Investigation (FBI) has recently fought with Apple over encryption in iMessage.18] In the newest versions of iOS, iMessage uses [end-to-end encryption so that only the sender and recipient can read messages19], making it impossible for law enforcement to access encrypted content. FBI Director [James Comey compared this to an unlockable door and said that a warrant should be all that is required to access this data20]. Comey noted how a terrorist who attempted to attack an event in Texas in May 2015 had been communicating with other terrorists abroad using encrypted messages[21], implying that these messages would have given authorities advance notice of the attempt had they been intercepted and read. The United States has no [key disclosure law, unlike Canada, the UK, and France, effectively keeping these encrypted messages a secret. While key disclosure allows agencies to access encrypted data, it only helps when the suspect is known. It is useful for gathering evidence, but not for intelligence, when fast response times are necessary, especially in preventing terrorist attacks.

United Kingdom's Cameron Administration

Similar battles are happening outside the United States. In the United Kingdom, Prime Minister David Cameron has spoken out against apps that send encrypted messages because most of them cannot be read by government.[22] Cameron argued that, in the past, government agents could get a warrant and intercept phone calls or mail, but now there are channels that government cannot access, creating a “safe space” for criminals and terrorists.[22] Cameron would like legislation that bans apps that use encryption unless the app has a government backdoor.[22]

National District Attorneys Association

The National District Attorneys Association (NDAA) has been a vocal opponent of "warrant-proof" encryption.[23] The NDAA argues that while consumer data protection policies are needed to keep Americans safe, they often come at the expense of making law enforcement more difficult to conduct. They specifically argue that tools used by law enforcement officers in critical early stages of investigations are hampered by encrypted devices and that there is no clear alternative to these tools[23]. Rather than focus on large mass casualty crimes as the FBI did, the NDAA chooses to highlight the difficulties in investigating crime that impacts most Americans' local communities such as carjacking and drug offenses. The NDAA appeals to readers' desire for safety and security by suggesting that anyone can be a victim of such crimes, and in doing so, serves as an appeal to lawmakers who are tasked with keeping their constituents happy and safe.

Opposition to Expanded Law Enforcement Access

Not everyone is in favor of expanding the government's access to private encrypted data. According to a 2014 poll, a majority of Americans (54%) “disapprove” of bulk government collection of phone and internet records,24] and presidential candidates as diverse as [Bernie Sanders25] and [Rand Paul26] have spoken in favor of reining in the [National Security Agency’s data collection programs during the 2016 election cycle. Most opposition comes from participants with concerns over privacy or technical issues, though other factors such as economic issues are also relevant.

Participants with Privacy Concerns

Many opponents of government access to data do so on privacy grounds. For instance, Apple CEO Tim Cook, speaking about his company’s end-to-end encrypted iMessage service, said “we believe the contents of your text messages and your video chats is none of our business.”27] Groups like the [Electronic Frontier Foundation[28] advocate for reducing government access to data on privacy grounds and enjoy reasonable support, including a budget in the tens of millions of dollars.[29]

Privacy concerns are not a new topic in the social sciences, but researchers have struggled even to define "privacy."[30] Despite the difficulty in defining it, researchers have found that people place significant value on keeping their data private,[31] and concern over privacy is likely at least partially motivated by economic factors; companies like Apple even expressly use their protection of consumer privacy as a selling point.[19]

Many tech companies have also used privacy concerns over access to encrypted data as marketing tools. Apple for example, has consistently promoted its products by highlighting a strong commitment to user privacy. It has repeatedly refused to create backdoors for the FBI and other law enforcement agencies, arguing that such access would weaken security for all users rather than serve as a limited investigative tool[32]. After public disapproval over proposed tools to automatically detect certain harmful content, Apple has expanded its encryption efforts beyond messaging to include services such as iCloud photos, device backups, and file storage[33]. Expanding on their efforts to protect encrypted user data, Apple has implemented zero knowledge encryption with Advanced Data Protection[34]. The technology ensures that even Apple is not aware of the encrypted data stored on its products, and removes their ability to comply with any requests for encrypted data, including lawful requests from law enforcement.

The American Civil Liberties Union (ACLU) has consistently opposed any legislation that grants law enforcement access to encrypted data. The advocacy seeks to defend various individual rights and liberties and cites encryption is an essential tool protecting Americans' right to privacy. While many groups have highlighted the dangers warrant proof encryption poses to victims of crimes, the ACLU highlights the danger posed by any governmental access to such data. Such victims include whistleblowers, journalists, and activists. The ACLU has taken a clear stance against Apple's proposed system for automatically detecting child sexual abuse content on users' devices, arguing that even well-intended measures can introduce mechanisms that may be exploited or expanded over time. Their argument emphasizes that permitting law enforcement access may only be the first step toward a more restrictive state, warning of the long-term dangers to civil rights if such access is granted beyond its original intent[35].

Participants with Technical Concerns

Many participants oppose weakening encryption on technical grounds. The basic argument is that abackdoor for law enforcement means that the encryption cannot be perfectly secure, because an attacker could use the backdoor to gain entry. As theInformation Technology Industry Council said in a statement following calls to add backdoors after the Paris attacks in November 2015, weakening encryption by adding backdoors “simply doesn’t make sense.”36] This is the same argument that security experts used when the[Clipper Chip was proposed, and which ultimately helped defeat it.[37]

Opponents also contend that adding backdoors to encryption systems will not actually help law enforcement defeat threats. Nate Cardozo, staff attorney for the Electronic Frontier Foundation, has said that "intel agencies are drowning in data... It's not about having enough data; it's a matter of not knowing what to do with the data they already have."38] Reports that the 2015 Paris attacks (which have been cited in proposals for backdoors, including by[CIA directorJohn Brennan)[39] were planned using unencrypted communications only make this claim stronger.[40]

In legal settings, social values come under pressure when groups hold competing interests. Several court cases have influenced how society interprets key social values, adding legal, political, and social complexity to the question of how much access law enforcement should have to encrypted data - and when that access becomes too much.

United States Constitution: The Foundation of Our Rights

Almost every case in this chapter cites, interprets, or challenges two constitutional amendments. Before analyzing those interpretations, it is important to clearly establish what the referenced amendments say about our constitutional rights:

4th Amendment

The 4th Amendment of the United States Constitution states:

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."[41]

In many encryption-related cases, defendants argued that warrantless device and data seizures violated this amendment. Courts often agreed, reinforcing the need for warrants before accessing encrypted devices and data. Over the past 50 years, the amendment's interpretation has remained consistent, protecting individuals and groups' dignity, privacy, and autonomy.

5th Amendment

The 5th Amendment of the United States Constitution states:

"No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation."[42]

The 5th Amendment protects individuals from being compelled to provide testimonial evidence against themselves (self-incrimination). It is also well known for the proper due process clause, which outline how searches, seizures, and arrests must be conducted. Courts examined whether entering a passcode or decrypting data communicated knowledge, such as ownership, control, or the existence of specific files. When decryption would reveal new information, the 5th Amendment applies. When the government can already describe the evidence with reasonable particularity, court have sometimes allowed compelled access. These cases shape how society negotiates differing social interests, ideas, and values, forcing courts and communities to decide which principles - privacy, autonomy, security, or public trust - should carry the most weight when digital information becomes part of criminal investigation.

Cases on Personal Privacy vs. Public Safety

The following court cases Smith v. Maryland, U.S. v. Cotterman, Riley v. California, and Carpenter v. U.S. highlight the evolving legal battle over how far the government may go in accessing digital information in the name of public safety and justice. Together they illustrate how constitutional protections written in the 18th century are reinterpreted to address current technologies, from cell phone applications to location tracking. They also go beyond legal bounds and address competing social values, where law enforcement's interest in preventing harm and investigating crime sometimes conflicts society's growing expectation of personal privacy extending to a digital space. As each case redefines the balance between these values, it also influences how U.S. citizens understand their legal rights and the conditions under which those rights can be limited or lost.

Smith v. Maryland (1979)

In Smith v. Maryland, Michael Lee Smith was arrested and indicted for robbing Patricia McDonough. To confirm Smith's identity after cross-referencing against the victim's description, the police asked the telephone company to install a pen register. However, they did so without a warrant or court order, since they believed Smith was the source of threatening calls made to McDonough. Once the pen register confirmed outgoing numbers, police obtained a warrant to search Smith's residence, where they seized the phonebook and identified Smith to be the robber. At trial, Smith sought to suppress the evidence collected by the pen register since the police did not obtain a warrant to seize his telecommunication information "prior to its installation," which he claimed violated his 4th Amendment protection against unreasonable searches and seizures. On June 20, 1979, the court ruled in favor of Maryland, holding that Smith had no "legitimate expectation of privacy" in the numbers he dialed because he voluntarily conveyed that information to the phone company, which they recorded as a part of their regular business practices. [43]

U.S. v. Cotterman (2013)

U.S. v. Cotterman began when Howard Cotterman returned from Mexico and was flagged by the Treasury Enforcement Communications System (TECS) database due to prior sexual offenses. At Lukeville, Arizona port of entry, border patrol officers conducted two searches (the second after the TECS notification), finding two laptops and 3 cameras, which Immigration and Customs Enforcement (ICE) later came and seized.44] After conducting an off-site digital forensic search, the government found hundreds of files containing child pornography on Cotterman's devices, and they indicted him for possession of such digital content. Cotterman motioned to suppress the evidence gained from the devices, claiming the forensic search violated the 4th Amendment. The United States argued that there are exceptions to the 4th Amendment regarding border searches. After being granted then reversed, the case was reheard [en banc. The Ninth Circuit en banc finally held that the United States violated Cotterman's 4th Amendment rights, saying that forensic, comprehensive searches of digital devices at the border require reasonable suspicion, recognizing the heightened privacy interests in electronic data.

Riley v. California (2014)

In Riley v. California, David Riley was stopped for a traffic violation, arrested on weapons charges, and had his cell phone seized and searched without a warrant, linking Riley to gang affiliation and involvement in a prior shooting. Riley moved to suppress the phone evidence, but the lower court denied his motion. A similar case, U.S. v. Wurie (2014), involved a similar warrantless search of a flip phone that linked Wurie to a drug stash in his apartment.[45] The Supreme Court reviewed both cases together and ultimately decided that "the police generally may not, without a warrant, search digital information on a cell phone seized from an individual who has been arrested"[46]. As a result, Riley's conviction was reversed while Wurie's case ruling was sustained.

Carpenter v. U.S. (2018)

Carpenter v. U.S. is similar to Riley v. California, in regard to how both involved data associated with cell phones. However, in the Carpenter case, police arrested four men with connection to an armed robbery. One of the men confessed and gave his number and all of the numbers of the other participants to the FBI, which they used to obtain orders to gain transactional records on each phone number. This was granted under the Stored Communications Act, 18 U.S.C. 2703(d), which provides the government the ability to "require the disclosure of certain telecommunication records when 'specific and articulable facts show] that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation.'"[47] The transactional records included evidential data about phone call location data and other [cell site location information (CSLI). Timothy Carpenter moved to suppress the evidence gained from the CSLI data, arguing it violated the 4th Amendment. Ultimately, the Supreme Court narrowly sided with Carpenter, stating the warrantless search and seizure of phone users' location data violated the 4th Amendment, but this case also extended the third-party doctrine, which was originally established in Smith v. Maryland and U.S. v. Miller (1976).

Social Analysis: Privilege of Privacy Amongst Individuals

While Smith v. Maryland established early boundaries for digital privacy through the third-party doctrine, the struggle between digital privacy and the government's duty to ensure public safety and promote the general welfare remains foundationally contested. Later cases U.S. v. Cotterman, Riley v. California, and Carpenter v. U.S. shifted the legal landscape by recognizing that digital privacy is not merely limited to or defined by location, device, or type of data. Further, these decisions affirm that modern technology and encrypted data function as extensions of one's identity: "phones are no longer merely phones, but important communication ...[and] data centers, and perhaps most significantly, loci for the digital culture."[48] In a world where personal identity, social life, and daily conduct are increasingly mediated through digital platforms, individuals carry with them an expectation of privacy that is qualitatively different from what was considered in the past.

However, this expectation is not universally accepted or consistently interpreted. The ability to protect one's digital privacy, through encryption, secure devices, and knowledge of digital rights, often underlines developing social privileges. As governments and courts continue to define the limitations and applications of privacy in an evolving cyber-physical space, tensions will continue to emerge between expanding privacy protections and ensuring that privacy is not viewed as a hindrance to justice, safety, or accountability. These tensions have been heightened by the recent rise in AI surveillance and automated data decryption services, where, as the ACLU notes, "the automated nature of these systems means that traditional limitations on police resources—once a vital check on government overreach—have been effectively eliminated."[49] These cases reveal that privacy is not only a legal right but a social resource - one that is unevenly accessible, persistently contested, and potentially constrained depending on the level of influence and position one has within society, public institutions, and digital systems.

Cases on Digital Autonomy vs. Law Enforcement's Authority

These cases highlight a nearly twenty year trend in how courts navigate the tension between personal digital autonomy and expanding authority of law enforcement. Central to this is the forgone conclusion doctrine, a limited exception to the 5th Amendment's Self-Incrimination Clause that can compel an individual to release encrypted data and passcodes if three factors are met:

  • The Government has knowledge of the existence of the evidence demanded
  • The defendant possessed or controlled the evidence, and
  • The evidence is authentic.

The government must also be able to describe the evidence with "reasonable particularity." [50] Although this doctrine is framed as a narrow case-by-case rule, its application in the digital era shifts power toward law enforcement in situations where devices and encrypted data act as extensions of personal identity, memory, and autonomy. As encryption continues to become a default feature of everyday technology, compelled-decryption cases raise questions about how much control individuals retain over their data and whether constitutional protections can keep up with rapidly evolving digital systems. While many courts, often citing In re Boucher, have supported decryption under the doctrine, cases such as U.S. v. Doe and the Oakland Biometrics Case emphasizes that society still recognizes meaningful limits on government authority and continue to affirm the social and legal value of personal digital autonomy.

In re Boucher Case (2009)

The In re Grand Jury Subpoena to Boucher case arose when Sebastien Boucher was arrested at the border between Canada and Vermont, where an officer's secondary inspection led to the discovery of child pornography on Boucher's computer. However, after seizing the laptop and once the computer was shut down, the hard drive's content could not be viewed again without entering in a passphrase. A Secret Service computer forensics expert testified that the drive had been encrypted using Pretty Good Privacy (PGP) software and there was no backdoor for this type of encryption software.51] In response, the grand jury subpoenaed Boucher to release the passphrases to the government, in which Boucher successfully moved to quash the subpoena, initially. Boucher argued that this violated his 5th Amendment rights against self-incrimination, but after further review the U.S. District Court for Vermont reversed the initial grant. The reasoning for this reversal is that since the files sought allegedly contain child pornographic content, the entry of the password is incriminating and therefore the real question is whether the "subpoena seeks testimonial communication." Also, both parties agreed that the content in the files did not share the same 5th Amendment privileges as revealing the password, as the files were "voluntarily prepared" and not testimonial.[52] The real question lies in whether entry of the password, and ultimately handing the files over to the government, would be testimonial and a violation of the 5th Amendment. The final verdict states that "Boucher has no act of production privilege to refuse to provide the grand jury with an unencrypted version of the Z drive of his computer," and that "the government may not make use of Boucher's act of production to authenticate the unencrypted Z drive or its contents either before the grand jury or a petit jury," ultimately legally compelling Boucher to decrypt his device and hand the files to the government.[53] This case became a significant landmark of [key disclosure law through being regarded as case law, and its influence is significant in several other court cases discussed in the battle of self autonomy and authority.

U.S. v. Doe (Dated March 25, 2011)

In the case of U.S. v. Doe, FBI agents seized two laptops and five external hard drives from a man under investigation, but the data was stored behind an encryption program assumed to be TrueCrypt. When ordered by a grand jury to produce unencrypted contents of the hard drives, he invoked the 5th Amendment, claiming a breach of protections against self-incrimination. Specifically, Doe argued that "the Government’s use of the decrypted contents of the hard drives would constitute derivative use of his immunized testimony, use not protected by the district court’s grant of immunity."[54] Doe also explained he was unable to decrypt the hard drive (which was disregarded in this case as well as the appeal case), but ultimately the court held Doe in contempt and jailed him. After appealing the decision, the circuit court ruled that decrypting the data is testimonial and therefore protected by the 5th Amendment (in favor of Doe), a comparably different outcome than seen in In re Boucher and U.S. v. Fricosu, and a significant limitation on the foregone conclusion doctrine.

U.S. v. Fricosu (2012)

In U.S. v. Fricosu, the FBI obtained a search warrant for Colorado resident Ramona Fricosu under suspicion of mortgage fraud. During the search, agents seized six computers. One of the six computers seized was password-encrypted by a program called PGP Desktop, which "provides easy to use and secure encryption to protect sensitive data on your laptop or desktop computers." [55] The day after the execution of the search warrant, Fricosu made a call to her incarcerated divorced ex-husband, and the recorded conversation revealed that both her and her ex-husband were aware of the content in her laptop, as well as the encryption program and her legal instruction to not provide any passwords, as protected by the 5th Amendment. In closing, several facts of the case (including file names, location of laptop, and connection to her ex-husband and his convictions) led the court to hold that Fricosu is legally compelled to provide an unencrypted copy of the files to the government as evidence, aligning with the In re Boucher case and applying the forgone conclusion doctrine.[56]

Commonwealth v. Gelfgatt (2012)

Commonwealth v. Gelfgatt is another case regarding compelled decryption via key disclosure laws influenced by In re Boucher. Leon I. Gelfgatt, an attorney, was indicted with seventeen counts of forgery of a document, seventeen counts of uttering a forged instrument, and three counts of attempting to commit larceny. The charges came from allegations against Gelfgatt that he conducted a scheme, using several computers, to receive ill-obtained funds that he used to pay mortgage loans for residential properties. The Commonwealth asked the judge to grant legal compulsion of Gelfgatt to decrypt his computers, in which the judge denied originally but asked for higher-level advisement on the question:[57]

"Can the defendant be compelled pursuant to the Commonwealth's proposed protocol to provide his key to seized encrypted digital evidence despite the rights and protections provided by the Fifth Amendment to the United States Constitution and Article Twelve of the Massachusetts Declaration of Rights?"[57]

The Supreme Judicial Court, after further review of the law in question, reversed the judges denial to the Commonwealth's request for Gelfgatt's compulsion, implying in their verdict that "the government can ... compel the defendant to produce it [digital evidence] where it already knows what the information is, and the defendant’s disclosure would add little or nothing to what the government’s knowledge," another application of the forgone conclusion doctrine.[58]

Oakland Biometrics Case (2019)

The In re: Search of A Residence in Oakland, California case presents a notably different application of the 4th and 5th Amendments in a cyber-physical system, compared to cases like In re Boucher, U.S. v. Fricosu, and Commonwealth v. Gelfgatt. In this case, the government was investigating two individuals suspected of committing extortion scheme conducted through Facebook Messenger. The government's warrant application asked for the authority to search the Oakland residence and seize all digital devices on the premise, and to compel any individual present to unlock the devices through biometric features, even if they were not the subjects of the warrant. The magistrate judge denied the application, finding that "while the Government had probable cause to search the premises under the Fourth Amendment, it did not have probable cause to search and seize all digital devices nor compel their unlocking using biometric features because the search warrant application was not limited to digital devices owned or controlled by the suspects."[59]

Citing Carpenter v. U.S. in 2018, the court emphasized how "the advancement of technology should not be accompanied by an erosion in the constitutional rights of the people, and that courts should vigilantly guard against such erosion."[59] In its final reasoning, the court held that biometric data cannot be compelled to unlock devices, including "fingers, thumbs, facial recognition, optical/iris, or any other biometric feature to unlock electronic devices." [60]

State v. Andrews (2020)

State v. Andrews began with the arrest of Quincy Lowery for suspected involvement in a New Jersey drug-trafficking ring. However, Lowery confessed officer Robert Andrews helped him evade detection by warning Lowery of the wiretap on his phone and the GPS tracker on his Jeep. Lowery even showed the investigators the text messages to prove such evidence, but because he reset his phone a month earlier, most of the text messages were wiped. Officers requested Andrews to hand over his two iPhones, in which Andrews did so voluntarily without giving out the passwords to unlock them. Without a way to effectively decrypt the passwords, the State obtained warrants for the phones' contents and motioned for Andrews to reveal the passwords. Andrews refused citing the 5th Amendment's Self-Incrimination Clause. Once the trial court supported the State's motion and Andrews appealed the courts decision, the appeals court upheld the trial court's decision, stating "because the State had already established that Andrews owned, possessed, and controlled his iPhones, his act of producing their passcodes, while 'testimonial,' fell under this 'foregone conclusion' exception."[61] Andrews appealed the decision again, and the New Jersey Supreme Court affirmed both lower courts, holding "that the Fifth Amendment privilege was overcome by the government’s knowledge of three key facts: the passcodes’ existence, their possession by the defendant, and their authenticity,"[61] ultimately compelling Andrews to reveal the passwords to the iPhones.

Social Analysis: Increasing Authority at the Cost of Digital Autonomy

The current U.S. legal landscape underlines a shift in how society balances personal digital autonomy against government authority. As courts increasingly apply the forgone conclusion doctrine to encrypted devices and data, they reshape social expectations about privacy, identity, and government authority. With digital devices functioning as extensions of our lives, compelled decryption has social implications far beyond traditional evidence production. Cases such as In re Boucher, U.S. v. Fricosu, Commonwealth v. Gelfgatt, and State v. Andrews have normalized broader government access to encrypted data, strengthening a social narrative that national security interests outweigh individual control over digital identity. This could erode trust and accountability, particularly in communities already skeptical of law enforcement, and may create concerning effects on expression, association, and political participation. As compelled access becomes more routine, society risks normalizing a surveillance-based relationship between citizens and the government.

However, cases like U.S. v. Doe and the Oakland Biometrics Case demonstrate the value digital autonomy and the importance of limiting the government's power when compelled decryption becomes indistinguishable from self-incrimination. Advocacies, professional organizations, and non-profits also play a crucial role in shaping both the public's view and judicial reasoning. For example, the Electric Frontier Foundation (EFF) wrote amicus briefs (a legal document providing advice, information, or arguments related to a case) for both U.S. v. Fricosu and U.S. v. Doe, consistently arguing that the 5th Amendment protected individuals from all forms of compelled decryption. They emphasized that the different outcomes in these cases resulted from not doctrinal inconsistency but from the defendant's own disclosures, underlining how "silence is golden." Noting how "Boucher talked to law enforcement" and "Fricosu talked to her ex-husband and co-defendant in jail," the EFF claims "it was this talking that defeated their Fifth Amendment privilege through the foregone conclusion doctrine."[62] Together, the legal and social proponents of conflicting civil liberties, often driven by strong social values, illustrate a battle over the definition of digital autonomy, one which courts, civil liberties organizations, and the public are actively shaping the future boundaries of state authority in an increasingly data-driven society.

Cases on Managing Public Trust & Accountability

This final section addresses the critical but often overlooked social values of public trust and accountability, particularly in the management of personal data. As emerging technologies such as quantum computing, AI, and edge computing reshape how information is stored and accessed, public trust in institutions responsible for protecting digital rights has become increasingly fragile. People typically rely on governments, courts, and large organizations to act as stewards of their data and to ensure that justice is upheld when digital rights are threatened. However, the following cases reveal a series of paradoxes, where entities display conflicting interests in data management and the legal framework governing their practices lag behind the change in technology. These tensions propose significant questions in who truly manages data and, by extension, who the public can trust to enact accountability in an increasingly digital world.

U.S. v. Microsoft (2018)

Data centers hold vast amounts of information about millions of individuals and organizations, making them a significant source of digital evidence.

Data centers hold vast amounts of information about millions of individuals and organizations, making them a significant source of digital evidence. (Image: BalticServers.com, CC BY-SA 3.0)

In U.S. v. Microsoft, the FBI in 2013 obtained a warrant under the Stored Communications Act requiring Microsoft to release encrypted email and other information connected to one of their customers that was under suspicion of being involved in illegal drug trafficking. Microsoft refused to comply, arguing these emails were stored in its Dublin, Ireland data center and that the SCA did not authorize U.S. courts to compel production of data outside of its borders. Microsoft moved to quash the warrant, questioning how a United States federal law can be enforced outside of U.S. borders. While the move to quash the warrant was denied by the district court, Microsoft appealed the ruling and was granted their motion to quash it by the Second Circuit court. The U.S. Department of Justice petitioned to review the new decision, claiming that the warrant was "a domestic application of the SCA," and that the appealed decision "would be 'impractical and detrimental to law enforcement' and that the use of the SCA to obtain user data stored abroad would respect 'the United States’ international obligations.'"63] After the Supreme Court granted the petition and planned to hold another hearing, the federal government enacted the [Clarifying Lawful Overseas Use of Data Act (CLOUD Act), which in essence established that U.S. service providers must produce data within their possession, custody, or control regardless of where the data is physically stored. This ultimately led to the case being dismissed as unnecessary and Microsoft being legally compelled by the CLOUD Act to obtain and provide the data from its Irish datacenter, due to Microsoft being a U.S. company.[64][65]

Van Buren v. U.S. (2021)

Van Buren v. U.S. addresses access to encrypted data very differently from U.S. v. Microsoft. Georgia police sergeant Nathan Van Buren was bribed by Andrew Albo, who was cooperating with an FBI sting operation, to run a license plate search on a possible undercover cop. Van Buren complied to the request, and through the Georgia Crime Information Center (GCIC) he used his authorized credentials to look up the provided license plate to confirm the identity of an undercover cop. Although officers are trained that GCIC access is strictly limited to law enforcement purposes specifically, Van Buren technically accessed only information he was already authorized to view. He was charged with violating the Computer Fraud & Abuse Act (CFAA), which he petitioned for review claiming that he technically did not exceed access authority as a law enforcement official with proper credentials to access the GCIC.[66] The court argued that "the purpose in using the system was immaterial," and with there being no purpose limitation cited in the CFAA, "Van Buren was authorized to access the database and di not violate the CFAA."[67]

The court also made three important notes regarding the outcome and implications of this case and the CFAA, stating as follows:

  • Amending the CFAA to include a purpose-based limitation criminalizes ordinary conduct, such as when an employee uses a business computer to send and check personal emails.
  • Purpose-based limitations are unstable and potentially unclear, blurring what is considered "normal" and "criminal" conduct.
  • The CFAA was only concerned in Van Buren's credentials, not his purpose for accessing GCIC records. Future disputes may address how contracts, policies, and terms of service interact with the statute's access-based limitations.

Social Analysis: Continuously Balancing Restriction and Freedoms

Thomas Jefferson recognized the power the public provides to its government, and the importance of the government maintaining the public's trust.

Thomas Jefferson recognized the power the public provides to its government, and the importance of the government maintaining the public's trust. (Image: Rembrandt Peale, Public domain)

As Thomas Jefferson once stated, "when a man assumes a public trust, he should consider himself as public property."[68]

The principal Jefferson emphasizes is that public institutions derive their legitimacy from the people and must remain accountable to them. Yet the modern legal framework surrounding encrypted data often moves in the opposite direction. In cases such as U.S. v. Microsoft, the government asserted authority beyond U.S. borders, raising important questions about which institutions, domestic or foreign, citizens are expected to trust with their digital lives. Microsoft and privacy advocates warned that if the U.S. can issue a warrant that legally compels decryption abroad, "other countries will in turn use their own laws to seize data stored in the U.S" which "could put Americans’ emails (and other data) at risk of seizure by foreign governments."[69] The CLOUD Act further complicates this landscape by shifting practical control of data from the government to private, for-profit corporations. Even when data is physically stored in another country, ownership and decision-making authority often remain with companies like Microsoft, Facebook, and Apple, who all supported the CLOUD Act and whose incentives are shaped not by democratic accountability but by reputation management, market pressures, and financial interests. This raises two currently unanswered questions of public trust: first, how can citizens trust governmental systems when jurisdictional boundaries blur and government authority extends beyond its traditional limits, and second, how can they trust corporations to act as responsible stewards of their data when their obligations to shareholders may conflict with the public's interest in privacy and autonomy?

Furthermore, Van Buren v. U.S. produces a paradoxical outcome, where individuals protected from being criminalized for everyday digital behavior while simultaneously exposing the public to greater risks of insider misuses of encrypted data by law enforcement. The CFAA was originally designed to prevent unauthorized access to sensitive information, but Van Buren narrowed its scope by rejecting any inquiry into a person's purpose for accessing data. In doing so, the court prevented the CFAA from becoming an overly broad "terms-of-service crime," yet it also removed a potential safeguard against officers who misuse their legitimate credentials to access personal information for improper reasons. As scholars note, the CFAA retains its force, "even with the purpose inquiry foreclosed: access may not be authorization, and authorization or its limits could be inferred from context and terms of use."[67] Regardless, this case “does not definitively resolve the question of whether unauthorized access must be barred by a hardware or software gateway or if activity can become ‘unauthorized’ by a contractual ban" and “largely for that reason, the practical effects on the CFAA’s civil enforcement provisions remain to be seen.”[70] From a public trust perspective, this creates a double-edged sword: the decision limits government overreach, yet it also leaves the public more vulnerable to the very actors entrusted with sensitive data, raising the difficult questions about accountability, oversight, and the social value of trust in law enforcement.

Both U.S. v Microsoft and Van Buren v. U.S. offer different stories connected by their influence over public trust and accountability; one raises concerns about how far a government's authority extends and the inherent ownership of encrypted data by companies driven by the market and productivity, while the other is seen as a win for protecting individuals from accidental criminalization of normal activities and a loss for holding law enforcement accountable by removing an extra layer of protection through authorization and credentials. As technology changes and evolves, shaping the application of data encryption, management, and access, future litigations may arise, and the question of who will maintain the public's trust in data privacy and digital autonomy will most likely continue to be overlooked and potentially mishandled. All of these court cases point toward a future that will quickly challenge long-held and accepted social values, especially in regard to extending those values to encrypted digital or cyber-physical platforms, and it is up to all participants to make these social values known and considered, whether it is noted by an advocacy, non-profit organization, for-profit corporation, law enforcement agencies, regular citizens, or the courts.

Conclusion

The struggle over law enforcement access to encrypted data is far from over. Future additions to this chapter should explain how the primary participants in the debate have changed as well as new legal and technological developments. One useful addition would be the Communications Assistance for Law Enforcement Act (CALEA), which states that carriers are generally not responsible for decrypting communications unless they provide the encryption and possess the information needed to decrypt it.[71] Also, more details about the All Writs Act and how it was used in the San Bernardino investigation would help contextualize the sentiment on this topic during the Obama administration.[72] These examples would help show that the legal and social conflict over encryption is at times more critical than the technical aspect of encryption.

Future updates could also discuss newer legislative and institutional participants. For example, the Lawful Access to Encrypted Data Act in 2020 proposed requiring device manufacturers and service providers to assist law enforcement with access to encrypted data after a warrant.[73] Even though this proposal did not become a law, it reveals the continued interest of Congress in the encryption debate and their framing of encrypted data as a public safety issue. Future additions could also discuss the Department of Justice and FBI's continued use of the phrase "lawful access," which presents encryption as a barrier to valid warrants rather than a privacy tool.[74] This broadens the chapter beyond courts and technology companies by framing prosecutors, legislators, and executive agencies as important participants in the debate.

Finally, the chapter could be improved by including ongoing and additional recent court cases. For example, United States v. Payne established that compelled use of a fingerprint to bypass biometric security on a phone was not testimonial communication and did not violate the Fifth Amendment.[75] However, United States v. Brown had a similar situation of compelled biometric unlocking, but the D.C. Circuit decided that it did violate the Fifth Amendment.[76] Other important cases include State v. Missak, which raises questions about how specific a warrant must be before police can search a cell phone, and State of New Mexico v. Meta Platforms, Inc. which concerns how Meta's end-to-end encryption significantly reduces their ability to detect child exploitation material on their platforms.[77][78][79] These cases broaden the encryption debate and show that it isn't only about encryption backdoors, and more about biometric access, phone-search limits, and platform liability. This also shows how there are many competing social values in this debate such as values of privacy, safety, and accountability. Additionally, interesting additions to this chapter could include updates covering future developments and expansion to cover encryption worldwide.

References

Where this page came from

This page was imported from Wikibooks. From “Lentis” on Wikibooks, by its contributors, under CC BY-SA 4.0. Changed here: set as a page; navigation and edit links left out; each image under its own licence, credited in its caption.

Nobody has written it yet — it is the source material at a new address, which is why search engines are asked to skip it and why no one earns from it. It is up for grabs: take it on, and it is yours to rewrite and to earn from.