On October 24, 2018, the Florida Court of Appeal for the Fourth District ruled that the state could not compel the production of a defendant's iPhone passcode and iTunes password because doing so would violate the Fifth Amendment's protection against self-incrimination. The ruling in G.A.Q.L. v. State of Florida is encouraging for privacy advocates but may set up a showdown at the Florida Supreme Court, as it conflicts with a 2016 ruling from the Florida Court of Appeal for the Second District in which the court ruled that compelled production of a passcode did not violate the Fifth Amendment. The two pair of decisions highlights the variety of ways courts can choose to apply long-standing legal principles to new technology – and the resulting lack of predictability for practitioners.
Would compelled passcode production violate the Fifth Amendment?
The issue in G.A.Q.L. arose after G.A.Q.L., a minor, crashed his vehicle while driving under the influence, resulting in the death of one of his passengers. Upon searching the vehicle, police found an iPhone 7 alleged to belong to the minor. After obtaining a warrant to search the phone, the police sought an order compelling the minor to provide the iPhone passcode and the password for an associated iTunes account because the phone couldn't be searched before an update was installed. The police wanted to search the phone because a surviving passenger stated she had communicated with G.A.Q.L. on the day of the crash via text messages and Snapchat. In response to the police's motion to compel, the minor argued that compelled disclosure of the iPhone passcode and iTunes password would violate the Fifth Amendment. The trial court disagreed and ordered the production, so G.A.Q.L. petitioned the Florida Court of Appeal for a writ of certiorari to quash the trial court's order.
Looking to Fifth Amendment precedent, the court weighed whether compelling production of the iPhone passcode and iTunes password would be more akin to requiring a person to surrender a key to a strongbox or to reveal the combination to a wall safe. Only the latter situation would constitute self-incrimination, according to the court, as it is testimonial in nature rather than a simple physical surrender. After surveying prior cases involving passwords, the Court of Appeal concluded that "revealing one's password requires more than just a physical act; instead, it probes into the contents of an individual's mind and therefore implicates the Fifth Amendment." As the court explained, the "very act of revealing a password asserts a fact: that the defendant knows the password," and so being forced to produce a password is testimonial. Thus, the Fourth District ruled that production of the iPhone passcode or iTunes password would violate the Fifth Amendment.
The Fourth District recognized that its decision directly contradicted the Second District's 2016 ruling in State v. Stahl, 206 So. 3d 124 (Fla. 2d DCA 2016). The Stahl court reasoned that because producing the passcode did not "extensively use" the producing party's mind, and that the passcode had no significance beyond its content, the production was not testimonial. Further, the Stahl court stated that producing the password was not a factual assertion and did not betray any knowledge about the offenses with which he was charged. By contrast, the G.A.Q.L. court found that providing the passcode would be "demonstrating as a factual matter that [the minor] knows how to access the phone," and did qualify as testimonial.
Does the foregone conclusion exception apply?
The Fourth District in G.A.Q.L. also diverged from the Second District's Stahl decision with respect to the "foregone conclusion" exception. Under this exception, compelling information does not violate the Fifth Amendment if the government can show with reasonable particularity that at the time it sought to compel the information, the government already knew of the materials it was seeking. With respect to electronic data, the government must demonstrate its knowledge that a file exists in a specified location, the target of the subpoena possesses the file, and the file is authentic.
The Stahl court found that the exception applied because the government had established that the passcode existed, it was in the accused's possession, and it was authentic. The Second District stated it did not need to establish any of those factors with respect to the contents of the phone, because it had not sought those; it requested the passcode. The G.A.Q.L. court disagreed. According to the Fourth District, the foregone conclusion inquiry had to address the locked data, because finding otherwise "would expand the contours of the foregone conclusion exception so as to swallow the protections of the Fifth Amendment." And because the subpoena to the minor did not identify specific files or file locations for information sought on the phone, the government did not meet the reasonable particularity requirement of the foregone conclusion exception. Accordingly, the G.A.Q.L. court held – contrary to the Stahl court – that the foregone conclusion exception did not apply.
With respect to both the initial Fifth Amendment inquiry and the foregone conclusion exception, the G.A.Q.L. court took the position that passcodes shouldn't be treated differently from other factual information and shouldn't be used as a loophole to compel production of other information. And while privacy advocates will appreciate such sentiments, they are not a guarantee that information on a phone will always remain hidden. Even if the view in G.A.Q.L. prevails – itself no foregone conclusion – the government can seek information from other sources, such as communications providers or other third parties who store personal data. Or, in some instances, the government may seek to crack passwords using its own tools or by pressuring companies like Apple to help it. Given law enforcement's own incentives, the government may resort to such tactics if courts such as Florida's Court of Appeal for the Fourth District continue to apply the Fifth Amendment in this manner in technological contexts.
This article is presented for informational purposes only and is not intended to constitute legal advice.
