Can a US citizen be required to provide the authentication key for encrypted data on a confiscated computer? I'm asking this for the sake of a story I was considering writing. Assume that someone has a computer, and within that computer he has some encrypted data. He is accused of a crime and the police get a search warrant to confiscate his computer. They suspect that he may hold evidence of the crime within the encrypted data, but have no way of getting to it without a password. Can the police force the owner of the computer to reveal his password, and/or penalize him if he doesn't, since they have a search warrant which justifies their viewing his data? Or would this qualify as being forced to bear witness against yourself and thus be protected under the bill of rights? Related question, if they confiscate a user's computer and learn his password, either from his providing it or it being saved on his computer, would they have the right to use that password to view information stored on 'the cloud', such as in his e-mail or even on his facebook?
If law enforcement is actually requesting an encryption key, talk to a real lawyer. To answer your first question, the answer is &quot;the government probably can't demand the password, but might be able to demand the data.&quot; Some courts have ruled that the Fifth Amendment can prevent courts from forcing someone to decrypt data for the government, because the act of decrypting the data conveys information (see United States v. Doe from the 11th Circuit). Other courts have ruled that there are situations where that is not the case (US v. Fricosu, In re Boucher). Boucher is particularly interesting because the government first asked for the password itself, and then (when that subpoena was quashed by the magistrate) narrowed its request to the decrypted data on appeal. In the magistrate's opinion, we see Also, the government concedes that it cannot compel Boucher to disclose the password to the grand jury because the disclosure would be testimonial. It is not generically a violation of the Fifth Amendment to compel production of documents (the 11th Circuit, quoting the Supreme Court, considered this a &quot;settled proposition&quot;). The issue is that the act of producing the documents can be considered testimony -- by producing the documents, the person is showing that they know the documents exist, where they are, how to read them, etc. Possession of the key to decrypt a file links you to that file, because keys are generally kept secret. In the 11th Circuit case, the court found that the government didn't know for a fact that a) Doe could decrypt the files, and b) what files existed on the encrypted drive. In the cases where forced decryption was allowed, the government had seen enough to independently show that the files existed, were authentic, and that the defendant had actual control/possession over them. The 11th Circuit asked for a bit more (the location), based on a standard that is in effect in some circuits but not others. In any event, courts seem to generally consider this to take a court order to force production of anything; the police can't just order you to do it.
As a baseline, you may assume that your code will be used legally. It sounds like this still applies in your case: there is an entirely reasonable and legal use for login code, so you had no reason to assume that there might be a problem. This puts you legally in the clear. To be liable, you'd need to know or at least reasonably suspect that your code would be used to violate the law.
Maybe not. The ICO says that The right of access enables individuals to obtain their personal data rather than giving them a right to see copies of documents containing their personal data. It might be valid to interpret the DPA / UKGDPR in a way that the relevant personal data undergoing processing in their system is the existence of the letters, but that you are not entitled to a copy of the letters. This is in line with the purpose of the right to access, that you can check what data they are processing about you and whether it is correct. If that argument holds and the data subject insists on receiving a copy of the letters, it might be legitimate to charge them a fee for these copies. But in practice: The data controller might not make this argument and just hand over the copies. It is worth a try. A right to access founded in data protection might not be the only way to receive a copy of these materials. If the letters are relevant for legal proceedings, they could perhaps be requested during the disclosure process.
It will be fact-specific, but potentially not unlocking your phone for such a reason could be a &quot;reasonable excuse&quot;. However, you will need to provide evidence for such an excuse. The prosecution will still have to prove, beyond reasonable doubt, that the excuse is not &quot;reasonable&quot;. It is entirely possible that the court would determine any such excuse based on privacy to not be reasonable, partly because it grants a very broad shield to defendants which would frustrate the purpose of the law, but partly because they can point to precedent that privacy is not an absolute right and that privacy infringement can be justified in the circumstances (the same way the police can search your phone). I have not been able to find any relevant case law on the matter, but I will keep investigating and update my answer if I find any. As an aside, it does appear possible for any warrant obtained by TV Licensing officials to include a Section 49 Regulation of Investigatory Powers Act 2000 notice which would compel you to unlock the phone regardless of any &quot;reasonable excuse&quot;. Failure to do so would result in a conviction under Section 53 of the Act.
In the UK and USA (and I imagine other jurisdictions) there have been laws that explicitly provide for orders obliging entities to (A) provide access or information and (B) keep the order secret. For example, in the USA the Stored Communications Act, Fair Credit Reporting Act and Right to Financial Privacy Act authorise the FBI to issue National Security Letters (Wikipedia, EFF, EPIC, Lawfare). These are an administrative subpoena, without prior approval from a judge, for meta-information (e.g. phone numbers dialed or email recipients addressed but not the content) of communications relevant to national security investigations. They typically contain a non-disclosure requirement prohibiting the recipient of the NSL from disclosing its existence or the FBI's demands. There have been challenges on First Amendment grounds to the non-disclosure aspect but, so far as I'm aware, they have all ultimately failed. Some of their non-disclosure requirements may eventually expire under other laws. In response, so-called 'warrant canaries' (Wikipedia) have been developed (and gone a bit further than the original idea) - these are intended to allow entities to relatively passively warn of such an order having been received if not the detail of the order. However, they can be legally risky in that they might be seen by a court as trying to circumvent the non-disclosure requirement and therefore breaking it.
The relevant Maryland statute is MD. Criminal Law Code Ann. § 9-307 (2021), subsection (a): A person may not destroy, alter, conceal, or remove physical evidence that the person believes may be used in a pending or future official proceeding with the intent to impair the verity or availability of the physical evidence in the official proceeding. Note &quot;that the person believes&quot; and &quot;with the intent to.&quot; If you have no reason to think it might be necessary in an official proceeding, you aren't violating this section. If you delete the data unintentionally or for some other reason, then you also probably are not violating the section. (I say &quot;probably&quot; because I'm sure there's some sort of provision for negligence or willful disregard for the evidential value of something you should know has evidential value.) As a practical matter, no copyright lawsuit or criminal trial (and criminal trials over copyright infringement are very rare) is going to depend on the browser history of the defendant's friend. What if my computer has major software issues and the only viable solution is delete everything and reinstall from scratch; am I stuck with a worthless broken computer because reinstalling things from scratch would delete evidence of a crime? If you know of evidence on the hard drive that would be destroyed, you can copy it somewhere else before deleting and reinstalling. Federal law is similar: it requires knowledge and intent. 18 USC 1519: Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.
In my opinion, this should be enough. The GDPR regulation is general - it does not attempt to address these issues directly, precisely for the reasons we see here: You can never predict how the technology will develop. When interpreting the GDPR, we must keep the intended goal in mind. What is the purpose of the "right to erasure"? To prevent anyone from further processing the personal data. If you "crypto-shred" it, it can't be processed anymore, not even theoretically. The encryptec file cannot be used to identify the subject, therefore it is not even personal data anymore. In case it can be decrypted in the future... Well, that is just a speculation. The courts can go to great lengths in interpreting what personal data is (dynamic IP address is considered personal data, since it can be linked to a person by the police with a court order), but i am pretty sure that "it can be theoretically possible in some distant future" is beyond the limit. As for the second question, I am not aware of any applicable case-law, but I guess that current security and technological standards will be used to assess the delay. You have a right to protect your data, the subject has a right to erase them. Those rights must be balanced, neither fully overrules the other. The delay should be short enough so the right to erasure is effective, and it should not extremely long compared to other (economically viable) backup solutions available, in line with current industrial standards.
Anyone can be arrested, as long as the police (and in some cases, anyone) have probable cause to do so. This generally includes two points: You are in the process of committing a criminal act The police have probable cause, generally through evidence, that you are in the process of, about to, or have committed a criminal act. This usually requires obtaining a warrant for the arrest. However, it's important not to conflate searches with arrest. Arrests are when you are being taken into custody for the reasons mentioned above. Searches are when your personal belongings (i.e. property), are searched to collect evidence. It is not up to police to convict someone. This is the job of the judicial system. There's a bit of terminology here: convictions basically mean being found guilty of an offence. Police don't have the ability to convict someone of an offence. They do have the ability to arrest, and charge with an offence. To charge someone with a crime basically means to accuse them of having done something. Now let's get to the actual crime. Since you haven't mentioned a specific jurisdiction, I'm going to use Canadian cases and law, but in general, it should apply worldwide. If the police have reason to believe that you are engaging in unlawful hacking-related behaviour, then they have the authority to arrest you. They simply need to have a reasonable belief that you are engaged in the crime. Something such as connecting you with an IP address and connecting that you were online at the time is enough. If the police need to find out more information (which they generally do, to investigate further into the matter) - they can obtain a search warrant afterwards. With this, they can legally search into your computer, and investigate. Any evidence that they collect can be used in court. I've recently done some research into cyber crimes. One rather infamous case involved the attack on multiple large scale websites, including Dell, Yahoo, and Amazon, in 2000. This sparked a large scale investigations, between the RCMP (Royal Canadian Mounted Police) and the FBI. The attacks were claimed by some to cause nearly 1.7 billion dollars of damage. The hacker was charged with 58 different offences. You can imply from the linked article that he was arrested before his computer was searched.