Decrypt Laptop

Ruling Stands: Defendant Must Decrypt Laptop

A federal appeals court is rejecting an appeal from a bank-fraud defendant who has been ordered to decrypt her laptop so its contents can be used in her criminal case.

Colorado federal authorities seized the encrypted Toshiba laptop from defendant Ramona Fricosu in 2010 with valid court warrants while investigating alleged mortgage fraud, and demanded she decrypt it by typing in her password. In January, U.S. District Judge Robert Blackburn ordered the woman, who faces decades in prison if convicted, to decrypt the laptop by the end of February.

Her attorney appealed, hoping to win a reprieve based on the assertion that being forced to decrypt her laptop amounts to a breach of the woman’s Fifth Amendment right against compelled self-incrimination.

The 2nd U.S. Circuit Court of Appeals, however, sided with the government’s contention that an appeal was not ripe — that she must be convicted or acquitted before the circuit court would entertain an appeal. Appellate courts usually frown on hearing appeals until after there’s been a verdict.

The appellate court wrote (.pdf) Wednesday that it lacks “jurisdiction to consider the resulting proceeding under any exception to our usual finality rules.”

Meanwhile, decryption orders are rare, and they have never been squarely addressed by the Supreme Court.

One case involved a child pornography prosecution that ended with a Vermont federal judge ordering the defendant to decrypt the hard drive of his laptop.

While that case never reached the Supreme Court, it differed from the Fricosu matter because U.S. border agents already knew there was child porn on the computer because they saw it while the computer was running during a 2006 routine stop along the Canadian border. The authorities’ belief that Fricosu’s hard drive might contain evidence against her was the result of a recorded jailhouse conversation between her and a co-defendant.

The ruling doesn’t, however, settle the issue. For instance, now the case faces the question of what might happen if the woman does not comply with the judge’s order. Her attorney, Philip Dubois, suggested in a recent interview that his client might have forgotten the password.

If she does not decrypt the drive by month’s end, as ordered, she could be held in contempt and jailed until she complies. If the case gets to that point, Judge Blackburn would have to make a judgment call and determine whether the woman had forgotten the code or was refusing to comply.

Prosecutors said they are unable to unlock the drive, and fear tampering with it could damage its contents. Attempting to break into an encrypted drive by brute force — using computers to repeatedly guess at a password, would likely take decades or even centuries, depending on the strength of the encryption algorithm and the length of the passphrase.