Self-incrimination in the digital age: Can the police force an accused to reveal passwords?

Mobile phones have become devices that store our secrets and most intimate information. To quote the US Supreme Court,

“Phones are so pervasive and insistent part of daily life that the proverbial visitor from Mars might conclude they were an important feature of human anatomy”.

The ability of our devices to protect the information from unauthorized access through encryption with a passcode or finger impression builds trust in these devices. But imagine being accused of a crime, and the police wants to unlock your phone/laptop for investigation. Are you obligated under law to give the password?

This vexed question of law is of significant Constitutional importance as it requires the court to examine whether disclosure of passcode against one’s volition violates the principles of self-incrimination, a constitutional protection under Article 20(3) of the Indian Constitution that prohibits the State to compel an accused to be a witness against himself.

In this post, we will examine if mobile passwords/finger print impressions can be compelled to be disclosed/produced by the State.

Self-incrimination in India

Under the Indian jurisprudence, the right against self-incrimination is available against revelations that might connect an accused with the commission of a crime. In its landmark case of Bombay v. Kothi Kalu Oghad (1961), the Supreme Court was required to define the scope of the protection and decide if compelling an accused to give handwriting, signature, or thumb impression samples violates Article 20 (3).

Holding against the accused, the Court observed that a witness offers testimonial and non-testimonial (physical) evidence, and only in the former, an accused may be considered a witness against himself. It reasoned that,

“Self-incrimination must mean conveying information based upon personal knowledge and cannot include merely the mechanical process of producing documents in court which may throw a light on any of the points in the controversy, but which do not contain any statement of the accused based on his personal knowledge."

Applying the reasoning, the Court held that handwriting is non-testimonial evidence which does not convey personal knowledge likely to lead to incrimination by itself or furnish a link in chain of evidence. It may only be used for corroboration or comparison with other evidence in the investigation. Therefore, an accused can be compelled for production of handwriting sample.

This principle has been used for compelling an accused for production of thumb impression, breath sample, voice sample, DNA etc. Later, in Selvi v. State of Karnataka, the Supreme Court declared several techniques like brain mapping, narco-analysis and lie detector test unconstitutional as they intrude into the privacy of an individual to extract feelings and thoughts for self-condemnation. It further strengthened the protection by holding that Article 20(3) creates a zone of mental privacy which the State may not force to surrender to extract personal knowledge about a relevant fact.

Thus, any information that arises from personal knowledge is protected under Article 20 (3) of the Indian Constitution. The same principle for self-incrimination is applicable in the United States jurisprudence. In India, application of this principle for securing passcode is yet to discussed by the courts. Various US Courts have delivered conflicting verdicts on this issue.

Passcode and self-incrimination in the US

The US Supreme Court is yet to decide whether compelling production of mobile passcode/fingerprint would be in violation of the Fifth Amendment (self-incrimination) protection under the US Constitution. However, the state courts in the US have rendered conflicting rulings on the issue.

In one judgment, the Pennsylvania Supreme Court declared that an accused cannot be compelled to reveal the passcode of his computer because the password exists in his mind and one cannot be compelled to remember the password or reveal it, as a person’s thoughts and knowledge are at the core of the Fifth Amendment.

In other cases, the courts have allowed compelling of passcode by applying the doctrine of “Foregone Conclusion”. This doctrine is applied to cases where the prosecution proves that the content of phone is already known to the police and a passcode will not add anything new to prosecution case. For instance, if the police wants to access X’s phone, then it has to prove a.) the phone belongs to X, b.) X knows the passcode c.) the police already knows the content of the phone and location of the incriminating evidence in the device.

However, in a few cases, courts have applied the foregone conclusion only to the extent of proving the accused’s knowledge of the passcode. For instance, a Missouri Court allowed extraction of passcode where the accused had previously unlocked the phone before the investigating agency. The Court ordered production of the passcode because “previous unlocking satisfied the elements of the foregone conclusion exception, because implicit facts were conveyed through act of entering the passcode i.e. the existence of the passcode, its possession or control by the accused, and the passcode’s authenticity. Therefore, applying the foregone conclusion test, it ordered compelling of the accused for the production of his password.

Even in cases pertaining to production of fingerprints, the courts have held inconsistent views. For instance, in Commonwealth of Virgina v. Baust ,the Court allowed production of fingerprints for decryption because a fingerprint is non-testimonial evidence with physical characteristics. Unlike a passcode, production of fingerprint doesn’t require divulging the contents of one’s mind. However, some courts have denied the production of fingerprints because they are the ‘functional equivalent’ of passcodes when used to unlock digital devices and therefore cannot be ordered for compelled production.

The contrary stands taken by different US Courts offers no clarity on the status of protection against compelled production of passcode/fingerprint. Thus, it is imperative for the Indian Supreme Court to remove the ambiguity brewing under self-incrimination jurisprudence concerning passcodes and fingerprint.

In India, compelling production of passcode would be against judicial pronouncements, since it would require communication of personal knowledge from an accused. However, based on its verdicts, the Court may compel production of fingerprints and choose not to treat the fingerprint as a “functional equivalent” of a passcode. However, what course the Court will take is yet to be seen.

The authors are advocates based in Delhi.