Is “I forget” a valid defense when court orders demand a smartphone password?

This week, a judge considers possible jail for alleged extortionists who pled the Fifth.

On May 30, two suspects accused of extorting the so-called "Queen of Snapchat" as part of a sex-tape scandal are scheduled to appear in a Florida court. But as wild as the premise sounds, primarily the accused need only to answer a simple question on this visit. Miami-Dade Circuit Judge Charles Johnson wants an explanation as to why Hencha Voigt and her then boyfriend, Wesley Victor, can't remember the passcodes to their mobile phones.

if he doesn't believe them or if they remain silent, the two suspects face possible contempt charges and indefinite jail time for refusing a court order to unlock their phones so prosecutors can examine text messages. Their defense to that order, however, rests on an unsettled area of law. Voigt and Victor maintain that a court order requiring them to unlock an encrypted device is a breach of the Fifth Amendment right to be free from compelled self-incrimination.

If things don't go their way in court Tuesday, the duo certainly wouldn't be the first ones ordered to prison for failing to abide by a judge's decryption order. They likely won't be the last ones, either.

GAME OVER

Voigt and Victor's escapade reads like a sort of present-day Law & Order plot. Voigt previously maintained some level of local celebrity in Miami, having starred in an E! show about women and athletes called Wags Miami. But the alleged victim—the "Queen of Snapchat" Julieanna Goddard, aka YesJulz—arguably dwarfed that public profile. Once the subject of a New York Times profile, Goddard boasts hundreds of thousands of followers across various social media, but the Snapchat platform is what reportedly elevated her to celebrity status. She's rubbed elbows with more traditional celebs at the Grammys and the NBA All-Star Game and has been namechecked in rap songs as a result of her work. To paint a fuller picture, Elite Daily proclaimed Goddard as friends with Lebron James and said the twenty something is "living the Millennial Dream."

But on July 21, 2016, the dream nearly became a nightmare. That afternoon, Goddard's personal assistant received a flurry of peculiar text messages. According to court documents (PDF), Voigt reached out to let Goddard know someone had "hacked" the Snapchat star's phone and "obtained compromising sex videos of Ms. Goddard which they were trying to sell." Voigt went on to send screenshots and short clips as proof that "these unspecified individuals actually had the compromising videos."

Luckily, Voigt continued, the would-be blackmailers would contact Goddard using a trap phone. "But don't threaten them, be super nice," Voigt warned. "U give them the money... And they don't do something w it."

As these texts took place, court documents show Voigt allegedly engaged in multiple calls with Victor. Voigt eventually sent her then boyfriend Goddard's phone number, and the man sprung into action. "This text is in behalf go the videos we have," Victor texted to Goddard around 6pm. "You have 24hrs have a wonderful evening... 2 videos in total one with robb banks and one with rambo the photographer i'll give u further instruction shortly."

The next day at 2pm, the conversation between Victor and Goddard resumed. Goddard reached out to ask how she'd get the videos back. "18k cash there on usb you can have them back as I said you dope chick I like your movement," Victor replied according to court records. "look if I feel any fun business GAME OVER your choice have a great day."

What Victor and Voigt didn't know, however, was that Miami Beach Police Department (MBPD) officers seemed to be aware of the situation by this point. Within minutes of the extortion texts, police apprehended Victor and Voigt together inside a parked vehicle within the vicinity of 1000 West Avenue in Miami Beach. The duo had four phones with them—Voigt's iPhone 6 and three devices (a BlackBerry, Samsung, and an iPhone 6S) belonging to Victor. According to a police complaint, Victor even tried to hide a device by sitting on it when authorities asked to search the vehicle.

MBPD detectives eventually obtained a search warrant to examine all four phones. But when digital forensics expert Ricardo Arias attempted to search the devices the following month, he ran into dead-ends. He determined all four phone numbers, but "he was unable to fully examine the contents of either Phone A [Voigt's iPhone] or Phone B [Victor's BlackBerry] because each of those phones were locked via a passcode with no available bypass," according to court documents.

Both Voigt and Victor were charged with extortion (and unfortunately for Goddard, the alleged sex tapes managed to leak online following the duo's arrest). Florida authorities suspect Voigt's and Victor's phones might have incriminating evidence, such as further text messages, linking them to the alleged extortion scheme. The messages that the government is trying to review are iMessages from Voigt to Victor that "do not appear in telephone service provider records as anything other than generic data usage." The government also maintains (PDF) that "the only practical way of determining whether iMessages were sent or received from a particular phone is to actually examine the contents of the phone."

During a hearing on April 25, 2017, prosecutors formally asked the courts to compel the unlocking of these phones. Accordingly, Voigt's team unveiled its Fifth Amendment defense. “This is a fishing expedition,” Voigt’s attorney, Kertch Conze, told the judge according to the Miami Herald. “You are asking my client to be compelled to divulge her thought process. This is not a fingerprint or a blood sample for DNA purposes. It’s what is in her mind and what we believe can be incriminating and a violation of her right to remain silent.”

But on May 3, Judge Johnson sided with the prosecution on the matter and ordered the two defendants to unlock their phones. He likened this command to "turning over a key to a safety deposit box," and the judge put the defendants on the clock to comply. But Voigt and Victor's team responded by saying the accused forgot their passcodes. Their stated memory loss essentially amounts to a chess move, and this week it leaves Judge Johnson to decide whether they should be held in contempt of court or perhaps imprisoned indefinitely until they divulge the code. (People found in contempt of court can be held in prison until they comply with a court order.)

New relevance for encryption, but ancient past as precedent

This latest legal brouhaha arrives as encryption has become ever more commonplace on mobile phones and computers while the topic of encryption has permeated the national political discussion. There's much debate globally about whether governments should demand that companies bake backdoors into their encrypted products so that the authorities can access content on them.

Arguably the most prominent recent incident came last year during the Justice Department's legal battle with Apple in wake of the San Bernardino shootings. A magistrate judge ordered Apple to produce code to enable the FBI to decrypt the iPhone used by one of the two shooters who killed 14 people at a San Bernardino County government building. But the standoff never made it to a final, precedent-setting decision—the government, instead, dropped the case when authorities paid a reported $1 million for a successful hack of the phones in question.

To date, the Supreme Court has never addressed the issue of forced decryption, let alone what to do if a defendant claims they forgot the passcode. Overall, cases involving compelled decryption are still relatively new and rare, with the first known one dating back to 2007 in a ruling a against the government.

However, one of the leading precedents governing contempt orders is 34 years old—and it never contemplated the forced decryption issue. The precedent from the Weiss case essentially says judges, when ruling in favor of a contempt charge, must find by "clear and convincing evidence" that somebody is purposely violating a court order. So in the case of modern a defendant who says they forgot the password, the judge must act as the jury to decide whether a suspect can be believed, experts tell Ars.

"It's a crapshoot to the extent that the accused has no guarantee as to the outcome, but if s/he truly forgot the passcode, the only option is to say so and hope the judge is sympathetic," Colorado defense lawyer Phil Dubois told Ars in an e-mail.

Dubois has firsthand experience with similar cases. In 2012, Dubois defended a bank-fraud suspect who was ordered to decrypt her hard drive. At the time, she said she "may" have forgotten the passcode. But this case never got to a contempt of court finding because the decryption order was mooted—authorities learned the password through her husband instead.

Liar, liar?

Today, at least one known person is in a US prison—for 20 months now and counting—based on a contempt of court order for refusing to obey a decryption order. That person is Francis Rawls, a now-fired Philadelphia cop who wouldn't unlock two FileVault encrypted drives (attached to an Apple Mac Pro) in connection to a child-porn investigation. The police say Rawls told them he forgot the codes. While Rawls has never testified in court that he could not remember them, a judge held Rawls in contempt in March 2017 on the belief that he was lying.
Among the court's reasoning, the appellate panel noted that Rawls "chose not to reveal them because of the devices' contents."

On the Fifth Amendment issue, the court of appeals found that Rawls' constitutional rights against being compelled to testify against oneself were not being breached. That's because the appeals court, like the police, agreed that the presence of child porn on Rawls' drives was a "foregone conclusion."

The Fifth Amendment, at its most basic level, protects suspects from being forced to disclose incriminating evidence. Federal authorities maintained that they already knew there was child porn on the drives, therefore Rawls' constitutional rights were not compromised, the court ruled.

"Forensic examination also disclosed that [Rawls] had downloaded thousands of files known by their 'hash' values to be child pornography. The files, however, were not on the Mac Pro, but instead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed," the court ruled (PDF).
Despite this "foregone conclusion," Rawls has not yet been charged with child-porn violations. He does, however, continue to idle away in prison.

Just this past week, on Thursday May 25, Rawls' counsel petitioned (PDF) the US 3rd Circuit Court of Appeals to reconsider the decision by a three-judge panel that upheld the contempt order and Rawls' indefinite detention.

"The panel likened such disclosure to an act of producing a tangible item known to be in one's physical possession, instead of a mental process culminating in the communication of personal knowledge," Federal Public Defender Keith Donoghue wrote. "This was error contravening Supreme Court precedent holding that a person may not be compelled to disclose the content of his own mind."

The paradox

This piecemeal of precedent represents the mixed results landscape Victor and Voigt now face this week. Mark Rumold, a staff attorney with the Electronic Frontier Foundation, told Ars the idea of being ordered to hand over a password is unconstitutional. And in his mind, getting someone to comply with such an order only adds insult to injury.

"It's one of the serious flaws with these compelled password entry cases: if someone legitimately can't remember, then they're being held in contempt for failing to comply with an impossible order," Rumold said in an e-mail.

Brett Max Kaufman, an attorney with the American Civil Liberties Union, told Ars the dispute basically boils down to a coin flip. "It basically comes down to a court's determination whether it's believable," he told Ars. McGregor Scott, the former US attorney for the Eastern District of California, seemed a little more optimistic. He told us that judges would consider "common sense things" to weigh the veracity of a suspect's claim to have forgotten a passcode.

"If I had a phone that I hadn’t used in years, and I made it a regular practice to change passwords, you can find credibility for somebody saying I don't remember the password," said Scott, now a private white-collar criminal defense attorney with the Orrick firm.
In the end, the judge must "determine whether the person is credible," Scott said. He added that a judge is less likely to believe somebody who recently unlocked their device, but where to draw that line in the sand is anybody's guess.

So, can it ever be known if somebody is telling the truth about a forgotten password? Victor's attorney has an answer, at least. "No reasonable person can remember their passcode when a year has passed. I don't remember what I had for breakfast yesterday," lawyer Zeljka Bozanic told Ars.

Conze, Voigt's attorney, had already likened the situation to a fishing expedition, and the attorney doesn't want to consider whether his client would willingly accept jail time for refusing to unlock her phone. "We will cross this road if we get there," Conze said.

Ultimately, in regards to whether decryption may be compelled, rulings in the lower courts are all over the map. That means the paradoxical situation facing Voigt and Victor is expected to become more front and center in the courts—especially as encryption becomes more consumer-friendly on mobile phones and as consumers become more vigilant in protecting themselves against hackers and government snooping.