Why police should have access to suspects’ smartphones.
To paraphrase the words of retired U. S. Supreme Court justice John Paul Stevens in a 1988 dissent, “a person may be forced to surrender a key to a lockbox, but he cannot be compelled to reveal the combination to his wall safe.” It is a legal concept that has returned to the spotlight recently, with the Canadian Association of Chiefs of Police calling for the legal power to compel criminal suspects to disclose passwords to electronic devices. It is an inevitable response to increasingly sophisticated, publicly available data encryption, but — the apoplexy of self-righteous Internet libertarians notwithstanding — it is not an unacceptable nor unconstitutional expansion of police powers.
That the police chiefs’ would call for the power to compel passwords comes as no surprise. As the Federal Bureau of Investigation’s spat with Apple over unlocking the phone of the San Bernardino shooter showed, as data encryption advances and becomes more widely available, traditional police investigative tools are increasingly left behind. Sophisticated software could, until recently, be utilized by law enforcement to crack a device’s password. Advanced encryption of the type now used in the latest smartphones and operating systems, however, makes those devices essentially uncrackable and renders previously utilized technology obsolete
Regardless, several arguments may be made against the police chiefs’ proposal. “Self- incrimination” is the battle cry of opponents to the idea of forcing a suspect to reveal a password. Compared to the United States, however, Canada’s protections against self- incrimination are weak and, in any event, largely inapplicable in the context of unlocking electronic devices. One cannot “plead the fifth” if testifying in Canada, nor are police obliged — as the Supreme Court of Canada has ruled — to stop questioning a suspect who invokes his right to silence.
Those protections against testimonial self-incrimination are moot in terms of a suspect being com- pelled to reveal a device’s password. Practically speaking, if police are not directly authorized by legislation, the demand for the password would likely come in the form of a court- ordered warrant. Despite the claims of unconstitutionality such a request may trigger, “self-conscriptive” evidence has been upheld by the Supreme Court. Subject to legislative provisions, a suspect may be compelled to provide blood, saliva or tissue samples; forced, in essence, to turn over the evidence that may seal his fate. In that regard, turning over a password is no more egregious — or unconstitutional — than a DNA swab in regard to one’s charter rights.
The police chiefs’ resolution also raises significant privacy concerns. Cellphones and other portable electronics contains reams of one’s most private personal information. Indeed, the Supreme Court has recognized the significant pri- vacy interest that exists in portable electronic devices. Surely then, compelling a suspect to reveal his password — and consequently revealing huge swaths of his most intimate details — is a step too far in terms of police powers.
The difficulty comes, however, in moving away from technology neutral laws. In that regard, legislation must be driven by the types of information concerned, not the medium in which that data are contained. Whether one’s information is kept in a well-ordered home office or on a smartphone is irrelevant — the information stored in the latter does not deserve more protection simply owing to the size, portability or ease of access of its storage media.
It is not to say that the state should simply be given an unfettered right to compel passwords from suspects. Clear legislation is needed to govern the collection and use of passwords — and the subsequent information revealed on an electronic device — by police. While some statutes allow police to demand self-conscriptive evidence based on reasonable belief — such as compelling a breathalyzer test from a suspected drunk driver — other forms, such as DNA samples, almost always require a court order. Given the Supreme Court’s recognition of a heightened privacy interest in personal electronic devices, compelling a suspect to reveal a password only under court order would be an acceptable compromise. Stringent safeguards against data fishing expeditions or exceeding the scope of a warrant would also protect a suspect’s privacy interests once a password is revealed.
Just as important in providing clear authorization and guidelines to police is the need for technology neutral legislation. Laws that favour one medium over another will inevitably leave the criminal law in a permanent state of playing catch- up, given the rapid pace of technological advancement. If the government wishes to privilege certain types of information over others, that is fine. The media that contain that information must, however, be treated equally. Information contained in a diary, smartphone or filing cabinet cannot be privileged over the other simply based on the physical characteristics of how it is stored.
As technology advances, so, too, must the criminal law keep pace. It is ultimately unwise to create exceptions based on the characteristics of information storage media — a photograph is no less deserving of protection because it is stored in a photo album rather than a smartphone.
Clear legislation that allows the court-ordered compelling of a password can achieve an acceptable balance between the legitimate policing interests of the state, and the privacy interests and constitutional rights of a criminal accused.
A PICTURE ON YOUR PHONE DOESN’T DESERVE MORE LEGAL PROTECTION THAN ONE IN AN ALBUM.