Court Rules Your Phone's Passcode Is Protected

A new ruling out of a Pennsylvania district court has found that forcing someone to reveal their smartphone passcode violates the Fifth Amendment to the Constitution.

“Pleading the Fifth” has become a regularly used idiom. It basically boils down to the right to not incriminate yourself, or as Jefferson and the Boys wrote:

“No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.”

In the case, Securities and Exchange Commission v. Bonan Huang, et al., Judge Mark Kearney ruled that because the defendants — “data analysts for Capital One” — were specifically told by their employer “to not keep records of their personal passcodes for security reasons,” the passcodes exist solely in their minds:

The passcodes do not belong to the corporation and are not in its records, so the defendants do not have to reveal them. In addition, the SEC could not prove “with ‘reasonable peculiarity’” that necessary documents — which, in this case, could be evidence of insider trading — exist behind the passcodes.

The ruling is at the district court level, so it’s legally possible to appeal up to the Supreme Court. Still, the ruling is another win for personal privacy — even if the guys in question had some shady dealings. It’s the same precedent from In re: Grand Jury Duces Tecum Dated March 25, 2011, which Kearney cites in his ruling. In In re, a child pornography suspect was not forced to decrypt his hard drive because it “would require the use of the contents of [the suspect]’s mind and could not be fairly characterized as a physical act that would be nontestimonial in nature.” Again, an allegedly very bad person doing heinous things was protected, but that’s America! Innocent until proven guilty.

As our personal lives become increasingly digitized, it is important that our physical rights follow us into cyberspace. The ruling from SEC v. Bonan Huang protects individuals — no matter how awful — and the personal content stored on their devices.