Decryption of Seized Storage System Part II

After the original request by the government to order the defendant to hand over his passwords was denied the government made a second request for reconsideration of its application.  This request was based on the discovery of new information that was found when the FBI successfully decrypted one of the hard drives and found over 700,000 files, including child pornography and proof that the data was securely stored by the defendant.

The court granted the second request based on this new information.  The court was convinced that the new evidence found by the FBI was sufficient to establish that the government had reasonable cause (particularity) to believe additional illegal materials were in the possession of the defendant and under the sole control of the defendant.  The court stated that this new found evidence precluded the defendant from pleading the 5th Am.  The defendant was required to give the government the passwords.


FULL TEXT

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF WISCONSIN

In the Matter of

THE DECRYPTION OF A SEIZED

DATA STORAGE SYSTEM                                                Case No.: 13-M-449

 

ORDER GRANTING EX PARTE REQUEST FOR RECONSIDERATION OF

THE UNITED STATES’S APPLICATION UNDER THE ALL WRITS ACT

 

On April 3, 2013, the government applied under the All Writs Act, 28 U.S.C. § 1651, for an order compelling Jeffrey Feldman (“Feldman”) to “assist in the execution of a federal search warrant by providing federal law enforcement agents a decrypted version of the contents of his encrypted data storage system, previously seized and authorized for search under a federal search warrant.”  (App.at 12.)  On April 19, 2013, the court denied the application, concluding that “ordering Feldman to decrypt the storage devices would be in violation of his Fifth Amendment right against compelled self-incrimination.” (Decision and Order at 9.)

Specifically, the court determined that, under the “foregone conclusion” doctrine, although an act of production accompanied by implied factual assertions is “testimonial” in character, “the contents of the accused’s mind are not used against him where ‘the Government is in no way relying on the truth-telling of the [accused] to prove the existence of or his access to the documents.’” (Decision and Order at 4-6 (quoting United States v. Fisher, 425 U.S. 391, 411 (1976)).) Accordingly, the issue for this court boiled down to “whether the government ha[d] established its knowledge of the existence, possession, and authenticity of the [child pornography] files on the encrypted storage devices with ‘reasonable particularity’ such that Feldman’s decryption would ‘add[] little or nothing to the sum total of the Government’s information.’”  (Decision and Order at 7 (quoting Fisher, 425 U.S. at 411).)

Turning to the facts, the court held that, because “the government already kn[ew] the names of the files (which indicate child pornography) and their probable existence on the encrypted hard drives . . . , ‘[t]he existence and location of the [files] [were] a foregone conclusion.’” (Decision and Order at 8 (quoting Fisher, 425 U.S. at 411).) Nevertheless, the court held that it was not “reasonably clear, in the absence of compelled decryption, that Feldman actually ha[d] access to and control over the encrypted storage devices and, therefore, the files contained therein.”  (Decision and Order at 8 (footnote omitted).)

The court summarized the evidence of access/control as follows:

To be sure, the storage devices were all found in Feldman’s residence, where he has admittedly lived alone for the past 15 years. In addition, the unencrypted Dell computer, which showed connections to the encrypted storage devices, has a login screen with only one username, “Jeff.” Nevertheless, unlike in [two other cases where the courts ordered compelled decryption], here, Feldman has not admitted access and control.

(Decision and Order at 8-9.)  Accordingly, although it was a “close call,” I concluded that “Fifth Amendment protection [was] available to Feldman.” (Decision and Order at 9.)

On May 16, 2013, the government presented an ex parte request for reconsideration of its application, based on the discovery of new information.  In particular, government submitted a supplemental affidavit of FBI Special Agent Brett Banner (“Banner”), attesting to the following facts:

a..  Since April 19, 2013, the FBI has continued to devote substantial resources to attempting to decrypt Feldman’s storage system. Recently, the FBI was able to decrypt and access a small part of Feldman’s storage system, namely a single hard drive. Unfortunately, the vast majority of Feldman’s storage system remains encrypted.

b. The decrypted part of Feldman’s storage system contains an intricate electronic folder structure comprised of approximately 6,712 folders and subfolders. In these folders, agents found approximately 707,307 files. Among those files were numerous files which constitute child pornography.

c. In addition to numerous files of child pornography, the decrypted part of Feldman’s storage system contains detailed personal financial records and documents belonging to Feldman.

d. The decrypted part of Feldman’s storage system contains dozens of personal photographs of Feldman.

e. On May 9, 2013, [Banner] interviewed Todd Vance (hereinafter “Vance”), software development manager at Rockwell Automation, where Feldman works. Vance informed [Banner] that Feldman is a competent software developer who could have learned how to use encryption.

(Banner Supp. Aff. ¶ 2.)  The government contends that such facts, combined with those set forth in Banner’s original affidavit, render Feldman’s access to and control over the encrypted storage devices a “foregone conclusion.”

I agree. To repeat, the encrypted storage devices were found in Feldman’s residence, where he has admittedly lived alone for the past 15 years.  In addition, the unencrypted Dell computer, which showed connections to the encrypted storage devices, has a login screen with only one username, “Jeff.”

And most significantly, the recently decrypted portion of the storage system contains personal financial documents and photographs clearly belonging to Feldman, whom the court has already found to be capable of using encryption.  Such being the case, the government has now persuaded me that it is a “foregone conclusion” that Feldman has access to and control over the subject encrypted storage devices. Thus, under the current state of the law as more particularly discussed in the court’s April 19 Decision and Order, Fifth Amendment protection is no longer available to Feldman with respect to the

contents of the encrypted storage devices.  Accordingly, the government’s application for an order under the All Writs Act will be granted.

NOW  THEREFORE  IT  IS  ORDERED  that  the  government’s  ex  parte  request  for reconsideration of its application under the All Writs Act be and hereby is GRANTED;

IT IS FURTHER ORDERED that Feldman shall assist law enforcement agents in the

examination of seven Western Digital My Book hard drives (serial numbers WMC1T0358400, WMAZA0052668, WCAVY0868325, WCAZA0078782,  WCZAZA0078878, WCPAW0572841, WMC1T0276658) and two Maxtor Black Armor external hard drives (serial numbers 2HC04653 and 2HC0491M), acting in support of a search warrant issued separately by this court (Case No. 13-M-421);

IT IS FURTHER ORDERED that on or before June 4, 2013, Feldman shall do one of the following: (1) meet with law enforcement agents who currently maintain custody of the above-dentified storage devices and, without being observed by law enforcement agents or by counsel for the United States of America, enter the appropriate password or passwords into forensic copies of the above-identified storage devices so as to decrypt those devices and allow law enforcement personnel to continue their examination of the files contained therein; or (2) take any actions agreed upon with law enforcement agents and with counsel for the United States of America for the purpose of, and with the result of, making available for their examination a decrypted copy of the data that exists in each of the above-identified storage devices.

SO ORDERED this 21st day of May 2013, at Milwaukee, Wisconsin.

BY THE COURT:

s/ William E. Callahan, Jr. WILLIAM E. CALLAHAN, JR. United States Magistrate Judge

Source