In a 4-3 decision, the Pennsylvania Supreme Court ruled on Nov. 20, 2019 that a suspect could not be compelled to reveal his password to police.
A supervisory agent in computer forensics, Special Agent Braden Cook, testified that a portion of Appellant’s HP 700 Envy computer’s hard drive was encrypted with a program called TrueCrypt Version 7.1. Id. at 42. The entire hard drive of the computer was encrypted and “there was no data that could be read without opening the TrueCrypt volume.” Id. at 46. Agent Cook could only confirm that there was “Windows on the computer and the TrueCrypt,” and he had no knowledge of any specific files other than the operating system files. Id. at 50-51
. . .
A supervisory agent in computer forensics, Special Agent Braden Cook, testified that a portion of Appellant’s HP 700 Envy computer’s hard drive was encrypted with a program called TrueCrypt Version 7.1. Id. at 42. The entire hard drive of the computer was encrypted and “there was no data that could be read without opening the TrueCrypt volume.” Id. at 46. Agent Cook could only confirm that there was “Windows on the computer and the TrueCrypt,” and he had no knowledge of any specific files other than the operating system files. Id. at 50-51
. . .
Based upon these cases rendered by the United States Supreme Court regarding the scope of the Fifth Amendment, we conclude that compelling the disclosure of a password to a computer, that is, the act of production, is testimonial. Distilled to its essence, the revealing of a computer password is a verbal communication, not merely a physical act that would be nontestimonial in nature. There is no physical manifestation of a password, unlike a handwriting sample, blood draw, or a voice exemplar. As a passcode is necessarily memorized, one cannot reveal a passcode without revealing the contents of one’s mind. Indeed, a password to a computer is, by its nature, intentionally personalized and so unique as to accomplish its intended purpose ? keeping information contained therein confidential and insulated from discovery. Here, under United States Supreme Court precedent, we find that the Commonwealth is seeking the electronic equivalent to a combination to a wall safe — the passcode to unlock Appellant’s computer. The Commonwealth is seeking the password, not as an end, but as a pathway to the files being withheld. As such, the compelled production of the computer’s password demands the recall of the contents of Appellant’s mind, and the act of production carries with it the implied factual assertions that will be used to incriminate him. Thus, we hold that compelling Appellant to reveal a password to a computer is testimonial in nature.
. . .
We appreciate the significant and ever-increasing difficulties faced by law enforcement in light of rapidly changing technology, including encryption, to obtain evidence. However, unlike the documentary requests under the foregone conclusion rationale, or demands for physical evidence such as blood, or handwriting or voice exemplars, information in one’s mind to “unlock the safe” to potentially incriminating information does not easily fall within this exception.
Indeed, we conclude the compulsion of a password to a computer cannot fit within this exception. Thus, we hold that the compelled recollection of Appellant’s password is testimonial in nature, and, consequently, privileged under the Fifth Amendment to the United States Constitution. Furthermore, until the United States Supreme Court holds otherwise, we construe the foregone conclusion rationale to be one of limited application, and, consistent with its teachings in other decisions, believe the exception to be inapplicable to compel the disclosure of a defendant’s password to assist the Commonwealth in gaining access to a computer.