The government's quest for a password-protected bitcoin fortune from the Silk Road shutdown may lead to a Fifth Amendment battle over whether a constitutional right against self-incrimination can protect the website's founder from compulsion of data.

Last week, the government managed to link the illegal drug purchasing website, Silk Road, to the so-called mastermind Ross Ulbricht. The site allowed purchasers to retain anonymity by making illegal drug transactions using bitcoin currency. During the takeover, the FBI seized 26,000 bitcoins (which translates into about $3.2 million dollars) from the site's servers in the form of files comprised of long lists of "digital signatures of previous owners." Although it is unclear as of yet how the government managed to find the site's servers, some say that the FBI's hacking into Silk Road's servers is unprecedented, and that's it's unlikely that the FBI gained entrance by placing pressure on insider administrators. 

Now, the FBI is after Ulbrict's private bitcoin fortune allegedly worth over 600,000 bitcoins, or almost $74 million USD, all of which is contained in a password-protected digitial wallet. Although $74 million may seem like an impressive haul for the government, the millions are currently more of a theoretical treasure trove. That's because in order to truly seize the bitcoins, the FBI will need to obtain Ulbricht's bitcoin private key information. Bitcoin private key information essentially functions as a password into Ulbricht's secure bitcoin account. 

Bitcoins are an entirely online currency. The earliest method of acquiring the currency was through a mining process wherein computer software was used to crack complicated math problems. As bitcoins became more popular, the math equations necessarily became more difficult, causing the value of bitcoins to rise. Currently, 1 bitcoin is equal to $121.30 USD and can be purchased online.

A criminal complaint against Ulbricht has been filed in the Southern District of New York and charges him with narcotics trafficking, computer hacking, and money laundering. The complaint details the illegal nature of the Silk Road website and outlines the site's bitcoin payment system.

If Ulbricht, also known by his online alias "Dread Pirate Roberts," is unwilling to hand over his private key information and the government is unsuccessful in finding the information through other means, the prosecution may attempt to compel the private key information through a court order. In his defense, Ulbricht could claim a Fifth Amendment privilege, citing protection from handing over the key information as it may be self-incriminating.

United States courts have had few cases dealing with the issue of data decryption and the Fifth Amendment. The cases that do approach this issue deal with password blocks on laptops, computers, storage devices, and cell phones. The two main cases cited in this developing body of law -- United States v. Fricosu in the United States District Court for the District of Colorado and re Grand Jury Subpoena Duces Tecum Dated March 25, 2011 in the United States Court of Appeals for the Eleventh Circuit -- have reached opposite conclusions over whether the Fifth Amendment can protect an individual from producing password-protected files on some device.

The Fifth Amendment provides that "[n]o person ... shall be compelled in any criminal case to be a witness against himself." The privilege provided by the Fifth Amendment against self-incrimination should be broadly construed to ensure that a defendant is "not compelled to produce evidence which could be used against him as an accused in a criminal action." Maness v. Meyers, 419 U.S. 449 (1975). One key distinction courts analyze in data encryption cases is whether the compulsion of a password would act as a testimonial piece of evidence or merely production of a document or file; the former would be protected by the Fifth Amendment while the latter would not.

Courts pay close attention to whether production of the document would compel Fifth Amendment protection because "although the contents of a document may not be privileged, the act of producing the document may be." United States v. Doe, 465 U.S. 605 (1984). To fall within the field of the Fifth Amendment, an individual must show: (1) compulsion; (2) a testimonial communication or act, and (3) incrimination. See United States v. Ghidoni, 732 F.2d 814, 816 (11th Cir. 1984).

Breaking down these three elements further, a compulsion requires that an individual must be compelled to make some statement, usually by government coercion. A testimonial communication or act can be a potentially-incriminating statement, but sometimes, the very act of producing documents can be considered testimonial. Finally, to qualify as incrimination, an individual must have a real and appreciable fear that the right against self-incrimination will be violated; such a protective right is therefore necessary to protect the dignity of the individual by allowing that person to protect private information about himself or herself. 

Case Law Holding that Compulsion of Encrypted Data Constitutes a Fifth Amendment Violation

In United States v. Kirschner, the United States District Court for the Eastern District of Michigan held that a subpoena for a password violated the defendant's Fifth Amendment privilege. 823 F. Supp. 2d 665 (E.D. Mich. 2010). Kirschner was suspected of having child pornography on his computer and a subpoena was issued which called for Kirschner to testify to his computer password. The court, applying the test from Doe v. United States, held that testifying to a password is a testimonial act because Kirschner would be "forced to reveal his knowledge of facts relating him to the offense or from having to share his thoughts and beliefs with the government." 487 U.S. 201, 212 (1987). Because a testimonial act would violate Kirschner's Fifth Amendment rights, the court held that the defendant did not have to testify as to his password.

Similarly, in re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, the United States Court of Appeals for the Eleventh Circuit held that decryption and production of a hard drive's content triggered the protection of the Fifth Amendment because it would be testimonial. 670 F.3d 1335 (11th Cir. 2012). The defendant's Youtube.com account was being investigated for child pornography when a subpoena duces tecum was issued to produce the unencrypted contents of the defendant's laptops and external hard drives. The defendant called for protection under his Fifth Amendment privilege because "by decrypting the contents, he would be testifying that he . . . placed the contents on the hard drive . . . ." The court held that, while the files themselves were not testimonial, the act of producing the hidden portions of the hard drives had some testimonial quality, which triggered Fifth Amendment protections. 

Case Law Holding that Compulsion of Encrypted Data Does Not Constitute a Fifth Amendment Violation

In United States v. Fricosu, the United States District Court for the District of Colorado held, although somewhat in dicta, that the Fifth Amendment was not implicated by requiring production of the unencrypted content of the password-protected computer. 841 F. Supp. 2d 1232 (D. Colo. 2012). FBI agents seized 6 computers from Fricosu's home in Colorado during a search for bank fraud evidence and one of the computers was password protected; when the FBI agents sought a search warrant, Fricosu refused, citing the Fifth Amendment. Although the government offered the defendant immunity, the court nevertheless went through a Fifth Amendment and case law analysis detailing how Fricuso's Fifth Amendment rights were not violated by a compulsion of the data. The court held that the government met its burden of proof by showing that the password-protected computer belonged to the defendant through a preponderence of the evidence. The Electonic Frontier Foundation has criticized the court's opinion, saying it "dodged" the real Fifth Amendment issue here of typing in a password rather than handing over a decrypted version of the computer's information.

In re Boucher the United States District Court for the District of Vermont held that requiring the defendant to produce an unencrypted version of his laptop's Z drive did not constitute compelled testimonial communication and therefore did not violate the Fifth Amendment. 2:06-MJ-91, 2009 WL 424718 (D. Vt. Feb. 19, 2009). The defendant was directed to provide an unencrypted version of his password-protected Z drive under allegations that he knowingly transported child pornography from Canada. The court held that because the Customs agent at the Canadian border viewed the file names and content of some of the Z drive, the Government knew of the existence and location of the Z drive and therefore compelling the drive to be unencrypted would add "little or nothing to the sum total of the Government's information." Further, Boucher admitted to possession of the laptop and the Government did not need to use the act of production as evidence of authentication.

Looking Ahead for Ulbricht

Mastermind though Ulbricht may be, if he's like the rest of us, he's likely to have written down his private key password information somewhere. After all, the private keys can be "super long" and therefore difficult to memorize, at least initially. If this were to be the case, the FBI may locate the key password -- perhaps scribbled onto an old piece of notebook paper, stuffed under Ulbricht's mattress -- through good, old-fashioned detective work.

When and if the government manages to secure Ulbricht's private key information, they will be left with the question of what to do with the seized assets. Members of the U.S. Treasury Department met with the Bitcoin Foundation back in August of this year to discuss the currency in what was referred to as a "routine" meeting, but nothing formal seems to have come from the meeting just yet. Although the criminal complaint against Ulbricht stipulates that bitcoin is a legal tender, no official statements have been issued by the U.S. Treasury Department on the currency's legality.

A number of websites offer exchange rates from bitcoins to USD. One such website is Mt.Gox.com, which claims to be the "oldest and most established" bitcoin business on the market. Alternatively, some online stores accept bitcoin currency, while currently only a handful of brick-and-mortar shops and restaurants take bitcoins. EVR, an upscale Manhattan bar and restaurant, earned the title of the first New York City restaurant to accept the currency back in April of this year.

In a statement released last Friday, Ulbricht denied all charges that he was connected in any way to the running of Silk Road. It remains to be seen whether he will argue, successfully or otherwise, a Fifth Amendment privilege to protecting his bitcoin private key information.

Samantha Scheller is a 2L at the UNC School of Law.

(Photo courtesy of Flickr user Zach Copley, licensed under a CC BY-SA 2.0 license.)