Keep Your Government & Corporate Hands Off My Passwords

You may have heard that Apple has implemented a robust new security feature with its latest mobile operating system: the phone's data is now encrypted by default, and Apple retains no record of your passcode or other "backdoor." As a result, Apple cannot "unlock" your phone, even if it has physical possession of the phone, and even if it is served with a lawful warrant or subpoena. It's simply "technically infeasible" for Apple to comply. Law enforcement might as well send the iPhone to Google, which probably is just as likely to have a record of your iPhone passcode somewhere in its vast treasure trove of data about you.

There's nothing nefarious or even new about this, as this has been the standard for encrypted hard drives since forever. I'm writing this post on a 2010 MacBook Pro (with upgraded RAM and SSD drive, I might add!), and its hard drive is encrypted using Apple's standard File Vault utility. Apple offers to keep a copy of your recovery key, but it's not required. If you care about having a truly secure computer, especially as a lawyer, you decline the offer like I did.

But because lots of people have iPhones, important people have noticed the change in Apple's default iPhone security settings, and some of them are freaking out. Most notably, Professor Orin Kerr—a well-respected and influential 4th Amendment scholar who blogs at Volokh Conspiracy—called Apple's move a "dangerous game" that would "thwart" lawful warrants and probably lead to reactionary legislation far worse for privacy interests and civil liberties than simply letting Apple store a copy of your passcode.

I had a lot of thoughts in response to Prof. Kerr's post, but I'm a terrible blogger so the vast majority of them have already been ably expressed by others:

• Julian Sanchez detailed all the ways in which Apple's move is nothing new, so presents no shift in the overall "equilibrium" between privacy and law enforcement interests, and certainly is not in derogation of the public interest.
• Matthew Green at Slate did the same, pointing out in particular how any ability we give the US government can be used equally by less friendly governments.
• Windypundit explained how any backdoor Apple can exploit for the government is a backdoor bad guys can exploit. 
• Kerr himself has admirably walked back from his original overreaction ("very troubling") to a more scholarly investigatory mode ("need more information to decide" and "where do you draw the line?").

I recommend you read all these responses. But there are a few things I think have been left unsaid.

Kerr's Sense of "Public Interest" is ... Very Troubling

Kerr's original reaction was based his inability to imagine how Apple's change (encryption by default plus no backdoor) could possibly be in the "public interest." This only reveals either his impoverished imagination or his perverted sense of the "public interest." Others (above) have adequately exposed his lack of imagination, but the deeper problem, I think, is that his sense of the public interest essentially boils down to "law enforcement interests." The fact that Apple's change will make tens of millions of Americans more secure in their papers, effects, documents, photos, etc., apparently doesn't register for Kerr as something that could possibly count as in the public interest. That's really weird. Maybe this is a cheap shot, but Kerr's mindset makes it hard for me to imagine how the 4th Amendment's warrant requirement would meet his definition of the "public interest" if it were up for debate today.

Indeed, Kerr's initial response to Apple's move was suspicion because he thinks anything that makes warrants—the "gold standard" of privacy protection—less effective is presumed illegitimate. Apple's move therefore could not possibly be in the "public interest" because it would make it harder for law enforcement and counter-terrorist officials to crack cases, and Apple's old way already protected people from government snooping without a warrant.

But the existence of the 4th Amendment warrant requirement proves that there is indeed a "public interest" in respecting people's privacy: making millions and millions of Americans more secure in their possessions adds up to an almost insurmountable public interest. Warrants are the minimum constitutional requirement for an invasion of privacy.  It does not follow that there is no freestanding public interest in allowing people to maximize the security of their own possessions. 

Consider, for example, a law that imposed criminal penalties for the destruction of any electronic documents. From Kerr's perspective, this would seem to be obviously beneficial to the public interest. After all, allowing people to destroy documents makes it inevitably less likely that future crimes will be solved. And all of these documents would be protected from government snooping without a valid warrant, and nowadays there's no practical limitation to the number of documents that a person can store so there's no legitimate reason to destroy an electronic document.

Perhaps there's some basis for finding such a law unconstitutional, but my belief is that most people confronted with such a proposal would recoil in terror at such an intrusion on their privacy and autonomy. Such a law, which would decrease the "private interests" of millions, has a huge bar to clear to be considered in the "public interest" overall because for the most part the public interest is just the sum of private interests. And I think this analysis applies almost directly to the question of any policy to make mobile phones less secure than is technically feasible (which is what Kerr's conception of the public interest would require).

If Backdoors are in the Public Interest, Why Require Private Companies to Possess Them?

Now let's consider what would seem to be the natural response if you accept Kerr's premise that Apple's move is in derogation of the public interest: legislation to fix it. That's how we usually advance public interests. He proposes a simple amendment to a 90s law that essentially required cell-phone makers to let law enforcement tap them. Kerr thinks we'll see a movement to change that law just to require smartphone manufacturers to keep a backdoor or a copy of your decryption key so they can crack open a phone's data if served with a lawful warrant.

But even if Kerr is right that it's in the public interest for law enforcement to have this capability (he's not, of course), it's unclear to me why the answer is that people should be forced by government mandate to trust private, profit-maximizing companies with the their secrets. I'm aware of no analogous legislation, and I think it would be quite radical.

Instead, if we really think it's in the public interest for all smartphones to be crackable by government, any "key escrow" should be in public hands. In other words, the legislation should require smartphone passwords to be registered with the FBI or some other government agency. Maybe event the Supreme Court. Or maybe the legislation could require mobile operating systems to have a backdoor that only the government itself is allowed to access. The same rules would apply: e.g., law enforcement could only access this publicly held database of passwords with a lawful warrant.

Now, the black helicopter brigade will scream and moan—"Are you crazy!? Trusting the government with out secrets??" But this is a modest proposal. Would you rather trust a private corporation like Apple, or the public-spirited civil servants in the good ole United States government? 

And of course it would be made a serious crime for anyone to access this data without a warrant or for any improper purpose. To some extent we have no choice to trust the people in power, and wouldn't we rather this information be in the hands of public servants rather than private corporations, if we're going to force it to be in someone's hands? This would also alleviate the concerns about bad-guy foreign governments being able to serve warrants on Apple; they'd have no rights to the information held secure by Uncle Sam in its Fort Know bunker.

Obviously, I'm trying to illustrate the absurdity of the proposed legislation. It strikes me as absurd to legislate that people register their passwords with the government. But it's obviously more absurd to require that they register their passwords with private companies. Isn't it?

When the Girlfriend Consents Too Much

Usually it is a good thing when your girlfriend consents. But there are exceptions. One of those exceptions is when the girlfriend consents to a search of your house and computer after she's called the cops because she found child pornography on your computer.

That was the situation under review by the Wisconsin Supreme Court in State v. Sobczak. The specific issue was whether the defendant's girlfriend of three months had authority to consent to the warrantless search of the defendant's computer. She had been using the computer, apparently with the defendant's consent, while she was staying the weekend at his parents' house. But when the defendant went off to work, she went clicking around, found videos of child pornography, and called the cops. I think they broke up.

The court found that the girlfriend did possess the necessary authority to consent to the search. Professor Orin Kerr thinks this is the right result:

[O]vernight guests have a “measure of control of the premises” when “the host is away.” Although this passage is hardly free from ambiguity — a “measure of control” isn’t clear about how much of a measure it confers — I would think that the most basic measure of “control” of a house is the ability to invite someone to enter the common areas of the home. If I’m right about that, Podella was exercising that right by allowing the officer to enter the common area of the home when Sobczak was away. Granted, she did so in one of those “unlikely” circumstances in which the guest found evidence of the homeowner’s crime, and the homeowner would not want the guest to invite in the cops. Olson indicates that if the homeowner is present and objects, the homeowner’s veto controls. But the homeowner was not present to object in this case, so I don’t think that conflict of interest matters.

Chief Justice Abrahamson dissented. One of her disagreements with the majority was that it relied on the characterization of the houseguest as the defendant's "girlfriend," and the evidence didn't necessarily support the conclusion that they were so initimately involved. Instead, the record was that they met online, had been dating for three months, and that she'd accepted his invitation to spend the weekend at his parents' house while they were away. Then, in an apparent swipe at the majority, the Chief Justice says,

The majority apparently assumes that a 22-year-old man is having a romantic, intimate relationship with a 20-year-old woman whom he invites over for the weekend while his parents are away.

What do you think, Mr. Gillette: did the majority make a reasonable inference?

Cook County to begin taking and storing DNA samples from innocent people

Following yesterday's Supreme Court opinion in Maryland v. King, in which the Court approved a Maryland law allowing the state to take DNA samples from all people accused of certain serious crimes, the Cook County sheriff's office announced today that it would start doing the same thing:

With the U.S. Supreme Court clearing the way for police to collect DNA from suspects in serious crimes, the Cook County sheriff's office says it will begin taking samples next month from jail inmates charged with murder, home invasion and certain sexual offenses. 

An Illinois law that took effect early last year allowed law enforcement officials throughout the state to take that action, but Cook County authorities decided to hold off until the Supreme Court weighed in on the issue.

As the Tribune article notes, the existing law already required DNA samples be taken from everyone convicted of serious crimes. No one disputes that this is appropriate and constitutional. But the new law allows DNA samples to be taken from everyone even accused of serious crimes, and that's what Cook County is going to start doing.

So the only practical effect of this new law, as far as I can tell, is that the DNA database will grow to include samples from people who were accused of serious crimes but never convicted. In other words, innocent people.

Nonetheless, Professors Akhil Reed Amar and Neal Katyal think King was a great decision because it passes the true test of the Fourth Amendment which is ... well, swabbing the DNA of innocent people for a government database is "not unreasonable":

On one hand, the swabbing itself is not particularly intrusive — no more so than a fingerprint or a lineup. Proper DNA testing can simultaneously exonerate innocent people who have been wrongly accused and find the bad guys — a true win-win situation — and in the process, this amazing new technology can powerfully deter crime. On the other hand, DNA testing without strict safeguards can reveal lots more personal information than a mere fingerprint. (For example, who is the suspect’s actual biological father or child?) If members of racial minorities are more likely to be wrongly arrested, they and their relatives will loom disproportionately large in the government’s DNA database.

Reasonable minds can differ on this. And therein lies the real genius of the Fourth Amendment. Contrary to Justice Scalia’s view, the framers did not answer the DNA question in 1791. Rather, the framers posed the question for us, their posterity. The distinction between criminal evidence-gathering and all sorts of other government programs and purposes is not an all-purpose touchstone or talisman. Rather, we must ponder how intrusive a given search policy is, how discriminatory it might be in application, how well justified and well administered it is, how democratically accountable it is, how it might bear upon human dignity, and so on.

The words of the Fourth Amendment mean exactly what they say. Warrantless searches are unconstitutional only if they are “unreasonable.” That rule, and no other, is the true “heart of the Fourth Amendment.”

I guess we'll just have to trust our eminent legislators to make the right calls on these profound questions of privacy and "human dignity" because, according to the professors, the constitution has nothing to say about them.

Breyer versus Scalia

The current Supreme Court has two intellectual giants: Stephen Breyer and Antonin Scalia. Justice Scalia is a powerful and public advocate for textualism and originalism as tools of constitutional interpretation. Justice Breyer is an equally ardent advocate for an opposing theory of constitutional interpretation that he calls "active liberty," which is essentially pragmatism.

A common criticism of Justice Scalia is that his theories of constitutional interpretation are just politics by other means. Because he is a conservative, the argument goes, it is no surprise that he espouses interpretative principles that require fealty to the ideas of long-dead, slave-holding white men. The common rejoinder is to point out areas where Justice Scalia's avowedly neutral principals lead him to results that are at odds with the policy preferences of modern conservatives. This happens, for example, in cases concerning questions of constitutional criminal procedure, particularly the constitutionality of various searches and seizures under the Fourth Amendment.

Justice Breyer's pragmatic approach to the constitution is open to the attack that it is just intellectual cover for imposing his policy preferences. This is Scalia's own criticism, in fact, and it stings. But Justice Breyer can also point to cases where his vote or his opinion did not comport with the policy preferences of modern liberals. Indeed, the Fourth Amendment is such an area. As Professor Orin Kerr points out, Breyer and Scalia have been on opposite sides of every contested Fourth Amendment case this term:

Justice Scalia has been on the defense side of every non-unanimous Fourth Amendment case this term: King (today’s case in which he wrote the dissent), Bailey (in which he joined the 6-3 majority), Jardines (in which he wrote the majority), and McNeely (in which he joined the Sotomayor plurality/majority opinion). In contrast, Justice Breyer has been on the government’s side in each of the Term’s non-unanimous Fourth Amendment cases: King (in which he joined Kennedy’s majority), Bailey (in which he wrote the dissent), Jardines (in which he joined the dissent) and McNeely (in which he joined the more government-friendly Roberts concurrence/dissent with Alito).

What gives?

One possibility is that these Fourth Amendment cases don't really trigger a liberal / conservative divide. Since Bill Clinton's move to the center in the 1990s, both Republican and Democrats have become "law and order" parties. The cops have won over everyone but the libertarians, and perhaps Scalia has libertarian policy preferences and Justice Breyer has the standard bipartisan, authoritarian policy preferences.

I don't think that's right, though. Libertarianism is not a consistent strain in Justice Scalia's stated worldview. For example, his views on morals legislation, particularly in the realm of gay rights, have no room whatsoever for libertarianism.

Professor Kerr has an interesting hypothesis:

What explains the trend? It might just be a coincidence. But I suspect some of it reflects the fact that a lot of the recent cases have involved Fourth Amendment balancing. Scalia dislikes balancing, while Breyer revels in it. Those different instincts may pull their votes in different directions. Also, defense counsel have realized that Justice Scalia is in play in Fourth Amendment cases if you can find him the kind of argument that he finds appealing. So we’re seeing more defense-side briefs targeting Scalia’s vote. But the problem is that Scalia and Breyer look at Fourth Amendment cases in exactly opposite ways. The kind of argument that appeals to Scalia can lose Breyer, and the kind of argument that appeals to Breyer can lose Scalia.

This gets right to the heart of the Scalia / Breyer divide. Scalia, as a textualist, wants to derive the results directly from the words of the law, so believes that those words should be interpreted to compel clear results. Breyer, the pragmatist, sees the words as a starting point for an analysis of consequences, among other things. The words have value—for to reach a result starkly contrary to them would be imprudent because it would bring the law into disrepute—and clarity has value, but what matters ultimately is providing guidance on how to reach the most just results in the most cases. Thus, balancing tests.

All of which is to say that I think both Justice Scalia and Justice Breyer are, fundamentally, intellectually honest judges who generally adhere to powerfully reasoned and coherent views of constitutional interpretation.

There He Goes Again ...

Once again, Justice Scalia is using his supposed "originalism" method of interpretation to achieve his preferred political ends. Today's example is Florida v. Jardines. The question in the case was whether a police dog sniffing at your door for evidence of narcotics constitutes a "search" under the Fourth Amendment. Writing for a five-justice majority, Justice Scalia held that it is indeed a search, and thus subject to the restrictions of the Fourth Amendment. The result in this specific case is that all evidence obtained pursuant to a subsequent search warrant will be suppressed, a conviction will be impossible, and a dope fiend will be loosed upon the streets. Just how Justice Scalia likes it.

I kid, of course. In fact, this is another in a long line of cases under the Fourth Amendment where Justice Scalia has arrived at conventionally "liberal" results. Perhaps Scalia is using these Fourth Amendment cases as cover for other cases, as part of long con that allows him to credibly use originalism as a crutch to support nakedly partisan results in First Amendment (corporate speech, establishment clause, etc), Second Amendment, federalism and other cases.

But I'd urge the cynics inclined to believe such claptrap to search within, instead, and consider how to counter the Justice Scalia who actually exists rather than the monster you've created in your heads.