Hey Alexa . . . I Take the Fifth

According to recent studies conducted by the Pew Research Center, 81 percent of Americans own smartphones, 25 percent own smart speakers such as Amazon Echo or Google Home, and 21 percent use either a smart watch or fitness tracker. Moreover, the smart home technology market currently projects to grow annually by 12.8 percent, resulting in 57.2 percent household penetration by 2025. Other popular products include home security systems, lighting and thermostat controls, and a wide variety of smart appliances like refrigerators capable of ordering their own groceries. What all these various smart devices have in common is their ability to record and transmit precisely the sort of “intimate” information that the Kyllo Court afforded such strong protection. The difference now, however, is that it is not law enforcement but instead an overwhelming and growing majority of private individuals voluntarily choosing ubiquitous smart technology use with little regard for privacy concerns where either convenience or, increasingly, conformity to social norms is at stake. Through any of a seemingly infinite combination of devices and apps, personal technology can track and broadcast with infallible precision where you were, where you are, where you are going, what you ate, where you ate it, when you ate it, how you digested it, when you sleep, where you sleep, for how long you sleep, your overall sleep quality, and your heart and respiration rates while sleeping. These examples barely scratch the surveilled surface to which we may willingly surrender by merely pushing an unassuming power button. In many ways, we now live in a reality where Black Mirror and Big Brother more closely resemble science fact than science fiction. It should come as no surprise then that, where suspected criminal activity is involved, these same smart technologies intended to assist with and enhance daily life have a funny way of making it far more complicated instead.

The most obvious scenarios involve modern home security systems, designed and installed specifically for the purpose of ceaselessly watching and listening. Former New England Patriot Aaron Hernandez’s arrest and subsequent murder conviction relied significantly on footage retrieved from the state-of-the-art smart security technology he himself installed in his home at great expense, for example. Growing increasingly more prevalent meanwhile are situations involving the aforementioned smart speakers, devices that continuously monitor audio for activating “hot words” that prompt virtual assistant capabilities. Legal uncertainty emerges amid the background monitoring performed by these devices within the privacy of the home. In a series of cases spanning several states since 2015, authorities have sought and successfully obtained data from Amazon Echo devices for help solving murders when supported by either a warrant or court order. Though none of the recordings at issue in the more notable cases represented the smoking gun envisioned by law enforcement in the end, Amazon nevertheless reported receiving more than 3,000 requests from police for user data in the first half of 2020 and complied almost 2,000 times. That represented a 72 percent increase in requests from the same period in 2016, when Amazon first disclosed the data, and a 24 percent jump from the year prior.

More confounding are cases where the use of various and seemingly innocuous smart technologies by third parties proved pivotal with criminal investigations. In 2018, Anthony Aiello was arrested and charged in California for the murder of his stepdaughter based on data recorded by her FitBit, a wearable smart device for tracking steps, exercise, heartrate, weight, and other vital signs and statistics. When Mr. Aiello claimed to have paid the victim a quick visit to deliver pizza and biscotti, her FitBit instead showed a significant spike in her heartrate during the time of his visit followed by a sudden, rapid slowing and eventual stoppage prior to his departure. That same year, the decades-old, unsolved “Golden State Killer” investigation received a similar technological assist. Accused of committing 50 rapes and 12 murders between 1974 and 1986, the “Golden State Killer” eluded law enforcement for nearly 40 years. In the end, it was not traditional police work but rather a relative’s use of an Internet genealogy service that cracked the case. Wildly popular, a range of online genealogy companies like Ancestry and 23andMe offer services whereby submitting a simple DNA sample (generally saliva), consumers can trace their ancestral tree, discover geographic origins across the globe, and connect with lost or unknown relatives coincidentally utilizing the same service. Entering a DNA sample from one of the “Golden State Killer” crime scenes into such a database and subsequently establishing familial relations among other database users enabled authorities to finally bring Joseph James DeAngelo to justice.

Fittingly so, the Supreme Court soon after encountered one of its first cases involving smart technology in Carpenter v. United States, 138 S. Ct. 2206 (2018). At issue was the government’s use of the far more basic manufacturer-installed “location services” feature on the defendant’s smartphone to track his whereabouts and convict him of a series of armed robberies. In another 5-4 decision, the Court held that authorities obtaining access to “location services” and other cellular data constituted a “search” requiring a warrant, recognizing that technology “has afforded law enforcement a powerful new tool to carry out its important responsibilities. At the same time, this tool risks Government encroachment of the sort the Framers [of the US Constitution], after consulting the lessons of history, drafted the Fourth Amendment to prevent.”

When relying on the Supreme Court’s ruling in Carpenter, examining lower courts’ procedural rulings in the sampling of cases involving more advanced smart technologies, and reviewing information disclosure policies of the often-implicated technological manufacturers and operators that more or less universally require a court order, it grows abundantly clear that the Fourth Amendment safeguards unwitting smart device usage far more fiercely than privacy-erosion alarmists give it credit for. Simply put, for the government to lawfully acquire an individual’s (and perhaps even a third party’s) smart data, some form of judicial review determining the existence of probable cause is required as it would be for any Fourth Amendment “search” not fitting within an established exception. This conclusion and the lively debate and discourse leading to it wholly ignore an equally important question, however. What happens when the smart data obtained are testimonial? Said differently, while requiring a valid warrant or court order may alleviate any Fourth Amendment concerns, what protections exist for Fifth Amendment rights when smart technology is involved?

In Fisher v. United States, 425 U.S. 391 (1976), the Supreme Court recognized that “the Fifth Amendment does not independently proscribe the compelled production of every sort of incriminating evidence but applies only when the accused is compelled to make a testimonial communication that is incriminating.” Further, to be considered testimonial, “an accused’s communication must itself, explicitly or implicitly, relate a factual assertion or disclose information. . . .” While the various data recorded by smart devices seemingly fit this standard, lower courts have, thus far, struggled with making this determination throughout an ongoing series of contrasting rulings. In fact, in attempting to reconcile smart device data with the Fifth Amendment protection against self-incrimination, none of the cases even considers the proverbial treasure trove of highly personal information at stake. Instead, they focus squarely on the testimonial nature of biometrics, such as fingerprint or facial recognition features, required for accessing many smart devices’ data altogether.

Two conflicting orders, both issued in the US District Court for the Northern District of California within nine months of one another, best demonstrate the confusion surrounding potentially testimonial biometric information for accessing smart devices. In In re Search of a Residence in Aptos, California, 2018 WL 1400401 (N.D. Cal. Mar. 20, 2018), the court’s interpretation of Fisher permitted government compulsion of the defendant’s passwords where his knowledge of the passwords, as distinguished from the device’s contents, was a “foregone conclusion.” Subsequently, in In re Search of a Residence in Oakland, California, 2019 WL 176937 (N.D. Cal. Jan. 10, 2019), the court found government efforts to compel the defendant’s biometrics impermissible by recognizing their ability to unlock massive digital databases of information compared to the narrow use of fingerprints and DNA for placing someone at a crime scene and declared them unequivocally testimonial. Dismissing the “foregone conclusion” principle applied only months earlier, the court stated it simply did not apply because authorities could not reasonably anticipate the scope of information stored on a digital device.

From a practitioner standpoint, these divergent outcomes curiously depart from accepted Fifth Amendment principles and confuse the expected legal arguments that typically ensue from them. Here, it is the biometrics, interestingly, that the court found testimonial but not the passwords that required actual disclosure by the defendant. Biometrics, generally, are physical or behavioral human characteristics that can be used to digitally identify a person to grant access to technological devices or data systems. Common examples include the above-referenced fingerprints and facial recognition as well as DNA samples, iris recognition, and retinal scans. Oddly, under traditional Fifth Amendment jurisprudence, these examples represent precisely the sort of nontestimonial evidence held readily obtainable by the government. Fingerprinting of a defendant is more or less compulsory upon arrest, DNA swabbing is firmly established as being constitutionally permitted, and facial recognition is as simple as viewing a defendant’s face absent any physical obstruction. Yet, where smart technology is involved, the underlying nature of the same exact evidence is somehow fundamentally altered and rendered testimonial as per the US District Court for the Northern District of California, whereas the compelled affirmative production of a more standard passcode or password is not. Providing a passcode or password, after all, actually requires potentially incriminating verbal or written communication on the defendant’s part.

Any logical reconciling of this illogical premise when either prosecuting or representing a criminal defendant requires a deeper dive into the Supreme Court’s ruling in Riley v. California, 573 U.S. 373 (2014). A Fourth Amendment case, Riley involved a search incident to a lawful arrest of the data stored on the arrestee’s smartphone. Consistent with other Fourth Amendment smart technology rulings, this search of digital information was held unconstitutional absent a warrant. While the decision omits any discussion of the Fifth Amendment, its examination of data contained within modern technological devices is nevertheless instructive. Writing for the majority, Chief Justice John Roberts noted that “[m]odern cell phones are not just another technological convenience. With all they contain and all they may reveal, they hold for many Americans ‘the privacies of life’. The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought.” In other words, the data recorded by these devices currently provides a proverbial window into an individual’s consciousness, and perhaps subconsciousness, well beyond the bounds of any mere verbal or written communication and firmly within the realm of testimonial. Given Riley’s dicta, the inquiry then hinges ultimately on a court’s interpretation of the “foregone conclusion doctrine.” Derived from Fisher and put simply, the foregone conclusion doctrine permits compelled testimonial acts when the testimonial aspect of the compelled act “adds little or nothing to the sum total of the Government’s information.” Following In re Search of a Residence in Aptos, California, prosecutors should argue that the foregone conclusion doctrine applies narrowly to only the precise information provided by a defendant and, therefore, permits constitutional compulsion of a mere passcode or password. On the other hand, criminal defense attorneys, in line with In re Search of a Residence in Oakland, California, should advocate for an interpretation of the foregone conclusion doctrine encompassing not simply the compelled information itself but also any additional testimonial information that could be accessed once it is provided and, thus, rendering it inapplicable given the broad and unpredictable range of digital data stored on smart devices.

As the US District Court for the Northern District of California and others across the country grapple with the testimonial nature of biometric passcodes and proper application of the foregone conclusion exception from Fisher without any guidance from the Supreme Court, more profound questions continue lying in wait. Of course, there is the testimonial nature of a smart device’s contents themselves. When utilized in a criminal investigator’s perfect world, an unknowing statement casually recorded by a “resting” Alexa, an elevated heartrate passively tracked by an always-worn FitBit, a curious frolic silently charted by any of many location-sharing apps activated by default, and even good-natured participation with family in 23andMe services over the holidays could all become the functional equivalent of an intense interrogation successfully obtaining a confession. This thought then leads to another unanswered question. By just using many smart technologies, can individuals waive their Fifth Amendment right altogether? Fully indoctrinated if not fully cautious of smart technology’s capabilities, do certain actions like confessing in the presence of a smart speaker constitute an implied waiver? The answers remain as unknown as the legal tensions that unimaginable technologies of the future will bring in the decades to come. Until then, or when the Supreme Court decides a landmark case, the only thing to do is stay “connected,” while exercising caution, that is.