The SEC, Company Smartphones and the Employee Passcodes

This post examines an opinion from a U.S. District Court Judge who sits in the U.S. District Court for the Eastern District of Pennsylvania:  Securities and Exchange Commission v. Bonan Huang, et al., 2015 WL 5611644 (2015). He begins the opinion by explaining that

Plaintiff Securities and Exchange Commission (‘SEC‘) seeks penalties, disgorgement and equitable relief arising from Defendants' trading on certain retail stocks based on allegedly material nonpublic information available to Defendants while they worked as data analysts for Capital One, a large credit card issuer bank (‘Bank‘).  Bank provided Defendants with smartphones but allowed them to create and set their own passcodes to access the smartphone. Bank's policies confirmed it owned the smartphone and any corporate documents on the smartphones. Consequently, Bank also requested its employees to not keep records of their personal passcodes for security reasons.

Upon leaving the Bank, Defendants returned their smartphones. The Bank provided the smartphones to the SEC. SEC cannot access the data on the smartphones as it does not know the passcode. SEC believes the smartphones contain unidentified Bank documents and issued an interrogatory or document request requiring Defendants ‘[i]dentify the Passcode for the [smartphone] that you used during the course of your employment‘. Defendants responded by invoking their Fifth Amendment right.

SEC now moves to compel production of Defendants' passcodes for their work-issued smartphones. . . . The SEC argues Defendants, as former Bank data analysts, are corporate custodians in possession of corporate records, and as such cannot assert their Fifth Amendment privilege in refusing to disclose their passcodes. . . . Defendants disagree they are corporate custodians and argue providing the passcodes to their phones is ‘testimonial‘ in nature and violates the Fifth Amendment.

Securities and Exchange Commission v. Bonan Huang, et al., supra.  You can, if you are interested, read more about the case in the news stories you can find here and here.

The references to the Fifth Amendment above are, of course, references to the privilege against self-incrimination, which is part of the protections provided by that Amendment to the U.S. Constitution.  As Wikipedia explains, the Fifth Amendment privilege protects

individuals from being forced to incriminate themselves. Incriminating oneself is defined as exposing oneself (or another person) to `an accusation or charge of crime,’ or as involving oneself (or another person) `in a criminal prosecution or the danger thereof.’ The privilege against compelled self-incrimination is defined as `the constitutional right of a person to refuse to answer questions or otherwise give testimony against himself or herself. . . .’ To `plead the Fifth’ is to refuse to answer any question because `the implications of the question, in the setting in which it is asked’ lead a claimant to possess a `reasonable cause to apprehend danger from a direct answer’, believing that `a responsive answer to the question or an explanation of why it cannot be answered might be dangerous because injurious disclosure could result.’

Wikipedia, supra (quoting Ohio v. Reiner, 532 U.S. 17 (2001) (emphasis in the original)).

The judge began his analysis of the parties’ arguments by explaining that the SEC

claims the ‘corporate records‘ cases govern our analysis. See Bellis v. U.S., 417 U.S. 85 (1974); Braswell v. U.S., 487 U.S. 99 (1988). In Bellis, a partner of a then dissolved law firm was subpoenaed to appear and testify before a grand jury and to bring all partnership records within his possession. Bellis v. U.S.,supra. The former partner appeared but refused to bring the records and asserted his Fifth Amendment privilege against compulsory self-incrimination. Bellis v. U.S., supra. The district court compelled the records' production and the court of appeals affirmed. Bellis v. U.S., supra. In affirming the district court's decision, the United States Supreme Court relied on the ‘collective entity‘ doctrine. Bellis v. U.S., supra. The doctrine prevents an individual from ‘rely[ing] upon the privilege to avoid producing records of a collective entity which are in his possession in a representative capacity, even if these records might incriminate him personally.‘  Bellis v. U.S.,

In Braswell, the Government subpoenaed books and records of two corporations, of which petitioner served as president and sole shareholder. Braswell v. U.S., supra. The petitioner refused to produce the documents asserting his Fifth Amendment privilege. Braswell v. U.S., supra. Citing the ‘collective entity‘ doctrine, the district court compelled production and the court of appeals affirmed. The Supreme Court affirmed after recounting the Court's Fifth Amendment jurisprudence in the context of corporate custodians. Braswell v. U.S., supra. The Court again reiterated a corporate custodian may not invoke the Fifth Amendment to avoid producing corporate records. Braswell v. U.S., supra.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

The judge then outlined the arguments the defendants made in response:

Defendants point to more recent cases, albeit none from the Supreme Court. In In re Grand Jury Duces Tecum Dates March 25, 2011, 670 F.3d 1335 (U.S. Court of Appeals for the 11th Circuit 2012), the Eleventh Circuit found a person accused of possessing child pornography may assert his Fifth Amendment privilege to avoid decrypting a hard drive. In In re Grand Jury Duces Tecum, supra. In reaching this conclusion, the court of appeals did not focus on whether the privilege applies to underlying documents but on whether the act of decryption and production were testimonial. In re Grand Jury Duces Tecum, supra. The court of appeals held decryption and production of the hard drives ‘would require the use of the contents of Doe's mind and could not be fairly characterized as a physical act that would be nontestimonial in nature.‘ In re Grand Jury Duces Tecum, supra. Thus, the decryption and production were testimonial and within the scope of the Fifth Amendment. In re Grand Jury Duces Tecum, supra.

Defendants also rely on U.S. v.Kirschner, 823 F. Supp. 2d 665 (U.S. District Court for the Eastern District of Michigan 2010) where the Government subpoenaed ‘all passwords‘ associated with defendant's computer. computer.  U.S. v. Kirschner, supra. The district court found revealing the password akin to providing the combination of a wall safe-an act deemed to be testimonial by the Supreme Court. U.S. v. Kirschner, supra (citing U.S.v. Hubbell, 530 U.S. 27 (2000)). Accordingly, the district court denied the Government's request to compel defendant produce his computer passcodes.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

The District Court Judge then found that,

as the SEC is not seeking business records but Defendants' personal thought processes, Defendants may properly invoke their Fifth Amendment right. SEC does not necessarily disagree with the courts' conclusions in In re Grand Jury and Kirschner arguing these cases involve child pornography and do not involve records of a third party entity, as here. The SEC focuses on the contents of the underlying documents contained on the device, claiming without any cited evidence, there are Bank records on the smartphones. We agree with the SEC as to Defendants' inability to preclude production of the Bank's documents.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

But the judge also went on to explain that

[h]owever, the SEC‘s reliance on the content of the documents is misplaced. In re Grand Jury persuades us to not look at the underlying documents to determine whether the act of producing a passcode is testimonial. In re Grand Jury Deces Tecum, supra (`Whether the drives’ contents are testimonial, 

however, is not the issue.‘). By relying on the corporate records cases of Bellis and Braswell, the SEC would have us focus on the nature of the documents allegedly contained in the phone rather than what they have requested, which are passcodes to the phones. Here, the SEC seeks to compel production of the passcodes which require intrusion into the knowledge of Defendants and no one else.  There is no evidence the Bank assigned Defendants passcodes to their phones or kept track of Defendants' passcodes. To the contrary, the Bank asked employees not to keep records of their passwords for safety reasons.

Absent waiver of the confidentiality attendant to this personal thought process, we cannot find the personal passcodes to the Bank's smartphones to be corporate records falling under the collective entity cases. We find Defendants' confidential passcodes are personal in nature and Defendants may properly invoke the Fifth Amendment privilege to avoid production of the passcodes.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

(In a footnote, the judge points out that

[t]o date, the SEC has not answered Defendants' request as to whether there is any ongoing criminal investigation. Defendants, presently residing in the Far East, are evaluating possible criminal prosecution for the same conduct.

Securities and Exchange Commission v. Bonan Huang, et al., supra.) 

He went on to note that the SEC

then argues the ‘foregone conclusion‘ doctrine applies to override Defendants' invocation of the Fifth Amendment privilege. An act of production is not testimonial if the proponent of production can show with ‘reasonable particularity,‘ ‘at the time it sought to compel the act of production, it already knew of the materials, thereby making any testimonial aspect a foregone conclusion.‘  In re Grand Jury Duces Tecum, supra. Thus, ‘where the location, existence, and authenticity of the purported evidence is known with reasonable particularity, the contents of the individual's mind are not used against him, and therefore no Fifth Amendment protection is available.‘  In re Grand Jury Duces Tecum, supra.

The SEC argues any incriminating testimonial aspect to Defendants' production of the their personal passcodes already is a foregone conclusion because it can show Defendants were the sole users and possessors of their respective work-issued phones. . . . The SEC's argument misses the mark in this regard. The court of appeals' reasoning in In re Grand Jury again persuades our analysis. There, the Court of Appeals for the Eleventh Circuit refused to apply the ‘foregone conclusion‘ doctrine because the Government could not meet its burden of showing with ‘reasonable particularity‘ what ‘if anything, was hidden behind the encrypted wall.‘ In re Grand Jury Duces Tecum, supra. While the Government need not ‘identify exactly‘ the underlying documents it seeks, ‘categorical requests for documents the Government anticipates are likely to exist simply will not suffice.‘ In re Grand Jury Duces Tecum, supra. There, the Government could not show the encrypted drives actually contained any files, nor could it show which files would if any prove to be useful. In re Grand Jury Duces Tecum, supra.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

He also explained that

[h]ere, the SEC proffers no evidence rising to a ‘reasonable particularity‘ any of the documents it alleges reside in the passcode protected phones. Instead, it argues only possession of the smartphones and Defendants were the sole users and possessors of their respective work-issued smartphones. SEC does not show the ‘existence‘ of any requested documents actually existing on the smartphones. Merely possessing the smartphones is insufficient if the SEC cannot show what is actually on the device. See In re Grand Jury Duces Tecum, supra. (‘In short, the Government physically possess the media devices, but it does not know what, if anything, is held on the device.‘).

Neither In re Boucher, 2009 WL 424718 (U.S. District Court for the District of Vermont 2009) nor U.S. v. Gavegnano, 305 F. App'x 954 (U.S. Court of Appeals for the 4th Circuit 2009), militate a different result. In Boucher, an ICE agent accessed the encrypted part of the drive at issue, viewed the contents of the drive, and ascertained it may contain images and videos of child pornography. In re Boucher, supra. Thus, the defendant providing access to the encrypted portion of the drive ‘add[ed] little or nothing‘ to the Government's information. In re Boucher, supra. Likewise, in Gavegnano, the Government could independently verify the defendant was the sole user and that he accessed child pornography websites because the computer was monitored for all activity. U.S. v. Gavegnano, supra.

Securities and Exchange Commission v. Bonan Huang, et al., supra.  He also noted that

the SEC has no evidence any documents it seeks are actually located on the work-issued smartphones, or that they exist at all. Thus, the foregone conclusion doctrine is not applicable.

Securities and Exchange Commission v. Bonan Huang, et al., supra. 

The judge therefore held that

[s]ince the passcodes to Defendants' work-issued smartphones are not corporate records, the act of producing their personal passcodes is testimonial in nature and Defendants properly invoke their Fifth Amendment privilege. Additionally, the foregone conclusion doctrine does not apply as the SEC cannot show with ‘reasonable particularity‘ the existence or location of the documents it seeks. Accordingly, the SEC's motion to compel the passcodes is denied.

Securities and Exchange Commission v. Bonan Huang, et al., supra.