United States v. Doe (In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011)

• Decision Date: 23 February 2012
• Docket Number: Nos. 11–12268,11–15421.,s. 11–12268
• Citation: 23 Fla. L. Weekly Fed. C 795,670 F.3d 1335
• Parties: In re GRAND JURY SUBPOENA DUCES TECUM DATED MARCH 25, 2011.United States of America, Plaintiff–Appellee, v. John Doe, Defendant–Appellant.
• Court: U.S. Court of Appeals — Eleventh Circuit

23 Fla. L. Weekly Fed. C 795

670 F.3d 1335

In re GRAND JURY SUBPOENA DUCES TECUM DATED MARCH 25, 2011.United States of America, Plaintiff–Appellee,

v.John Doe, Defendant–Appellant.

Nos. 11–12268

11–15421.

United States Court of Appeals, Eleventh Circuit.

Feb. 23, 2012.

Robert G. Davies, David Lance Goldberg, Nancy J. Hess, Pamela C. Marsh, Pensacola, FL, Josh Goldfoot, U.S. Dept. of Justice Computer Crime & IP Section, James Anthony Silver, U.S. Dept. of Justice–Crim. Div., Washington, DC, for Plaintiff–Appellee.

Chet Kaufman, Randolph P. Murrell, Fed. Pub. Defenders, Tallahassee, FL, Randall Lockhart, Fed. Pub. Def., Pensacola, FL, for Defendant–Appellant.

Hanni Fakhoury, Marcia Hofmann, Electronic Frontier Found., San Francisco, CA, for Electronic Frontier Found., Amicus Curiae.Appeals from the United States District Court for the Northern District of Florida.

Before TJOFLAT, MARTIN and HILL, Circuit Judges.

TJOFLAT, Circuit Judge:

This is an appeal of a judgment of civil contempt. On April 7, 2011, John Doe was served with a subpoena duces tecum requiring him to appear before a Northern District of Florida grand jury and produce the unencrypted contents located on the hard drives of Doe's laptop computers and five external hard drives.¹ Doe informed the United States Attorney for the Northern District of Florida that, when he appeared before the grand jury, he would invoke his Fifth Amendment privilege against self-incrimination and refuse to comply with the subpoena.² Because the Government considered Doe's compliance with the subpoena necessary to the public interest, the Attorney General, exercising his authority under 18 U.S.C. § 6003,³ authorized the U.S. Attorney to apply to the district court, pursuant to 18 U.S.C. §§ 6002⁴ and 6003, for an order that would grant Doe immunity and require him to respond to the subpoena.

On April 19, 2011, the U.S. Attorney and Doe appeared before the district court.⁵ The U.S. Attorney requested that the court grant Doe immunity limited to “the use [of Doe's] act of production of the unencrypted contents” of the hard drives. That is, Doe's immunity would not extend to the Government's derivative use of contents of the drives as evidence against him in a criminal prosecution. The court accepted the U.S. Attorney's position regarding the scope of the immunity to give Doe and granted the requested order. The order “convey[ed] immunity for the act of production of the unencrypted drives, but [did] not convey immunity regarding the United States' [derivative] use” of the decrypted contents of the drives.

After the hearing adjourned, Doe appeared before the grand jury and refused to decrypt the hard drives. The U.S. Attorney immediately moved the district court for an order requiring Doe to show cause why Doe should not be held in civil contempt. The court issued the requested order, requiring Doe to show cause for his refusal to decrypt the hard drives. Doe, responding, explained that he invoked his Fifth Amendment privilege against self-incrimination because the Government's use of the decrypted contents of the hard drives would constitute derivative use of his immunized testimony, use not protected by the district court's grant of immunity.⁶ An alternative reason Doe gave as to why the court should not hold him in contempt was his inability to decrypt the drives. The court rejected Doe's alternative explanations, adjudged him in contempt of court, and ordered him incarcerated. Doe now appeals the court's judgment.

We review the district court's findings of relevant facts for clear error, see United States v. Doe, 465 U.S. 605, 613–14, 104 S.Ct. 1237, 1243, 79 L.Ed.2d 552 (1984) (stating that the Court would not overturn findings of fact unless they had no support in the record), and review the district court's application of the Fifth Amendment privilege de novo, United States v. Hernandez, 141 F.3d 1042, 1049 (11th Cir.1998). Part I briefly reviews the relevant factual background and procedural history of the case. Part II discusses the merits of Doe's Fifth Amendment claim. Part III upholds Doe's invocation of his Fifth Amendment right.⁷

I.

This case began with the lawful seizure of seven pieces of digital media during the course of a child pornography investigation. In March 2010, law enforcement officials began an investigation of an individual using the YouTube.com account [redacted] whom the Government suspected of sharing explicit materials involving underage girls. During the course of their investigation, officers from the Santa Rosa County (Florida) Sheriff's office obtained several internet protocol (“IP”) addresses from which [redacted] accessed the internet. Three of these IP addresses were then traced to hotels. Following a review of the hotels' guest registries, law enforcement officers found that the sole common hotel registrant during the relevant times was Doe.

In October 2010, law enforcement officers tracked Doe to a hotel in California and applied for a warrant to search his room. A judge granted the application and issued a search warrant, allowing the officers to seize all digital media, as well as any encryption devices or codes necessary to access such media. The officers seized seven pieces of digital media: two laptops—a 320–gigabyte (“GB”) Dell Studio laptop and a 160–GB laptop; and five external hard drives—a 1.5–terabyte (“TB”) Seagate external drive, a 1–TB Western Digital MyPassport external drive, a 1–TB external drive, a 500–GB Western Digital external drive, a 500–GB SimpleTech external drive.⁸ Federal Bureau of Investigation forensic examiners analyzed the digital media, but were unable to access certain portions of the hard drives.

The grand jury subpoena issued because the forensic examiners were unable to view the encrypted portions of the drives. The subpoena required Doe to produce the “unencrypted contents” of the digital media, and “any and all containers or folders thereon.” Doe informed the U.S. Attorney that compliance with the subpoena would violate his Fifth Amendment privilege against self-incrimination. It was in an attempt to avoid this constitutional issue that the U.S. Attorney requested that the district court grant Doe the limited act-of-production immunity.

Thus, the focus of the motion to show cause hearing on April 19, 2011, was, in essence, whether the Fifth Amendment would bar the Government from establishing before a petit jury—say, if Doe were indicted for possession of child pornography in violation of 18 U.S.C. § 2252—that the decrypted contents (child pornography) were Doe's because (1) the hard drives belonged to Doe (which was not in dispute), and (2) contained child pornography. Doe contended that the establishment of point (2) would constitute the derivative use of his immunized grand jury testimony. That is, by decrypting the contents, he would be testifying that he, as opposed to some other person, placed the contents on the hard drive, encrypted the contents, and could retrieve and examine them whenever he wished.⁹

The critical testimony during the show cause hearing came from forensic examiner Timothy McCrohan. McCrohan testified that he cloned over 5 TB of data from the digital media devices—an “enormous amount of data.” He also testified that over a million pieces of data could be stored on a typical 320–GB hard drive. McCrohan continued, “So when you're at five terabytes you're looking at 20 times that size. It could be in the multi-millions.” Notably, McCrohan testified that the forensic examination indicated that the hard drives had been encrypted with a software program called “TrueCrypt.” Essentially, TrueCrypt can make certain data inaccessible; in doing so, the program can create partitions within a hard drive so that even if one part of the hard drive is accessed, other parts of the hard drive remain secured. Because the hard drive was encrypted, the forensic examiners were unable to recover any data.¹⁰ Although they were unable to find any files, McCrohan testified that they believed that data existed on the still-encrypted parts of the hard drive. In support of this belief, the Government introduced an exhibit with nonsensical characters and numbers, which it argued revealed the encrypted form of data that it seeks.

In his testimony on cross-examination by Doe, however, McCrohan conceded that, although encrypted, it was possible that the hard drives contain nothing. Doe asked McCrohan, “So if a forensic examiner were to look at an external hard drive and just see encryption, does the possibility exist that there actually is nothing on there other than encryption? In other words, if the volume was mounted, all you would see is blank. Does that possibility exist?” McCrohan responded: “Well, you would see random characters, but you wouldn't know necessarily whether it was blank.”¹¹

The forensic analysis was able to identify two passwords, neither of which revealed any information when entered. When pressed by Doe to explain why investigators believed something may be hidden, McCrohan replied, “The scope of my examination didn't go that far.” In response to further prodding, “What makes you think that there are still portions that have data[?],” McCrohan responded, “We couldn't get into them, so we can't make that call.” Finally, when asked whether “random data is just random data,” McCrohan concluded that “anything is possible.” At the conclusion of the hearing, the district court held Doe in contempt and committed him to the custody of the United States Marshal.¹²

II.

We turn now to the merits of Doe's appeal. In compelling Doe to produce the unencrypted contents of the hard drives and then in holding him in contempt for failing to do so, the district court concluded that the Government's use of the unencrypted contents in a prosecution against Doe would not constitute the derivative use of compelled testimony protected by the Fifth Amendment privilege against...