Quel dommage —

Prosecutor: Suspect must give up his phone’s passcode in fatal hazing case

New Louisiana case deals with the ever-thorny question of forced decryption.

Extreme close-up of a finger unlocking a smartphone.

Prosecutors in Baton Rouge, Louisiana, have recently asked a local judge to force a Louisiana State University student implicated in a fatal hazing case to give up the passcode to his cell phone.

The case, State of Louisiana v. Sean-Paul Gott, involves one of the three defendants who has been charged with misdemeanor hazing. A fourth defendant, Matthew Naquin, has been charged with negligent homicide connected to the death of an 18-year-old LSU student named Max Gruver.

According to prosecutors, Gruver was pledging to join the fraternity Phi Delta Theta back in September 2017. He was invited to attend an event, code-named "Bible Study," that was, in fact, a drinking game where he would be quizzed on the fraternity's history.

He was part of a group of around 20 would-be fraternity members who had showed up at the frat house at about 9:30pm. They had been invited via the GroupMe messaging app and also on the phone by Gott.

According to The Advocate, a local newspaper, initiates only had a Solo cup of lemonade as a chaser for their "three- to five-second pulls" of a 190 proof grain alcohol known as Diesel.

Gruver seemingly did the worst at this game, taking "10-12 pulls," while most others only had three to four at the most.

He was set down on a fraternity couch after midnight. Hours later, around 9am, some fraternity members found Gruver and were not sure if he was still breathing. He was taken to the hospital and pronounced dead two hours later. Gott's phone was seized by local authorities in November, several weeks after the tragic incident.

The case is yet another example of an ongoing vexing legal quandary: can individuals be compelled to open up their own digital devices as part of a criminal investigation, or can they invoke their Fifth Amendment right, protecting themselves against self-incrimination?

What’s “testimonial” mean, anyway?

In the 18-page motion, which was filed last Friday, Assistant District Attorney Morgan Johnson argued that merely giving up a passcode was "not testimonial for purposes of the Fifth Amendment."

This is one of the well-known exceptions to the Fifth Amendment privilege: defendants can be compelled to produce samples (voiceprints, fingerprints, among others) to establish a link to a piece of evidence.

Johnson further argued that, even if the judge finds forced decryption to be in violation of the Fifth Amendment, "the foregone conclusion" exception applies. This legal doctrine posits that, if the government already knows the testimony that will be obtained, then the Fifth Amendment cannot be a shield.

As Ars has reported previously, forced decryption is far from settled law. As recently as August 21, a state appellate court in Indiana ruled that forcing a defendant to provide a passcode was, in fact, testimonial.

Meanwhile, a former Philadelphia police officer has remained in custody for nearly three years for refusing to decrypt a seized hard drive that authorities believe contains child pornography.

On the federal level, the 11th US Circuit Court of Appeals ruled in 2012 that forced decryption did constitute a violation of a defendant's Fifth Amendment rights. In 2013, a federal judge refused to force a Wisconsin child pornography suspect to decrypt his laptop.

Overall, cases involving decryption are still relatively new and rare. The first-known instance only dates back to 2007.

Invoking the Fifth

Like the courts, legal experts are not totally unified as to whether a passcode is testimonial.

"It is ultimately compelling Gott to provide a statement that will be used to prosecute him for this hazing charge," emailed Brian Owsley, a law professor at the University of North Texas and a former federal magistrate judge. "He had a choice and chose not to use fingerprint access because he wanted more security from government intrusion."

Owsley noted that it may be that the prosecution is seeking additional evidence to charge Gott with something beyond misdemeanor hazing—perhaps manslaughter or homicide.

"Regardless of how one feels about whether Gott should be charged as such, Gott should not be compelled to provide statements to build the case against him for some homicide charge," Owsley continued.

One of the ongoing cases that the Louisiana prosecutor relies on is United States v. Spencer, a child pornography case currently being adjudicated by the federal court in San Francisco. There, the defendant was ordered to decrypt three devices—after resisting for over three weeks, he finally complied.

However, in Spencer, the suspect was not forced to give up his passcode but was merely required to produce unencrypted versions of the seized devices. While this may seem like a distinction without a difference to most non-attorneys, the law sees things differently.

For now, few courts have agreed with the route that the Louisiana prosecutor is seeking: compelling someone to hand over a passcode.

"Legally, we generally frown upon forcing people to create records or to speak," said Dan Terzian, a Los Angeles-based attorney who has written on forced decryption before. "We're fine forcing them to produce stuff that we know already exists, but forcing them to talk about it is another matter."

Channel Ars Technica