In case of encrypted data, can't the US government legally force one to disclose passwords following a raid? In other words they might raid a company, they find encrypted hard drives so they ask for passwords. Then does revealing passwords fall under "self-incriminating" or not revealing them fall under "obstructing justice"?

My understanding is that in the US, passwords fall under the 5th amendment. Here's an example where a subpoena ordering the defendant to enter in a password was quashed: http://www.eff.org/files/Boucher.pdf

The Wikipedia article has more info on that case.

http://en.wikipedia.org/wiki/United_States_v._Boucher

In February of this year, the judge required him to provide unencrypted access to the drive.

A good read, thanks for posting.

In the US, it appears that you cannot be compelled to give up your password. Even if you could be, it is possible that the obstruction of justice charge would carry a lighter sentence than whatever is on the disk would get you.

(But of course, if you are at the point where your hardware is being seized, it's possible that the government already has enough evidence on you.)

Theoretically, a password is protected by the fifth amendment only in very limited circumstances, basically when the mere knowledge of it would be evidence against you. If your equipment is seized legally with a court issued warrant, you'd normally be expected to disclose it. However, if your defense is that your system was compromised and encrypted files were put there by an attacker, there is an issue of self-incrimination and fifth amendment protections may apply. It would then be up to the judge to rule on it.(corrections welcome, IANAL)

I wonder if stating that the password it's self is incriminating information would also allow it to fall under Fifth Amendment protection. AKA, the password is a sentence that contains incriminating information.

I it could be argued that pleading the fifth for every single question is allowed under the Fifth Amendment because what information you think might be incriminating is also incriminating information. AKA where on December 2, 1952 and you plead the fifth. But you are willing to say where you where on the December 1, 1952 and December 3, 1952.

This is a quick route to a contempt of court charge and the judge will let you spend some quality time with the folks in the local jail until you decide that being a smartass to someone who can send you directly to jail is a bad idea.

The password can be protected. The contents of what's protected by that password is not. So for instance, that you encrypted content with the password "ilikelittlechildren" can be protected. But that said content is thousands of instances of child pornography cannot be protected, and you can be required to (yourself) unencrypt the content even though you don't tell anyone your password.

The most correct answer in the U.S. is that the question of whether a defendant can be forced to give up his password is still undecided.

In the UK the government settled the question with a law making it a crime to withhold your password:

http://security.homeoffice.gov.uk/ripa/encryption/faqs/

The issue hasn't really come up in Canada. Some authorities have recommended a law similar to the UK's.