Open sesame!

The cell phone appears in today’s society as a second home. Everything is there, including our most secret files. But is it possible to refuse to give the key to this home?

In other words, can you refuse to give the access code of your smartphone?

In a ruling issued on November 7, 2022, the Cour de Cassation (French Supreme Court) seems a priori to say that the answer is no.

In the case at hand, an individual arrested in connection with a drug offense refused to give to the investigators the codes to access his phones that they suspect had been used during the trafficking.

This individual, prosecuted on the basis of Article 434-15-2 of the French Criminal Code that deals with refusal to give to law enforcement authorities “the secret convention for decrypting a means of cryptology”, was acquitted of this offence.

Following the appeal lodged by the Public Prosecutor, the Court of Appeals of Douai upheld this acquittal in a judgment dated July 11, 2019.

An appeal was lodged against this decision before the Cour de Cassation.

The Cour de Cassation quashed this judgment^[1] and referred the matter back to the Court of Appeals of Douai which again upheld the acquittal judgment.

The Public Prosecutor of the Court of Appeals of Douai then appealed again to the Cour de Cassation.

Therefore, the question at issue was: Is the code used to unlock the screen of a smartphone a “secret convention for decrypting a means of cryptology”? If yes, an individual who refuses to provide it may be prosecuted under the above-mentioned Article 434-15-2 of the French Criminal Code.

The Criminal Chamber of the Cour de Cassation, sitting in plenary session, ruled that the term “decryption convention” means “any software or other information allowing the clearing of a data transformed by a means of cryptology, either during its storage or its transmission. As a result, the access code of a cell phone can constitute a decryption key if this phone is equipped with a means of cryptology”.

A such, to better understand this ruling, it is necessary to consider the conditions governing the application of Article 434-15-2 of the French Criminal Code and Article 29 paragraph 1 of the 2004 Law for confidence in the digital economy.

Pursuant to Article 434-15-2 of the French Criminal Code:

“Anyone who has knowledge of the secret decryption convention of a means of cryptology likely to have been used to prepare, facilitate or commit a crime or offence, and who refuses to provide said convention to the judicial authorities or to implement it, at the request of these authorities pursuant to Titles II and III of Book I of the [French] Code of Criminal Procedure is liable to three years’ imprisonment and a fine of 270,000 euros.

If the refusal is made when the provision or the implementation of the convention would have made it possible to avoid the commission of a crime or an offence or to limit its effects, the penalty is increased to five years’ imprisonment and a fine of 450,000 euros.”

In addition, according to Article 29 paragraph 1 of the 2004 Law for confidence in the digital economy:

“Cryptography means any hardware or software designed or modified to transform data, whether it is either information or signals, by secret conventions or to perform the reverse operation with or without secret conventions. The main purpose of these means of cryptography is to guarantee the security of the storage or the transmission of data while ensuring their confidentiality, authentication, and integrity.”

A formalized request by a criminal investigation police officer or judge

As a result of the above, for the offence to be established, a criminal investigation police officer or judge must preliminarily issue a request for the purpose of being given “a secret decryption convention”.

The criminal investigation police or the judge officer must therefore formalize his/her request and, above all, warn the accused individual that if he/she refuses to comply, such refusal will constitute an offence. The request must, therefore, be formalized in writing and cannot be merely a verbal one.

A phone equipped with a means of cryptology

Also, for the offence to be characterized, the individual must refuse to give the secret convention for decrypting a means of cryptology. It is thus necessary that the phone be equipped with such a means of cryptology. 

The purpose of cryptology is to make information incomprehensible in order to secure it.

On this point, the Cour de Cassation considered that if the phone is equipped with such a means of cryptology, then the access code to the home screen can allow the encrypted information to be cleared and thus constitute “a secret decryption convention.”

The refusal of the owner of a phone equipped with an encryption device to provide his/her access code could then be considered as one of the constituent elements of the offence.

A phone used in the preparation or commission of a crime

Finally, it is necessary – and this is not insignificant – that the phone, the access code of which is withheld by the accused individual, is likely to have been used in the preparation or commission of a crime or offence.

It is only if all these conditions are met that the offence can be characterized.

It should be noted, however, that the judge will have to investigate and justify in his/her decision that the phone in question is equipped with a means of cryptology, as this cannot be not presumed. In fact, the accused cannot be convicted if the code in question is a simple password that does not involve any encryption process.

Such a control could be difficult to carry out, especially in the context the so-called immediate appearance procedure (procédure de comparution immédiate), which implies faster investigations.

It is clear that the modernization of phones implies, for many, the inclusion of a means of cryptology. For these new smartphones, the refusal to provide the access code could characterize the offence provided for under Article 434-15-2 of the French Criminal code.

But this if, and only if, the 3 above-mentioned conditions are met.

Only this way will sesame open.

[1] Criminal Chamber of the Cour de Cassation, October 13, 2020, appeal No. 19-85.984, published