encryption

Encryption is vital for attorney-client privilege in the digital era, and lawyers should fight for it

If you live in the U.S., you could be forgiven for assuming that a conversation with your attorney is always confidential and protected by something called “attorney-client privilege.” After all, the U.S. Supreme Court has held that “The essence of the Sixth Amendment right is… privacy of communication with counsel,” and popular TV shows and movies reflect the common understanding that lawyers can counsel their clients in private.  But the unfortunate truth is that calls and messages from prison are in many cases routinely surveilled, and are even leaked to the public. Unless we take action to defend prisoners’ rights and bulwark digital security — including requiring encryption for all attorney-client conversations  —  we could see people already suffering from systemic racism, discrimination, and abuse further stripped of their fundamental rights and freedoms.   

Consider what happened to Gerard Howard, who was arrested on suspicion of possession of heroin and drug paraphernalia. The police never found illegal drugs on him, but seven minutes into a confidential collect call from his jail cell to his attorney, he said “Just like after detox or whatever…they just moved me to a different building.” The New Orleans District Attorney then used the jail’s recording of the call — specifically citing Mr. Howard’s use of the word “detox” — as the key element of the crime of “possession of drug paraphernalia” in order to convict and sentence him.

Howard’s attorney, Thomas Frampton, told The Guardian that the call ended up being the “centerpiece of their case against my client.” He says prosecutors had “no other evidence to meet their burden of proving that the needle in his pocket qualified as ‘paraphernalia’ under Louisiana law.”

Howard is not alone. While the U.S. has only five percent of the world’s population, it has 25 percent of the world’s known prisoners. That is due in part to the breadth and intrusiveness of government monitoring and a U.S. criminal justice system that reflects deeply entrenched systemic and structural racism. As the U.N. Special Rapporteur on racism, E. Tendayi Achiume, has highlighted, we are seeing authorities increasingly use invasive surveillance technologies, in some cases intended for purposes such as border control, against people in Black and Latinx communities who are targeted for discrimination and racist attacks. That is why Access Now supports a broad range of efforts to defend encryption, increase transparency and limit police use of rights-infringing surveillance technologies, and ban outright some uses of technology that inherently threaten human rights, such as facial recognition for mass surveillance. We also strongly back the call by Special Rapporteur Achiume and other human rights experts for a global moratorium on the sale, transfer, and use of surveillance tech, and have joined a lawsuit to hold the spyware industry accountable. 

U.S. prison authorities have undermined people’s Sixth Amendment rights by recording attorney-client communications on a massive scale. We know this because companies that provide prison telecom services are making mistakes and exposing people’s private conversations. Case in point: HomeWAV, a company used in dozens of prisons across the U.S to provide prisoners with phone services, left an unsecured database exposed to the internet from April to October 2020. HomeWAV’s representatives have refused to explain why the company recorded and transcribed these conversations when they are supposed to be protected by attorney-client privilege.

This news comes in the wake of two other massive breaches of attorney-client communications in the U.S., also enabled by private contractors. Securus and Telmate, two companies that state governments hired to manage messages to incarcerated people, have exposed millions of messages to the public. When data from Securus was leaked to journalists in 2015, it included more than 70 million individual calls by incarcerated people, of which 57,000 were made by detainees to lawyers. Both clients and lawyers likely understood these calls to be “privileged and confidential,” but clearly they were wrong. Similarly, Telmate left an unsecured server on the internet with 227,770,157 message records, including attorney-client communications, which were then discovered by researchers in August of 2020. In a functional justice system, these kinds of breaches would lead to the declaration of a mistrial or early release of prisoners in all the cases involved.

Shocking as it may be, routine prison monitoring of attorney-client calls is just the tip of the iceberg. As a new report by the New York Civil Liberties Union (NYCLU) highlights, it’s not just through snooping on prison calls that law enforcement breaches the sanctity of the attorney-client relationship. Surveillance of attorney-client communications is tainting the U.S. justice system as a whole. For example, the federal Drug Enforcement Administration has a $125 million unit called the Special Operations Division devoted to smuggling illegal evidence into U.S. criminal cases, such as information secretly collected via government monitoring of Google, Facebook, Apple, and Microsoft. This practice is called “parallel construction” and it’s a direct assault on attorney-client privilege.

How do we address this problem? At least part of the answer is developing digital-age standards for the protection of attorney-client communications. As the NYCLU report recommends, we must require attorneys to encrypt all of their client communications. Lawyers and lawyer associations must step up to the plate to advocate for better digital security standards, and help push regulations to strictly limit surveillance and protect prisoners’ rights. 

The American Bar Association already encourages attorneys to protect digital communications and their clients’ data, including through encryption and technological due diligence. Yet a 2019 survey shows that “less than half of respondents use file encryption (44%), slightly more than a third use email encryption (38%).” These figures are particularly shocking when compared to those of professional journalists. Both attorneys and journalists have similar professional obligations to provide confidentiality to clients and sources. But unlike attorneys, more than two-thirds of journalists and newsrooms use end-to-end encryption tools and most major print media, from The New York Times to USA Today to The Intercept, offer open source encrypted drop boxes for first contact with sources. These facts make it clear that attorneys need stronger guidance from the ABA. 

It’s clear the scales of the U.S. justice system are tilted toward incarceration. Prosecutors are engaging in mass surveillance of prison calls and messages in violation of the human rights of incarcerated people. But while being imprisoned may curtail your freedoms, it does not take away your fundamental right to privacy under U.S. and international law, and no one should be subjected to arbitrary or unlawful interference with that right – by law enforcement or private companies. Prison officials can make a real difference right now. They can prove they are not systematically monitoring attorney-client calls — violating Sixth Amendment rights — by supporting the implementation of modern security measures, including end-to-end (strong) encryption for these calls. Let’s put in place laws, policies, and practices that will defend privacy, promote racial equality under the law, and help people like Gerard Howard regain the rights that ought never to have been violated in the first place.