SEC v. Huang

            With an ever-expanding accumulation of technological advancements, questions about privacy and self-incrimination begin to arise, especially when the devices are not owned by the user.  This question was recently raised in federal court in Pennsylvania in Securities and Exchange Commission v. Huang , 2015 WL 5611644 (E.D. PA 2015-269)(“ SEC v. Huang ”). 

            In SEC v. Huang , former employees at Capital One and were provided company-owned smartphones.  The bank allowed their employees to determine their own passwords that unlocked their devices, and in fact, urged all employees to not keep records of any personal codes in an attempt to be even more secure.  Upon departing from Capital One, the employees returned their smart phones to the bank. 

            The SEC contends that certain former Capital One employees (Defendants) took part in an insider trading scheme during their time as employees, illegally benefitting from information obtained during their time of employment with Capital One.  Documents were believed to be stored on the Defendants’ smart phones.  Capital One turned the employees’ smartphones over to the SEC to aid in the investigation, but the phones still had the passcode lock mechanism on them.  The bank did not have the codes, per their security policy. 

            The SEC demanded that the rogue employees provide the passwords to the smartphones, but they refused, asserting their Fifth Amendment rights against self-incrimination.  The SEC sought court intervention to compel the Defendants to provide the passwords to unlock the smartphones in an effort to gain evidence to support the charges of insider trading.  The SEC argued that, as former employees, the Defendants were “corporate custodians” and had no privacy right to withhold the passcodes.

            The District Court (Hon. Mark A. Kearney) ruled in favor of the Defendants, allowing them to assert their Fifth Amendment rights and not be obliged to provide their personal passcodes to the SEC or Capital One.  The reasoning was that the SEC was not seeking business documents, but actually seeking the “thought processes” of Defendants who were allowed to choose and protect their personal passwords.  Neither Capital One nor the SEC actually knew definitively if what they were seeking would be found within the contents of the Defendants’ phones.  The court held that producing the passcodes would be testimonial in nature and potentially self-incriminating, thereby protected from compulsory disclosure under the Fifth Amendment. 

Implications:

            This case can have significant implications for employers and employees.  An employer may want to provide their employee with an assigned and recorded, company password for any of their company-issued devices in the future, so that an issue like the one that arose is SEC v. Huang may be avoided.  This would have eliminated the argument that the passwords were the employees’ own personal thoughts (hence requiring testimonial revelations), and likely would have yielded a different holding in the case.  Although, enacting this procedure could pose issues with privacy rights, especially if it is the employee’s personal device, containing personal text messages, emails, etc., not to mention the heightened security problems that could result with stored passwords. 

            There is the option of having some type of mobile device management system that would allow the employees who utilize the company-issued devices access to only certain applications or downloads.  This would be a seemingly fair compromise for both sides – a small price to pay for a free phone. 

            To secure ownership of all information on an devices that are employer owned, The Fleischmann Law Firm is recommending to all its business clients that the employers assign passwords/passcodes to the devices, and that employees be required as a job condition to keep the employer informed of any changes.

The Fleischmann Law Firm, P.C.

By: Craig J. Fleischmann, Esq. and

       Andrew McFadyen, Paralegal Intern

The post Who Owns the Password? The Employer or the Employee? appeared first on The Fleischmann Law Firm, P.C..