Commonwealth v. Gelfgatt

Spina, J.

On May 5, 2010, a State grand jury returned indictments charging the defendant with seventeen counts of forgery of a document, G. L. c. 267, § 1; seventeen counts of uttering a forged instrument, G. L. c. 267, § 5; and three counts of attempting to commit the crime of larceny by false pretenses of the property of another, G. L. c. 274, § 6. The charges arose from allegations that the defendant, through his use of computers, conducted a sophisticated scheme of diverting to himself funds that were intended to be used to pay off large mortgage loans on residential properties. On November 21, 2011, the Commonwealth filed in the Superior Court a “Motion to Compel the Defendant to Enter His Password into Encryption Software He Placed on Various Digital Media Storage Devices that Are Now in the Custody of the Commonwealth” (motion to compel decryption). The Commonwealth also filed a motion to report a question of law to the Appeals Court prior to trial pursuant to Mass. R. Crim. P. 34, as amended, 442 Mass. 1501 (2004). The question concerned the lawfulness of compelling the defendant to privately enter an encryption key into computers seized from him by the Commonwealth.¹ Following a hearing on January 18, 2012, a judge denied the Commonwealth’s motion to compel decryption, but he reported the following question of law:

“Can the defendant be compelled pursuant to the Commonwealth’s proposed protocol to provide his key to seized encrypted digital evidence despite the rights and protections provided by the Fifth Amendment to the United States Constitution and Article Twelve of the Massachusetts Declaration of Rights?”²

We transferred the case to this court on our own motion.³ We now conclude that the answer to the reported question is “Yes, where the defendant’s compelled decryption would not communicate facts of a testimonial nature to the Commonwealth beyond what the defendant already had admitted to investigators.” Accordingly, we reverse the judge’s denial of the Commonwealth’s motion to compel decryption.⁴

1. Background. The undisputed facts are taken from the parties’ submissions to the motion judge.⁵

Beginning in 2009, the defendant, who is an attorney, allegedly orchestrated a scheme to acquire for himself funds that were intended to be used to pay off home mortgage loans. According to the Commonwealth, the defendant identified high-end properties that were listed in an online database as “under agreement.” He would research each one at the applicable registry of deeds to determine whether there was a mortgage on the property. If there was, the defendant, purportedly using a computer, would forge an assignment of the mortgage to either “Puren Ventures, Inc.” (Puren Ventures) or “Baylor Holdings, Ltd.” (Baylor Holdings). He then would record the forged assignment at the applicable registry of deeds and mail a notice to the seller stating that the mortgage on the property had been assigned to one of these sham companies, which he had set up.

The defendant fostered the illusion that Puren Ventures and Baylor Holdings were actual companies by giving each one Internet-based telephone and facsimile numbers. When a closing attorney would contact one of these companies to request a statement documenting the sum necessary to pay off the reassigned mortgage, the attorney would be instructed to send the request to the facsimile number that the defendant had created. Next, the defendant would request an actual payoff figure from the true mortgage holder. The defendant would transmit this information by Internet facsimile number to the closing attorney, doing so under the guise of the sham company. The defendant would instruct the closing attorney to send the payoff check to a Boston address where the defendant once had practiced law. Although ultimately unsuccessful, the defendant purportedly created seventeen fraudulent assignments of mortgages, totaling over $13 million. According to the Commonwealth, the defendant relied heavily on the use of computers to conceal his identity and perpetrate his alleged scheme.

On December 17, 2009, State police troopers arrested the defendant immediately after he retrieved what he believed to be over $1.3 million in payoff funds from two real estate closings. They also executed search warrants for his residence in Marble-head and for his vehicle. During the search of the defendant’s residence, troopers observed several computers that were powered on, and they photographed the computer screens.⁶ The troopers seized from the defendant’s residence two desktop computers, one laptop computer, and various other devices capable of storing electronic data.⁷ They also seized one smaller “netbook” computer from the defendant’s vehicle. Computer forensic examiners were able to view several documents and “bookmarks” to Web sites that were located on an external hard drive.⁸ However, all of the data on the four computers were encrypted with “DriveCrypt Plus” software.⁹

According to the Commonwealth, the encryption software on the computers is virtually impossible to circumvent. Its manufacturer touts the fact that it does not contain a “back door” that would allow access to data by anyone other than the authorized user. Thus, the Commonwealth states, the files on the four computers cannot be accessed and viewed unless the authorized user first enters the correct password to unlock the encryption. The Commonwealth believes that evidence of the defendant’s purported criminal activities is located on these computers.

On the day of his arrest, the defendant was interviewed by law enforcement officials after having been advised of the Miranda rights. In response to questioning, he said that he had more than one computer in his home. The defendant also informed the officials that “[e] very thing is encrypted and no one is going to get to it.” In order to decrypt the information, he would have to “start the program.” The defendant said that he used encryption for privacy purposes, and that when law enforcement officials asked him about the type of encryption used, they essentially were asking for the defendant’s help in putting him in jail. The defendant reiterated that he was able to decrypt the computers, but he refused to divulge any further information that would enable a forensic search.

On November 21, 2011, the Commonwealth filed its motion to compel decryption pursuant to Mass. R. Crim. P. 14 (a) (2), as appearing in 442 Mass. 1518 (2004). It sought an order compelling the defendant’s compliance with a “protocol” that the Commonwealth had established to obtain decrypted digital data.¹⁰ As grounds for the motion, the Commonwealth stated that compelling the defendant to enter the key to encryption software on various digital media storage devices that had been seized by the Commonwealth was essential to the discovery of “material” or “significant” evidence relating to the defendant’s purported criminal conduct. The Commonwealth further stated that its protocol would not violate the defendant’s rights under either the Fifth Amendment to the United States Constitution or art. 12 of the Massachusetts Declaration of Rights.

In denying the Commonwealth’s motion to compel decryption, the judge said that, on the one hand, the Commonwealth merely was requesting a sequence of numbers and characters that would enable it to access information on the computers, but that, on the other hand, the Commonwealth was asking for the defendant’s help in accessing potentially incriminating evidence that the Commonwealth had seized. In the judge’s view, there was merit to the defendant’s contention that production of a password to decrypt the computers constituted an admission of knowledge, ownership, and control. Further, the judge continued, the scenario presented in this case was far different from compelling a defendant to provide a voice exemplar, a handwriting exemplar, or a blood sample, all of which are deemed to be nontestimonial. The judge said that the defendant’s refusal to disclose the encryption key during his interview with law enforcement officials could be construed as an invocation of his rights under the Fifth Amendment and art. 12. Finally, it was the judge’s understanding that neither the Federal nor the State Constitution requires a defendant to assist the government in understanding evidence that it has seized from a defendant.

2. Decryption under the Fifth Amendment. The Commonwealth contends that compelling the defendant to enter his encryption key into the computers pursuant to the Commonwealth’s protocol would not violate the defendant’s Fifth Amendment right against self-incrimination. In the Commonwealth’s view, the defendant’s act of decryption would not communicate facts of a testimonial nature to the government beyond what the defendant already has admitted to investigators. As such, the Commonwealth continues, the defendant’s act of decryption does not trigger Fifth Amendment protection. We agree.¹¹

The Fifth Amendment provides that “[n]o person . . . shall be compelled in any criminal case to be a witness against himself.”¹² See Couch v. United States, 409 U.S. 322, 328 (1973) (“It is extortion of information from the accused himself that offends our sense of justice”). It is well established that “the Fifth Amendment does not independently proscribe the compelled production of every sort of incriminating evidence but applies only when the accused is compelled to make a testimonial communication that is incriminating” (emphasis in original). Fisher v. United States, 425 U.S. 391, 408 (1976). See United States v. Hubbell, 530 U.S. 27, 34 (2000) (“The word ‘witness’ in the constitutional text limits the relevant category of compelled incriminating communications to those that are ‘testimonial’ in character”); Schmerber v. California, 384 U.S. 757, 761 (1966) (“[T]he privilege protects an accused only from being compelled to testify against himself, or otherwise provide the State with evidence of a testimonial or communicative nature”). See also Commonwealth v. Hughes, 380 Mass. 583, 588, cert. denied, 449 U.S. 900 (1980).

Here, the Commonwealth, through its motion, is seeking to compel the defendant to decrypt “all” of the “digital storage devices that were seized from him.” Given that the Commonwealth believes that those devices contain information about the defendant’s alleged mortgage payoff scheme, the entry of the encryption key or password presumably would be incriminating because “it would furnish the Government with a link in the chain of evidence leading to [the defendant’s] indictment.” Doe v. United States, 487 U.S. 201, 207 n.5 (1988), and accompanying text. The issue on which this case turns is whether the defendant’s act of decrypting the computers is a testimonial communication that triggers Fifth Amendment protection.

Although the Fifth Amendment privilege typically applies to oral or written statements that are deemed to be testimonial, United States v. White, 322 U.S. 694, 698 (1944), the act of producing evidence demanded by the government may have “communicative aspects” that would render the Fifth Amendment applicable. Fisher, 425 U.S. at 410. See Hubbell, 530 U.S. at 36. See also Commonwealth v. Burgess, 426 Mass. 206, 211 (1997) (“The Fifth Amendment privilege against self-incrimination applies not only to verbal communications, but . . . also to nonverbal acts that imply assertions”). Whether an act of production is testimonial depends on whether the government compels the individual to disclose “the contents of his own mind” to explicitly or implicitly communicate some statement of fact. Hubbell, supra at 43, quoting Curcio v. United States, 354 U.S. 118, 128 (1957). See Doe v. United States, 487 U.S. at 213 (Fifth Amendment intended “to spare the accused from having to reveal, directly or indirectly, his knowledge of facts relating him to the offense or from having to share his thoughts and beliefs with the Government”). See also Pennsylvania v. Muniz, 496 U.S. 582, 595 n.9 (1990) (opinion of Brennan, J.) (“nonverbal conduct contains a testimonial component whenever the conduct reflects the actor’s communication of his thoughts to another”). More particularly, the act of complying with the government’s demand could constitute a testimonial communication where it is considered to be a tacit admission to the existence of the evidence demanded, the possession or control of such evidence by the individual, and the authenticity of the evidence. See Hubbell, supra at 36 & n.19; United States v. Doe, 465 U.S. 605, 613-614 & n.11 (1984); Fisher, supra. See also Commonwealth v. Burgess, supra; Commonwealth v. Hughes, 380 Mass. at 592. The determination whether an act of producing evidence in response to a governmental demand is sufficiently testimonial that it renders the Fifth Amendment applicable “depend[s] on the facts and circumstances of [each] particular case[].” Fisher, supra. See Doe v. United States, 487 U.S. at 214-215.

It is well established that not all acts of production have communicative aspects such that they will be deemed testimonial. See Hubbell, 530 U.S. at 34-35; Doe v. United States, 487 U.S. at 210-211. Significantly, the Fifth Amendment privilege is not triggered where the government seeks to compel an individual to be the source of real or physical evidence by, for example, furnishing a blood sample, Schmerber v. California, 384 U.S. at 764-765; producing a voice exemplar, United States v. Dionisio, 410 U.S. 1, 5-7 (1973); standing in a lineup, United States v. Wade, 388 U.S. 218, 221-223 (1967); providing a handwriting exemplar, Gilbert v. California, 388 U.S. 263, 266-267 (1967); or putting on particular clothing, Holt v. United States, 218 U.S. 245, 252-253 (1910). See Commonwealth v. Brennan, 386 Mass. 772, 776-777 (1982) (breathalyzer test and field sobriety tests do not produce evidence of testimonial nature). The Fifth Amendment privilege is not implicated in these circumstances because the individual is “not required ‘to disclose any knowledge he might have,’ or ‘to speak his guilt.’ ” Doe v. United States, supra at 211, quoting United States v. Wade, supra at 222-223. See Hubbell, supra at 35 (“The act of exhibiting such physical characteristics is not the same as a sworn communication by a witness that relates either express or implied assertions of fact or belief”); Pennsylvania v. Muniz, 496 U.S. at 590-599 (discussing distinctions between production of “real or physical” evidence and production of “testimonial” communication for purposes of privilege against self-incrimination).

Here, the defendant’s act of entering an encryption key in the computers seized by the Commonwealth would appear, at first blush, to be a testimonial communication that triggers Fifth Amendment protection. By such action, the defendant implicitly would be acknowledging that he has ownership and control of the computers and their contents.¹³ This is not simply the production of real or physical evidence like a blood sample or a handwriting exemplar. Rather, the defendant’s act of entering the encryption key would be a communication of his knowledge about particular facts that would be relevant to the Commonwealth’s case. Our analysis, however, does not end here. We must further determine whether the defendant’s act of production loses its testimonial character because the information that would be disclosed by the defendant is a “foregone conclusion.”

The “foregone conclusion” exception to the Fifth Amendment privilege against self-incrimination provides that an act of production does not involve testimonial communication where the facts conveyed already are known to the government, such that the individual “adds little or nothing to the sum total of the Government’s information.” Fisher, 425 U.S. at 411. For the exception to apply, the government must establish its knowledge of (1) the existence of the evidence demanded; (2) the possession or control of that evidence by the defendant; and (3) the authenticity of the evidence. See id. at 410-413; United States v. Bright, 596 F.3d 683, 692 (9th Cir. 2010). See also Hubbell, 530 U.S. at 40-41, 44-45 (government did not satisfy “foregone conclusion” exception where no showing of prior knowledge of existence or whereabouts of documents ultimately produced by respondent to subpoena); United States v. Doe, 465 U.S. at 613-614 & nn.11-13 (act of producing business records involved testimonial self-incrimination where government did not show that existence, possession, and authenticity of records were “foregone conclusion”). In those instances when the government produces evidence to satisfy the “foregone conclusion” exception, “no constitutional rights are touched. The question is not of testimony but of surrender.” Fisher, supra at 411, quoting Matter of Harris, 221 U.S. 274, 279 (1911). See, e.g., United States v. Sideman & Bancroft, LLP, 704 F.3d 1197, 1202-1205 (9th Cir. 2013) (quantum of information possessed by Internal Revenue Service regarding existence and possession of summonsed documents, together with evidence of their authenticity, satisfied “foregone conclusion” exception to Fifth Amendment privilege against self-incrimination); United States v. Fricosu, 841 F. Supp. 2d 1232, 1237 (D. Colo. 2012) (Fifth Amendment not implicated by requiring production of unencrypted contents of computer where government knew of existence and location of files, although not specific content of documents, and knew of defendant’s custody or control of computer); State v. Jancsek, 302 Or. 270, 287-288 (1986) (compelled production of letter not protected by Fifth Amendment privilege where existence, contents, and authenticity of letter already known to police). In essence, under the “foregone conclusion” exception to the Fifth Amendment privilege, the act of production does not compel a defendant to be a witness against himself.

Based on our review of the record, we conclude that the factual statements that would be conveyed by the defendant’s act of entering an encryption key in the computers are “foregone conclusions” and, therefore, the act of decryption is not a testimonial communication that is protected by the Fifth Amendment. The investigation by the corruption, fraud, and computer crime division of the Attorney General’s office uncovered detailed evidence that at least two mortgage assignments to Baylor Holdings were fraudulent. During his postarrest interview with State police Trooper Patrick M. Johnson, the defendant stated that he had performed real estate work for Baylor Holdings, which he understood to be a financial services company. He explained that his communications with this company, which purportedly was owned by Russian individuals, were highly encrypted because, according to the defendant, “[that] is how Russians do business.” The defendant informed Trooper Johnson that he had more than one computer at his home, that the program for communicating with Baylor Holdings was installed on a laptop, and that “[e]verything is encrypted and no one is going to get to it.” The defendant acknowledged that he was able to perform decryption. Further, and most significantly, the defendant said that because of encryption, the police were “not going to get to any of [his] computers,” thereby implying that all of them were encrypted.

When considering the entirety of the defendant’s interview with Trooper Johnson, it is apparent that the defendant was engaged in real estate transactions involving Baylor Holdings, that he used his computers to allegedly communicate with its purported owners, that the information on all of his computers pertaining to these transactions was encrypted, and that he had the ability to decrypt the files and documents. The facts that would be conveyed by the defendant through his act of decryption — his ownership and control of the computers and their contents, knowledge of the fact of encryption, and knowledge of the encryption key — already are known to the government and, thus, are a “foregone conclusion.”¹⁴ The Commonwealth’s motion to compel decryption does not violate the defendant’s rights under the Fifth Amendment because the defendant is only telling the government what it already knows.

3. Decryption under art. 12. The Commonwealth also contends that compelling the defendant to enter his encryption key pursuant to the Commonwealth’s protocol would not violate his privilege against self-incrimination under art. 12 of the Massachusetts Declaration of Rights. We agree.

Article 12 provides that “[n]o subject shall... be compelled to accuse, or furnish evidence against himself.” It is well established that art. 12 affords greater protection against self-incrimination than does the Fifth Amendment in circumstances that are “discrete and well defined.”¹⁵ Commonwealth v. Burgess, 426 Mass. at 218. See Commonwealth v. Mavredakis, 430 Mass. 848, 858-859 (2000). However, as we have explained, “[ajlthough art. 12 demands a more expansive protection, ‘it does not change the classification of evidence to which the privilege applies. Only that genre of evidence having a testimonial or communicative nature is protected under the privilege against self-incrimination.’ ” Commonwealth v. Burgess, supra, quoting Attorney Gen. v. Colleton, 387 Mass. 790, 796 n.6 (1982) . Like the Federal Constitution, the protection against self-incrimination afforded by art. 12 is unavailable where the government seeks to compel an individual to be the source of real or physical evidence. See Commonwealth v. Burgess, supra, and cases cited.

Similarly, we have held that, as is the case under the Federal Constitution, “the act of production, quite apart from the content of that which is produced, may itself be communicative.” Commonwealth v. Doe, 405 Mass. 676, 679 (1989). See Commonwealth v. Hughes, 380 Mass. at 592. Where the information conveyed by an act of production “is reflective of the knowledge, understanding, and thoughts of the witness,” it is deemed to be testimonial and, therefore, within the purview of art. 12. Commonwealth v. Doe, supra. At the same time, we also have recognized that “[w]hen it is a ‘foregone conclusion’ that a witness has certain items, and the items themselves are not privileged, the witness has no privilege.” Id. at 680-681, citing Commonwealth v. Hughes, supra at 590, and Fisher v. United States, 425 U.S. at 411. See Commonwealth v. Diaz, 383 Mass. 73, 76 n.5 (1981) (no serious constitutional issue of self-incrimination raised by disclosure of information that is “foregone conclusion”). See also note 13, supra.

In Commonwealth v. Burgess, 426 Mass. at 219, when the court considered the scope of the protection against self-incrimination afforded by both the Federal Constitution and the Massachusetts Declaration of Rights, we pointed out that our analysis under art. 12 need not “merely duplicate our earlier Fifth Amendment analysis.” Rather, “[w]e are free to consider certain evidence, considered by the Supreme Court to be insufficiently testimonial for Fifth Amendment purposes, to be sufficiently testimonial for art. 12 purposes.” Id. Mindful of this pronouncement, as well as our jurisprudence recognizing the “foregone conclusion” principle, we are not persuaded that the circumstances presented here dictate an analytical departure from the Federal standard. Where the facts that would be conveyed by the defendant through the act of entering an encryption key into the computers seized by the Commonwealth are a “foregone conclusion,” his act of production is insufficiently testimonial for art. 12 purposes.¹⁶

4. Conclusion. We answer the reported question, “Yes, where the defendant’s compelled decryption would not communicate facts of a testimonial nature to the Commonwealth beyond what the defendant already had admitted to investigators.” The judge’s denial of the Commonwealth’s motion to compel decryption is reversed, and this case is remanded to the Superior Court for further proceedings consistent with this opinion.

So ordered.

1 The parties treat as synonymous the terms “encryption key” and “password” to encryption software. For the sake of simplicity, we shall do the same.

2 The parties have not included in the record appendix a copy of the order reporting the question of law from the Superior Court. We rely on a joint stipulation of the parties filed on July 19, 2012, that sets forth the language of the reported question.

3 All proceedings in the Superior Court have been stayed pending resolution of the reported question.

4 We acknowledge the amicus briefs submitted in support of the defendant by the American Civil Liberties Union Foundation of Massachusetts, the American Civil Liberties Union Foundation, and the Electronic Frontier Foundation; by the Massachusetts Association of Criminal Defense Lawyers; and by Daniel K. Gelb, Daniel B. Carrie, and the National Association of Criminal Defense Lawyers. We also acknowledge the amicus briefs submitted in support of the Commonwealth by David W. Opderbeck, the Massachusetts Chiefs of Police Association, Inc., and NW3C, Inc., doing business as the National White Collar Crime Center; by the Florida Department of Law Enforcement, the Massachusetts Chiefs of Police Association, Inc., NW3C, Inc., doing business as the National White Collar Crime Center, and the National District Attorneys Association; and by NW3C, Inc., doing business as the National White Collar Crime Center.

5 These submissions included an affidavit dated August 31, 2011, from David Papargiris, the director of the Attorney General’s computer forensics laboratory; an affidavit dated October 19, 2011, from State police Trooper Patrick M. Johnson; and the transcript of an audio recording of a postarrest interview of the defendant conducted on December 17, 2009, by law enforcement officers. The motion judge declined to make findings of fact when ruling on the Commonwealth’s motion to compel decryption, given that the only facts before him were those presented in the Commonwealth’s submissions. Defense counsel did not dispute the facts set forth in the affidavits and transcript, recognizing that they spoke for themselves. He did, however, point out that he might disagree with some of the characterizations of those facts.

6 Appearing on the computer screens were the following phrases that were visible as headings or icons: “K:\Leon DocumentsYMy Scans”; “Erasing Report”; “Erased area”; “Attorney Leon I. Gelfgatt”; “TrueCrypt”; and “DriveCrypt Plus Pack.”

7 Apart from the computers, troopers seized an Adaptec external hard drive, two universal serial bus (USB) thumb drives, two secure digital cards, two cellular telephones, and fourteen compact discs.

8 These documents included what appeared to be unsigned releases for a mortgage encumbering the defendant’s residential property in Marblehead. Computer forensic examiners also were able to see an image file that appeared to contain the seal for an Arizona notary public. The “bookmarks” included a Web site where Puren Ventures was advertised for sale, and a Web site offering anonymous wire transfers.

9 In an affidavit submitted in connection with the Commonwealth’s motion to compel decryption, the director of the Attorney General’s computer forensics laboratory explained the differences between encryption and decryption:

“Encryption is the process by which ‘readable’ digital media, that is, digital media or data that can be viewed and accessed, is scrambled in such a way as to render that digital media or data ‘unreadable’ without decryption. Encryption can be performed both by hardware and by means of software tools.

“Decryption is the process by which encrypted, scrambled data is rendered ‘readable’ again. In order to decrypt data, the person seeking decryption performs some action such as the entering of a password, scanning of a fingerprint or [insertion of] a USB Thumb drive with a pass code key on it. The encryption software then translates this action into a ‘key,’ essentially a string of numbers or characters. The encryption software then applies this key to the encrypted data using the algorithm of the given encryption program. By tunneling the encrypted data through the algorithm, the data is rendered ‘readable’ again.”

10 The Commonwealth’s “protocol” is as follows:

“1. The defendant, in the presence of his counsel, shall appear at the Computer Forensics Laboratory of Massachusetts Attorney General Martha Coakley within 7 days from the receipt of this Order at a time mutually agreed upon by the Commonwealth and defense counsel;

“2. The Commonwealth shall provide the defendant with access to all encrypted digital storage devices that were seized from him pursuant to various search warrants issued in connection with this case;

“3. The defendant shall manually enter the password or key to each respective digital storage device in sequence, and shall then immediately move on to the next digital storage device without entering further data or waiting for the completion of the process required for the respective devices to ‘boot up’;

“4. The defendant shall make no effort to destroy, change, or alter any data contained on the digital storage devices;

“5. The defendant is expressly ordered not to enter a false or ‘fake’ password or key, thereby causing the encryption program to generate ‘fake, prepared information’ as advertised by the manufacturer of the encryption program;

“6. The Commonwealth shall not view or record the password or key in any way; [and]

“7. The Commonwealth shall be precluded from introducing any evidence relating to this Order or the manner in which the digital media in this case was decrypted in its case in chief. Further, the Commonwealth shall be precluded from introducing any such evidence whatsoever except to the extent necessary to cure any potentially misleading inferences created by the defendant at trial relating to this matter.”

At the hearing on the motion to compel decryption, the Commonwealth stated that it “would be seeking to introduce the fact of encryption in order to suggest consciousness of guilt.”

11 Generally speaking, “discovery matters are committed to the sound discretion of the trial judge.” Buster v. George W. Moore, Inc., 438 Mass. 635, 653 (2003). “We will uphold discovery rulings unless the appellant can demonstrate an abuse of discretion that resulted in prejudicial error.” Id., citing Solimene v. B. Grauel & Co., 399 Mass. 790, 799 (1987). However, we review a judge’s rulings on mixed questions of fact and law de nova. See McCarthy v. Slade Assocs., 463 Mass. 181, 190 (2012); Commissioner of Revenue v. Comcast Corp., 453 Mass. 293, 303 (2009).

12 In Malloy v. Hogan, 378 U.S. 1, 8 (1964), the United States Supreme Court held that the privilege against self-incrimination under the Fifth Amendment to the United States Constitution applies to the States through the Fourteenth Amendment to the United States Constitution. See Commonwealth v. Simon, 456 Mass. 280, 285 n.4, cert. denied, 131 S. Ct. 181 (2010).

13 Because the actual files and documents that are located on the defendant’s computers were voluntarily created by the defendant in the course of his real estate dealings, they are not -testimonial communications that enjoy Fifth Amendment protection. See United States v. Hubbell, 530 U.S. 27, 35-36 (2000) (recognizing “settled proposition that a person may be required to produce specific documents even though they contain incriminating assertions of fact or belief because the creation of those documents was not ‘compelled’ within the meaning of the [Fifth Amendment] privilege”); United States v. Doe, 465 U.S. 605, 611-612 (1984); Fisher v. United States, 425 U.S. 391, 409-410 (1976).

14 We note that compliance with an order for the production of specific documents pursuant to a subpoena may be deemed to be a testimonial communication of the fact that the documents produced are the ones demanded, thereby constituting authentication of those documents. See Fisher v. United States, 425 U.S. at 412-413 & n.12. Here, the defendant’s decryption of his computers does not present an authentication issue analogous to that arising from a subpoena for specific documents because he is not selecting documents and producing them, but merely entering a password into encryption software.

15 We have held, for example, that art. 12 of the Massachusetts Declaration of Rights does not allow a defendant’s refusal to submit to a breathalyzer test to be admitted in evidence. Compare Opinion of the Justices, 412 Mass. 1201, 1209-1211 (1992), with South Dakota v. Neville, 459 U.S. 553, 562-564 (1983) . We also have held that a custodian of corporate records may invoke his art. 12 right against self-incrimination in response to a subpoena for those records where the act of production itself would be personally incriminating. Compare Commonwealth v. Doe, 405 Mass. 676, 678 (1989), with Braswell v. United States, 487 U.S. 99, 108-110 (1988). Additionally, we have held that the type of immunity that provides the requisite degree of protection for art. 12 purposes is so-called transactional immunity, which affords broader protection than the “use and derivative use immunity” required by the Fifth Amendment. Compare Attorney Gen. v. Colleton, 387 Mass. 790, 795-801 & n.4 (1982), with Kastigar v. United States, 406 U.S. 441, 453 (1972).

16 As properly enunciated by the Commonwealth in its protocol, see note 10, supra, the compelled act of computer decryption cannot be used to prove that the defendant had custody and control over the computers. Cf. Commonwealth v. Burgess, 426 Mass. 206, 220 (1997).