Search Warrants and Compelled Biometric Access to Phones

A new ruling, and some (mostly critical) thoughts.

|The Volokh Conspiracy |

Magistrate Judge Kandis Westmore of the U.S. District Court in Oakland, California, recently handed down an opinion denying a search warrant application because the prosecutors asked for a provision compelling everyone present to submit to a fingerprint or other biometric means of unlocking digital devices found there. According to Magistrate Judge Westmore, such a provision would violate the Fourth and Fifth Amendments.

Judge Westmore also ruled that it would be impermissible for the warrant to allow a seizure of all devices on the scene. In her view, the warrant can only authorize the seizure of devices "reasonably believed by law enforcement to be owned or controlled by the two suspects identified in the affidavit."

I think this opinion is partially right on one issue but mostly takes the wrong track. I agree that the compelled biometric provision is impermissible. But I mostly disagree with Judge Westmore as to why that's the case. And I think the second ruling, that not all devices can be seized, is mistaken. Here are the details, for those interested.

I. Compelled Biometrics Under the Fourth Amendment

Let's start with the compelled-biometrics ruling. The court first rules that this provision is not permissible under the Fourth Amendment because the government hasn't established probable cause as to each person who might be compelled to unlock the device. From the opinion:

[T]he Government seeks an order that would allow agents executing this warrant to compel "any individual, who is found at the Subject Premises and reasonably believed by law enforcement to be a user of the device, to unlock the device using biometrie features…." (Aff. 117h.) This request is overbroad. There are two suspects identified in the affidavit, but the request is neither limited to a particular person nor a particular device.

Thus, the Court finds that the Application does not establish sufficient probable cause to compel any person who happens to he at the Subject Premises at the time of the search to provide a finger, thumb or other biometric feature to potentially unlock any unspecified digital device that may be seized during the otherwise lawful search.

I think the court has the right instinct, but I don't think the issue is worked out quite the way it should be.

The first question is whether these sorts of provisions shold be permitted in warrants at all. There isn't much law on this, but let me offer my view that compelled biometric provisions categorically don't belong in warrants. The problem is that warrants can't try to regulate how a search is executed. Warrants have to say where the search is executed and what the government can seize there. But I think that what happens onsite—the details of how the warrant is executed—is a matter of case-by-case Fourth Amendment reasonableness that has to be litigated ex post rather than resolved as a rule ex ante. Given that, I think that the compelled biometric provision is an impermissible effort to regulate the details of the warrant's execution. The government can't settle their powers in the warrant ahead of time: They need to act reasonably when the warrant is actually executed.

Granted, my view above is just my opinion. I recognize that there's room in the Ninth Circuit for a different answer. The Ninth Circuit in United States v. Comprehensive Drug Testing took a very favorable view of ex ante search restrictions in warrants. Given that decision, it's at least plausible that ex ante restrictions can also extend to regulating unlocking. But if so, that raises the question of what standard applies to compel biometric access. It's hard to say what that standard is, I think, as the reasonableness standard for compelling any particular biometric access could depend on the facts. In general, though, I'm skeptical of Judge Westmore's apparent assumption that probable cause would be needed to compel a person to submit to a means of biometric access. Fingerprinting usually just requires reasonable suspicion, not probable cause. We don't know if the government would have reasonable suspicion, as we don't know the facts yet. But I think the Fourth Amendment standard is likely lower than Judge Westmore assumes.

In summary: For this part of the opinion, on the Fourth Amendment issue, I eagree with Judge Westore as to the result but have some disagreement as to the reasoning.

II. Compelled Biometrics Under the Fifth Amendment

The court next makes the very surprising holding that mandating biometric access would violate the Fifth Amendment privilege against self-incrimination. This is the part of the opinion that has drawn the most attention. But I think this ruling is incorrect for several reasons.

The first question raised by the Fifth Amendment aspects of compelled biometric access is whether it can be adjudicated now, before the warrant is signed. The opinion concludes that, as a matter of "moral imperative," it has to be adjudicated before the warrant is signed:

The undersigned has found no legal authority explicitly restricting the Court from considering the privileges and protections afforded by the Fifth Amendment prior to signing a warrant. In fact, the prejudice that suspects may suffer should the Fifth Amendment be ignored at this juncture—both due to the practical difficulty in prevailing on a motion to suppress and the fact that they are not represented in the warrant process—gives rise to a moral imperative demanding consideration of the Fifth Amendment. To do otherwise would be a miscarriage of justice.

This is pretty grand language, but I think it's wrong. The Supreme Court has been clear that the Fifth Amendment privilege against self-incrimination only comes into play when a person affirmatively asserts his Fifth Amendment privilege. As Justice Alito wrote in his controlling plurality opinion in Salinas v. Texas, there is ordinarily an "express invocation" requirement to the privilege. With a few exceptions presumably not implicated here, you have to affirmatively plead the Fifth before you can rely on the privilege. When you plead the Fifth, you put everyone on notice that you think you have rights at stake: A court can then assess whether the facts support your assertion of privilege.

Given the invocation requirement, I don't think a court can rule on the Fifth Amendment implications of a set of events that may or may not require someone to do something in which a person may or may not assert the privilege. You have to wait for the assertion of privilege to rule on it, I think.

Next, the court rules that biometric access will violate the Fifth Amendment because it is the functional equivalent of compelling a password. If the government tried to compel a person to disclose his password, the Fifth Amendment would be implicated; it should be no less implicated if the governmemnt figures out a way to access a device through biometric means. As the court puts it, "biometric features serve the same purpose of a passcode, which is to secure the owner's content, pragmatically rendering them functionally equivalent."

The Government expresses some urgency with the need to compel the use of the biometric features to bypass the need to enter a passcode. This urgency appears to be rooted in the Government's inability to compel the production of the passcode under the current jurisprudence. It follows, however, that if a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one's finger, thumb, iris, faee, or other biometric feature to unlock that same device.

But that doesn't follow. The reason compelling a passcode raises Fifth Amendment issues is that compulsion to disclose the password is testimonial. It requires a person to speak, either through express words or acts that necessarily imply a person's state of mind. Biometric access doesn't, at least outside very unusual circumstances presumably not raised here.

It's true that the purpose of bypassing biometric security is the same as the purpose of bypassing a password gate with a password. The purpose in both cases is to then search the device. But that's a Fourth Amendment issue, not a Fifth Amendment issue. The government already has established probable cause, satisfying the Fourth Amendment. The fact that a non-testimonial means of executing a search with a warrant happens to have the same purpose as a testimonial means doesn't make the former testimonial under the Fifth Amendment. It just means that they both require a warrant under the Fourth Amendment.

The court next argues that compelling a person to place a finger on a reader (or use any other biometric forms of access) has a testimonial aspect: "the act concedes that the phone was in the possession and control of the suspect, and authenticates ownership or access to the phone and all of its digital contents." But I have to respectfully disagree with that, too. I think Judge Westmore is mixing up the testimonial significance of an act with its evidentiary significance.

As I explained in this forthcoming article, the testimonial question under the Fifth Amendment is about what the person compelled is necessarily saying by completing the act. What thought does it reveal? Being compelled to place a finger on a reader doesn't reveal any thought. A person could do it asleep or dead. It may be that the fact that the fingerprint unlocks a particular phone gives the government important evidence; in Fifth Amendment terms, it may be incriminating. But it doesn't make it testimonial, so the Fifth Amendment privilege doesn't apply.

The court then concludes that the foregone conclusion doctrine doesn't apply. In the court's view, the foregone conclusion doctrine applies only if all of the evidentary value the evidence is known. But that can't be the case because electronic devices store so much information: "the Government inherently lacks the requisite prior knowledge of the information and documents that could he obtained via a search of these unknown digital devices, such that it would not be a question of mere surrender." I disagree with that part, as well, as I think the foregone conclusion doctrine only looks to whether the testimonial aspect of the act is known—not whether the evidentiary value of what the act may help reveal is known. Here there is no known testimonial act.

III. The Limit on Devices That Can Be Seized

I'll conclude by flagging a brief part of the opinion that is important but is also easy to miss. The court rules that the warrant cannot authorize the search and seizure of every computer found onsite:

The Government's request to search and seize all digital devices at the Subject Premises is similarly overbroad [as the request to get fingerprints from everyone onsite]. The Government cannot he permitted to search and seize a mobile phone or other device that is on a non-suspect's person simply because they are present during an otherwise lawful search.

While the warrant is denied, any resubmission must be limited to those devices reasonably believed by law enforcement to be owned or controlled by the two suspects identified in the affidavit.

I don't think that's right. The Ninth Circuit dealt with this most clearly in United States v. Adjani, where the government searched Adjani's apartment and seized (and later searched) a computer found there that belonged to someone else, Reinhold. The computer ended up having evidence on it, and Reinhold was charged together with Adjani. The Ninth Circuit rejected Reinhold's argument that her computer couldn't be searched on the ground that "probable cause analysis focuses not on the owner of the property, but rather on whether evidence of the crime can be found on the property given the circumstances."

Reinhold's argument that there was no probable cause to search her computer, a private and personal piece of property, because the warrant failed to list her as a "target, suspect, or co-conspirator" misunderstands Fourth Amendment jurisprudence. Although individuals undoubtedly have a high expectation of privacy in the files stored on their personal computers, we have never held that agents may establish probable cause to search only those items owned or possessed by the criminal suspect. The law is to the contrary. "The critical element in a reasonable search is not that the owner of the property is suspected of crime but that there is reasonable cause to believe that the specific `things' to be searched for and seized are located on the property to which entry is sought." Zurcher v. Stanford Daily, 436 U.S. 547, 556, 98 S.Ct. 1970, 56 L.Ed.2d 525 (1978); cf. United States v. Ross, 456 U.S. 798, 820-21, 102 S.Ct. 2157, 72 L.Ed.2d 572 (1982) ("A lawful search of fixed premises generally extends to the entire area in which the object of the search may be found and is not limited by the possibility that separate acts of entry or opening may be required to complete the search.").

I think that's equally true here. Further, the Ninth Circuit approved of the seizure and removal of computers to see if they contain the evidence sought in United States v. Hill, which I think is the correct rule as explained here.

Advertisement

NEXT: Brickbat: If at First You Don't Succeed

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  1. This is a good occasion to remind people with fingerprint scanner secured phones, (Or other devices.) that you don’t actually have to use your fingerprint to train them, other parts of your body work, too.

    Fat lot of good forcing you to put your finger tip on a phone is going to do, if you trained it to recognize your nose, or one of your knuckles.

    1. Or a rabbit’s foot on your key chain!

    2. I wonder how many peoples phones recognize a mushroom stamp

  2. It completely baffles me how law professionals can argue that compelled biometrics isn’t testimonial.

    By providing the biometric, the person/suspect is indeed saying, “I have a user/controlling relation with this device and therefore have a user/controlling relation with the data found on the device.”

    1. I think the problem may be that the Supreme Court has offered meaning to words in the Constitution that may be different from what a layperson might understand the words to mean.

      1. Thanks for the insult.

        Can you offer an example of when the Supreme Court has offered meaning to words in the Constitution that may be different from what a layperson might understand the words to mean – and specifically to the biometrics issue?

        1. I didn’t insult you, and I’m not sure why you’re taking offense. But in any event, I wrote a law review article on the Fifth Amendment and compelled decryption that you might find helpful to understand the Supreme Court’s guidance in this area. Google my name and “compelled decryption” and it will come up on SSRN.com in draft form.

    2. But the person isn’t saying that at all. The evidence is saying that, sure, but the person isn’t. It’s no different that taking a suspect’s fingerprints and comparing them to the fingerprints on the murder weapon — yes, the end result clearly says “he used this gun,” but it’s not the same as making the suspect actually say that. You’re just using the suspect’s fingerprints here, just in a different way that traditional fingerprint analysis.

      There may be other legal arguments against compelled biometrics, but I don’t think this one is legit.

      1. “But the person isn’t saying that at all. The evidence is saying that, sure, but the person isn’t. It’s no different that taking a suspect’s fingerprints and comparing them to the fingerprints on the murder weapon”

        Yes, it is different from taking a suspect fingerprints to compare to other evidence. In that case, they take all or your fingerprints and compare all of them. In the compelled unlock/decription case they require you to identify which finger you used.

        1. No, they don’t. That would be testimonial.

        2. What if it didn’t require you to identify which finger to use. There’s nothing I’ve seen in any of the documentation in this case that claimed that. One of the requests is facial recognition. Presumably, we’re dealing with individuals who only have one face.

          1. Presumably, we’re dealing with individuals who only have one face.

            So… not politicians, then?

    3. The testimony at issue is the information conveyed directly by the act, this is what the OP means about “mixing up the testimonial significance of an act with its evidentiary significance.” Providing a password at least testifies to knowledge of the password, but putting your index finger on a sensor when directed to do so only confirms you have an index finger, and they already knew that.

    4. Its because they get sucked into principles like “testimonial.”

      In fact, its more of a Fourth Amendment issue than a Fifth, but its clear the Constitution bars requiring a person to provide passwords, keys, eye approval, or fingerprint approval. Anybody who argues differently doesn’t understand the Constitution, whose purpose was to greatly restrict government.

  3. An odd aside. I agree that “Being compelled to place a finger on a reader doesn’t reveal any thought. A person could do it asleep or dead.” Many modern biometric access control devices (and, notably, biometrically-accessed food dispensers used on the African continent) measure heartbeat interval in addition to a primary factor (fingerprint, iris, et c.) in an attempt to assure that the primary factor is indeed currently attached to a living human: as Kerr notes, it would otherwise be possible gain access using a severed finger or gouged eye (or, borrowing from a comment above, a rabbit’s foot).

    Presence of a heartbeat indicates more than mere presence of a potentially severed finger or gouged eye. Heartbeat interval changes due to many factors, including the mood (panic state) of the individual; so, does measurement of heartbeat interval reveal thought (Fifth Amendment)?

  4. It’s a bit sad that biometric passwords, supposed to increase security, in effect decreases it by removing even the theory of the 5th Amendment (“foregone conclusion”, aside, which is yet another sophistry workaround of the spirit of the rights). Historically, far and away the biggest problem for humanity isn’t mundane criminality, but dictatatorial government. Every time our government bypasses, by tricky words, the spirit of the Constitution so law enforcement can get another prosecution tick mark on their annual reviews, billions around the world with an iron boot on their neck feel it press a little deeper

    1. If it weren’t for biometrics, most phone users would not accept having to enter a numeric passcode (let alone an 8-10 digit one, as recommended to prevent brute force).

  5. While law enforcement usually will argue that how the search is to be executed, warrants often contain such provisions. In the Dahlia case in which the agents had an order for a bug, but the order did not authorize a break in, the court upheld the break in as being part of the execution of the bug warrant. However, since then, such warrants explicitly authorize a break in.

    Here, the presence of an order reduces the risk of violence. A suspect shown a court order is more likely to comply than one who is told by law enforcement officers to put his finger on the phone.

  6. “Fingerprinting usually just requires reasonable suspicion, not probable cause. ”

    Is there a difference between fingerprinting, as when used in processing an arrestee, and applying someone’s finger to a biometric-enabled phone?

  7. I tried to think of the framework to Judge the Fourth Amendment requirement and, therefore, what standard of suspicion to use. I’ll start right off the bat that Supreme Court precedent (and the text of the Fourth Amendment) seem to make clear that you can’t have a search warrant on reasonable suspicion standard. As counterintuitive as it may seem, a warrant can only be issued upon finding of Probable Cause and, if the search doesn’t require Probable Cause, it has to be a warrantless search (with the exception of regulatory searches of housing under building codes).

    My instinct is the police need to have a bit more particularity when compelling biometric access. I didn’t find the requirements in this warrant to be unreasonable. But I also think I’m conflating the search with the act of unlocking. If the issue is an unlawful search, Probable Cause strikes me as the correct standard.

    On the other hand, what if the issue is the seizure of the individuals? In that case, the intrusion is relatively similar to a Terry Stop and, arguably, only RAS is required. Or should we consider the fact that the police have the power to detain all individuals present in a home during a search? Does that remove the suspicion requirement entirely?

    These aren’t easy answers to answer and it’s hard to say what box to put in the act of compelling people to submit their face to unlock a phone.

  8. I have to disagree with your opinion on the standard in this case for fingerprinting. But it’s based on a predicate that you don’t agree with, that it is in an ex ante warrant. The Fourth Amendment is clear that the warrant requires probable cause. So if it should be something in the warrant I think it must be supported be probable cause. Reasonable suspicion only works for your belief in ex post review.

  9. On the Fifth Amendment question, how does your opinion square with SCOTUS opinions on subpoenas for documents? Like Fisher v United States and United States v. Hubbell. The act of producing does have communicative effects or existence control and if they aren’t describing the documents the expect to be in the phone with reasonable particularity that would also seem to violate Hubbell.

    1. Hubbell was replying to a subpoena duces tecum, about which the Court said:

      It is apparent from the text of the subpoena itself that the prosecutor needed respondent’s assistance both to identify potential sources of information and to produce those sources. See Appendix, infra. Given the breadth of the description of the 11 categories of documents called for by the subpoena, the collection and production of the materials demanded was tantamount to answering a series of interrogatories asking a witness to disclose the existence and location of particular documents fitting certain broad descriptions.

      The search contemplated here wouldn’t require people present to go through their devices and select and retrieve incriminating documents.

  10. Professor Kerr, are you arguing that mere presence at the scene of the search provides probable cause to believe that the electronic devices in the personal possession of such persons contain evidence of the extortion crime police are investigating? That seems like a huge stretch to me. I don’t read the 9th Circuit case you cite for that proposition. Big difference between a PC at a location that the target may reasonably be believed to have access to, even if owned by someone else, and the personal electronic devices of persons who happen to be present at the scene when police arrive to execute the search warrant.

    1. I think Prof. Kerr is correct that the court announced the wrong test, but that the right test would have gotten it to the same place for the reasons you cite. Ownership or current possession of an electronic device isn’t the right standard, but if person A is suspected of a crime and there’s probable cause to think evidence is on his phone, that’s not remotely probable cause to think there’s evidence on other nearby people’s phones. A PC (which is what the Adjani case dealt with) is just not the same thing as a phone.

      1. Liberaltarian did understand Prof. Kerr correctly though, he quoted from Adjani then said “I think that’s equally true here”. The test you seem to be recommending, excluding phones possessed by nearby non-suspect persons, is what the magistrate judge wanted to apply and what Kerr rejected.

        1. The test you seem to be recommending, excluding phones possessed by nearby non-suspect persons,

          That’s not the test I’m recommending; that’s the result of the test. Prof. Kerr’s point (I think!) and mine is that there’s no categorical rule based on ownership/possession. The magistrate seemed to want there to be one.

          1. OK. Your test then would be that the warrant could authorize the seizure of PCs but not phones? I don’t see that it would enable effective searches since it would exclude the suspects’ phones too, but it might be permissible. But maybe that’s just me, I don’t see that an ownership condition is forbidden either.

            In Adjani the 9th circuit found that a warrant to seize computers that did not have an ownership restriction was sufficiently particular without one. There is no “categorical rule”, but that only means that warrants may be valid without a restriction, not that the restriction is impermissible. It might even be necessary, if the “location to be searched” contains computers belonging to many unconnected people.

  11. When you plead the Fifth, you put everyone on notice that you think you have rights at stake: A court can then assess whether the facts support your assertion of privilege.

    5th Amendment: No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.

    “nor shall be compelled in any criminal case to be a witness against himself” being the relevant phrase.

    1. We have an adversarial criminal justice system. The two sides are the individual and the representatives of the state. It seems to me that “nor shall be compelled in any criminal case to be a witness against himself” means that I cannot be compelled to assist my adversary. The Fifth Amendment nowhere says anything about self-incrimination. If the police want something from me, it means that they think it will help them, and the Fifth means that I don’t have to give it to them. Giving them any thing or information that they want means, in some fashion, bearing witness against myself.

      The Fourth and the Fifth are joined at the hip, recognizing my right not to cooperate. In the instant case, a judge should have a highly compelling reason to issue a warrant that overrides my rights. Other interpretations of these amendments is a perversion of their true purpose.

  12. We need to look to Congress, not courts for relief on these questions. The courts are up to their necks on stretched analogies to past cases.

    It really upset me when the oral arguments in United States v. Antoine Jones focused on whether the GPS tracker was attached to a car. While they contemplated that, the whole country was adopting smart phones that can be tracked without police action. Technology changes much faster than the courts can every keep up with.

    IMO, the obstacle is our collective lack of imagination in crafting privacy legislation. We can’t agree on how to define it or what to write into the law that could serve us for decades rather than just months.

  13. There are a lot of people walking around on our streets on some type of supervised or conditional release. It would be nice if they were flagged somehow so that cops could immediately identify them. For instance, a man loitering outside Beautiful Cherub Day Care Center might be involuntarily iris scanned and told, “Sir, you are a registered sex offender and you are under arrest.”

    Within jails, where I used to work, finger print readers have come into common use daily for a lot of things: dispensing medicines, dispatching the right inmate to an approved visit, temporary and permanent releases, and so forth. In the past officers having to visually compare fingerprint cards was tedious and often wrong, resulting in people facing huge prison time being released from jail by impersonating a misdemeanor pal.

    Here is a common jail incident. Two inmates get in a terrible bloody battle. They both require immediate transport to an outside hospital. They have photo wristbands on, but are they the right ones? Their faces are swollen and bloody, after all. Next problem, once in the hospital, one of the inmates hits their escort with a bedpan and escaped (happened!)

    It would really be helpful if police frantically searching for the escapee on the street could iris scan solitary men with swollen faces out for a stroll and rule them in or out and get on with the search. Legal?

Please to post comments

Comments are closed.