Judge Rules Police Cannot Require People to Unlock Their Own iPhones With Thumb or Iris
Compelled use of facial and finger recognition features runs afoul of the Fifth Amendment.
A recent court ruling highlights the importance of strong legal protections for smartphone privacy--and should remind us that current law does only a scattershot job of protecting our electronic data.
In an opinion published January 10, a federal magistrate judge in Oakland, California, ruled that the Fifth Amendment's protections against self-incrimination extend to phones equipped with biometric locks. Federal police can search a residence, the court ruled, but may not force anyone present during a search to hold their finger, thumb, iris, or other body part up against a phone to try to unlock it.
This opinion follows a series of cases involving compelled disclosures of passphrases that unlock mobile phones. Some courts, but not all, have reached the conclusion that forcing a criminal defendant to divulge a passphrase runs afoul of the Fifth Amendment, which says no person "shall be compelled in any criminal case to be a witness against himself."
There are good reasons to think this is the right result, at least in this case. Despite determined efforts by the cypherpunks in the 1990s, as technology has advanced, so has the amount and variety of data that law enforcement can access. Most electronic communications, including email and Facebook Messenger, are stored in unencrypted form and can be obtained by police. AT&T, Verizon, and other wireless providers record the locations of customers' mobile devices, which are accessible with a warrant. Records of calls receive less privacy protection than that.
Our society's databasification has reached an advanced stage. The vast majority of transactions at stores, restaurants, and gas stations use credit and debit cards instead of cash, and law enforcement can obtain those records without a warrant (sometimes even in real time). Cloud storage has largely replaced local storage. Traffic cameras, automatic license plate identification, and electronic toll tags add to this pool of data.
Any one of these developments might not have had a dramatic impact on privacy. Taken together, they've handed law enforcement an all-encompassing suite of investigative powers: the Justice Department's Electronic Surveillance Manual (2005 edition) weighs in at no fewer than 228 pages. As databases balloon and governmental authority expands, electronic privacy has shrunk.
Taking a muscular view of Fifth Amendment protections for mobile devices can tilt this balance back toward the individual.
This brings us to the January 10 ruling by U.S. Magistrate Judge Kandis Westmore, which involves a criminal investigation into alleged extortion. Some suspects allegedly used Facebook Messenger to threaten to distribute an embarrassing video unless the victim paid them off. Police sought a court order allowing them to raid an Oakland residence and use the biometrics--faces, irises, fingerprints, thumbprints--of anyone present to unlock any electronic devices discovered in that search.
It's not a perfect test case for either law enforcement or privacy advocates. First, because law enforcement has the ability to use legal process to obtain the communications and other account data including IP address directly from Facebook, it's not clear that unlocking any mobile devices is necessary. Second, the request to unlock mobile devices seized from "any individual present at the time of the search"--even if that person is an innocent guest and not a suspect--is overly broad and intrusive. A narrower request from prosecutors would avoid these constitutional questions.
If the Justice Department appeals, it will be able to raise fairly strong arguments: if criminal defendants can be forced to provide fingerprints, blood tests, cheek DNA swabs, handwriting samples, and voice samples, why not biometric samples as well? Courts have ruled such compelled activities are not "testimonial," meaning the Fifth Amendment presents no obstacle to the government demanding them.
On the other hand, courts have taken a dim view of governmental fishing expeditions into a potential defendant's records. Clinton crony Webb Hubbell, who was investigated by Ken Starr in a case that ended up before the U.S. Supreme Court, objected to Starr's demands for tens of thousands of pages of personal files. A majority of the justices agreed with Hubbell's arguments, saying it has "long been settled that [the Fifth Amendment's] protection encompasses compelled statements that lead to the discovery of incriminating evidence." (Also off-limits under the Fifth Amendment, because of its testimonial nature, is a compelled polygraph test.)
Courts should extend the same logic to our phones, which store far more data than appeared in Hubbell's Whitewater Development Corporation files. As we use our phones for increasingly personal, intimate purposes, police should need more than mere suspicion that a crime was committed--not even by you, but by someone you're visiting!--to force you to unlock it and divulge the contents.
In some cases, as virtual assistants become more capable and trusted, perhaps certain deeply personal data should simply become off-limits to the government. This would follow other legal privileges, including the attorney-client privilege, the marital privilege, the clergy privilege (protecting both formal confessions as in the Catholic Church and confidential communications to other clerics), the accountant-client privilege, and the physician-patient privilege. Not one is absolute; exceptions exist for future crime or fraud, and a privilege can be waived in other ways.
This will not happen anytime soon, if it ever does. So for now, a friendly reminder: if you have a newer iPhone, squeezing the side button and volume up or down will turn off Touch ID and Face ID. Newer Android devices have lockdown mode, which requires a passphrase to unlock your device. Perhaps future smartphones will lock themselves down when taken to a police station that's not whitelisted in advance. If the law lags behind, technology can help to fill in the gaps.
