Courts

Judge Rules Police Cannot Require People to Unlock Their Own iPhones With Thumb or Iris

Compelled use of facial and finger recognition features runs afoul of the Fifth Amendment.

|

|||Kamachi209/Dreamstime.com
Kamachi209/Dreamstime.com

A recent court ruling highlights the importance of strong legal protections for smartphone privacy–and should remind us that current law does only a scattershot job of protecting our electronic data.

In an opinion published January 10, a federal magistrate judge in Oakland, California, ruled that the Fifth Amendment's protections against self-incrimination extend to phones equipped with biometric locks. Federal police can search a residence, the court ruled, but may not force anyone present during a search to hold their finger, thumb, iris, or other body part up against a phone to try to unlock it.

This opinion follows a series of cases involving compelled disclosures of passphrases that unlock mobile phones. Some courts, but not all, have reached the conclusion that forcing a criminal defendant to divulge a passphrase runs afoul of the Fifth Amendment, which says no person "shall be compelled in any criminal case to be a witness against himself."

There are good reasons to think this is the right result, at least in this case. Despite determined efforts by the cypherpunks in the 1990s, as technology has advanced, so has the amount and variety of data that law enforcement can access. Most electronic communications, including email and Facebook Messenger, are stored in unencrypted form and can be obtained by police. AT&T, Verizon, and other wireless providers record the locations of customers' mobile devices, which are accessible with a warrant. Records of calls receive less privacy protection than that.

Our society's databasification has reached an advanced stage. The vast majority of transactions at stores, restaurants, and gas stations use credit and debit cards instead of cash, and law enforcement can obtain those records without a warrant (sometimes even in real time). Cloud storage has largely replaced local storage. Traffic cameras, automatic license plate identification, and electronic toll tags add to this pool of data.

Any one of these developments might not have had a dramatic impact on privacy. Taken together, they've handed law enforcement an all-encompassing suite of investigative powers: the Justice Department's Electronic Surveillance Manual (2005 edition) weighs in at no fewer than 228 pages. As databases balloon and governmental authority expands, electronic privacy has shrunk.

Taking a muscular view of Fifth Amendment protections for mobile devices can tilt this balance back toward the individual.

This brings us to the January 10 ruling by U.S. Magistrate Judge Kandis Westmore, which involves a criminal investigation into alleged extortion. Some suspects allegedly used Facebook Messenger to threaten to distribute an embarrassing video unless the victim paid them off. Police sought a court order allowing them to raid an Oakland residence and use the biometrics–faces, irises, fingerprints, thumbprints–of anyone present to unlock any electronic devices discovered in that search.

It's not a perfect test case for either law enforcement or privacy advocates. First, because law enforcement has the ability to use legal process to obtain the communications and other account data including IP address directly from Facebook, it's not clear that unlocking any mobile devices is necessary. Second, the request to unlock mobile devices seized from "any individual present at the time of the search"–even if that person is an innocent guest and not a suspect–is overly broad and intrusive. A narrower request from prosecutors would avoid these constitutional questions.

If the Justice Department appeals, it will be able to raise fairly strong arguments: if criminal defendants can be forced to provide fingerprints, blood tests, cheek DNA swabs, handwriting samples, and voice samples, why not biometric samples as well? Courts have ruled such compelled activities are not "testimonial," meaning the Fifth Amendment presents no obstacle to the government demanding them.

On the other hand, courts have taken a dim view of governmental fishing expeditions into a potential defendant's records. Clinton crony Webb Hubbell, who was investigated by Ken Starr in a case that ended up before the U.S. Supreme Court, objected to Starr's demands for tens of thousands of pages of personal files. A majority of the justices agreed with Hubbell's arguments, saying it has "long been settled that [the Fifth Amendment's] protection encompasses compelled statements that lead to the discovery of incriminating evidence." (Also off-limits under the Fifth Amendment, because of its testimonial nature, is a compelled polygraph test.)

Courts should extend the same logic to our phones, which store far more data than appeared in Hubbell's Whitewater Development Corporation files. As we use our phones for increasingly personal, intimate purposes, police should need more than mere suspicion that a crime was committed–not even by you, but by someone you're visiting!–to force you to unlock it and divulge the contents.

In some cases, as virtual assistants become more capable and trusted, perhaps certain deeply personal data should simply become off-limits to the government. This would follow other legal privileges, including the attorney-client privilege, the marital privilege, the clergy privilege (protecting both formal confessions as in the Catholic Church and confidential communications to other clerics), the accountant-client privilege, and the physician-patient privilege. Not one is absolute; exceptions exist for future crime or fraud, and a privilege can be waived in other ways.

This will not happen anytime soon, if it ever does. So for now, a friendly reminder: if you have a newer iPhone, squeezing the side button and volume up or down will turn off Touch ID and Face ID. Newer Android devices have lockdown mode, which requires a passphrase to unlock your device. Perhaps future smartphones will lock themselves down when taken to a police station that's not whitelisted in advance. If the law lags behind, technology can help to fill in the gaps.

NEXT: The 7 Most Insane Licensing Proposals of 2019 (So Far)

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  1. Smash your phone when they come busting down the door.

    1. Destroy your own property so the police can’t illegally search your electronics. Yeah, that’ll teach ’em.

    2. Smashing a phone or computer may make it inoperable but data still remains on the hard drive. It is common practice to extract info from hard drives that have been thrown out of winders, put into water, etc. When a hard drive is broken and unable to boot in the usual way options are available to create a mirror image of the hard drive and boot it as an external drive from a working computer. Police will need a data recovery program to help retrieve your data back if it was merely put in the waste basket and emptied without using a secure overwrite. This is done every day some place so breaking the functionality of the phone/computer means very little to retrieving the data.

      Plus doing so may create more problems for the target of the investigation such as an obstruction charge and can also be used by the prosecutor to show ‘consciousness of guilt’ (i.e. you knew there was something illegal on the device you tried to destroy)..

      The best thing to do (in my opinion) is encrypt your phone/computer, wipe it on a weekly basis so that unused or deleted data is permanently destroyed using a DOD approved algorithm (at least a 7 pass wipe), and if the police do bust down the door – simply invoke your right to speak with an attorney and decline to provide your password or biometrics. Of course, the best thing to do is do not things that may get your door knocked off the hinges.

      Best to everyone here regardless of your views – Darren Chaker

      1. “Of course, the best thing to do is do not things that may get your door knocked off the hinges.”

        I cannot hold my breath that long.

    3. Smash your phone?!
      Just use someone else’s biometrics to unlock your phone. Sure it’s a little inconvenient but so is prison.

      1. Or just tell them the unlock is My Attorney Please. They will likely take you to jail regardless so I see no loss.

  2. One thing I have never understood is why the Supreme Court had to invent a right to privacy from the penumbras of the Constitution. The 4th and 5th amendments are all about privacy, just worded in that quaint Constitutional lingo.

    As usual, they had to come up with some idiotic justification for plain language, because plain language is too honest and simple. And now they don’t dare admit the stare decisis decisions were too complicated and Rube-Goldberg, so there’s a new roundabout rationalization.

    1. One thing I have never understood is why the Supreme Court had to invent a right to privacy from the penumbras of the Constitution. The 4th and 5th amendments are all about privacy, just worded in that quaint Constitutional lingo.

      You have a rather narrow understanding then. Does the phrase “Free as in beer or free as in speech.” make sense to you? In either case does the direct or indirect provider or recipient matter? If it’s “No.” in both cases, then how do you distinguish between the government adjudicating fraud or other property crimes and/or just outright despotic rule? Does everybody have a right to know anything/everything or no one has a right to any knowledge?

      I don’t disagree with your overarching theme, I think the right to privacy is a fraudulent fabrication, but I think it’s because it inappropriately invented as independent from the 4th and 5th; obligating the government to protect or defend property not held. I don’t think ignoring the inherent difference between property and information enhances the understanding of the nuance or distinction.

      1. Your last paragraphs sums up what I said. Your first paragraph pretends otherwise.

  3. Perhaps future smartphones will lock themselves down when taken to a police station that’s not whitelisted in advance.

    If *that’s* not the suspicious behavior of a potential terrorist, I don’t know what is!

    1. Obstruction of justice charges in 3…2…1…

  4. If the Justice Department appeals, it will be able to raise fairly strong arguments

    If the Justice Department appeals, it’s going to get a majority opinion, co-authored by Neil and Sonia, right in the teeth.

  5. Yeah, the cops out there protecting people’s rights except when they are busy violating our rights and justifying it afterwards.

  6. Or acknowledge that all internet capable devices are grabbing your data, and do nothing illegal or embarrassing.

    1. Ok. Because illegal is not being constantly added to. How long before certain words are codified as actual violence, hence illegal? The current SJWs are on that track.

  7. I had certain people send this ruling to me earlier in the week telling me I have no reason to fear the biometrics now. They failed to see the issue in that the judge actually stated they would likely accept the warrant without issue if the scope were narrowed to not list everyone in the house.

    So this isn’t really a win, as noted in the article.

  8. A court does its job! Amazing!

    Now we just need all of them to do so.

    The courts have failed when they required people to unlock safes, then their computers, then their phones.

    Nobody should be compelled to do that unless they are a WITNESS.

  9. Bitsgap gives you access to the largest exchanges in one unified place
    This amazing platform has all major exchanges where you can trade your favorite pairs without having multiple tabs open.
    Join for FREE – https://bitsgap.com

  10. Nice post..!! after that crime rate also goes down via usage of smartphones. if you need email help and support service for setting up email on iPhone, Android or any other devices. kindly connect with us and get an appropriate solution for email issues.

Please to post comments

Comments are closed.