Search Warrants and Compelled Biometric Access to Phones

A new ruling, and some (mostly critical) thoughts.

Magistrate Judge Kandis Westmore of the U.S. District Court in Oakland, California, recently handed down an opinion denying a search warrant application because the prosecutors asked for a provision compelling everyone present to submit to a fingerprint or other biometric means of unlocking digital devices found there. According to Magistrate Judge Westmore, such a provision would violate the Fourth and Fifth Amendments.

Judge Westmore also ruled that it would be impermissible for the warrant to allow a seizure of all devices on the scene. In her view, the warrant can only authorize the seizure of devices "reasonably believed by law enforcement to be owned or controlled by the two suspects identified in the affidavit."

I think this opinion is partially right on one issue but mostly takes the wrong track. I agree that the compelled biometric provision is impermissible. But I mostly disagree with Judge Westmore as to why that's the case. And I think the second ruling, that not all devices can be seized, is mistaken. Here are the details, for those interested.

I. Compelled Biometrics Under the Fourth Amendment

Let's start with the compelled-biometrics ruling. The court first rules that this provision is not permissible under the Fourth Amendment because the government hasn't established probable cause as to each person who might be compelled to unlock the device. From the opinion:

[T]he Government seeks an order that would allow agents executing this warrant to compel "any individual, who is found at the Subject Premises and reasonably believed by law enforcement to be a user of the device, to unlock the device using biometrie features…." (Aff. 117h.) This request is overbroad. There are two suspects identified in the affidavit, but the request is neither limited to a particular person nor a particular device.

Thus, the Court finds that the Application does not establish sufficient probable cause to compel any person who happens to he at the Subject Premises at the time of the search to provide a finger, thumb or other biometric feature to potentially unlock any unspecified digital device that may be seized during the otherwise lawful search.

I think the court has the right instinct, but I don't think the issue is worked out quite the way it should be.

The first question is whether these sorts of provisions shold be permitted in warrants at all. There isn't much law on this, but let me offer my view that compelled biometric provisions categorically don't belong in warrants. The problem is that warrants can't try to regulate how a search is executed. Warrants have to say where the search is executed and what the government can seize there. But I think that what happens onsite—the details of how the warrant is executed—is a matter of case-by-case Fourth Amendment reasonableness that has to be litigated ex post rather than resolved as a rule ex ante. Given that, I think that the compelled biometric provision is an impermissible effort to regulate the details of the warrant's execution. The government can't settle their powers in the warrant ahead of time: They need to act reasonably when the warrant is actually executed.

Granted, my view above is just my opinion. I recognize that there's room in the Ninth Circuit for a different answer. The Ninth Circuit in United States v. Comprehensive Drug Testing took a very favorable view of ex ante search restrictions in warrants. Given that decision, it's at least plausible that ex ante restrictions can also extend to regulating unlocking. But if so, that raises the question of what standard applies to compel biometric access. It's hard to say what that standard is, I think, as the reasonableness standard for compelling any particular biometric access could depend on the facts. In general, though, I'm skeptical of Judge Westmore's apparent assumption that probable cause would be needed to compel a person to submit to a means of biometric access. Fingerprinting usually just requires reasonable suspicion, not probable cause. We don't know if the government would have reasonable suspicion, as we don't know the facts yet. But I think the Fourth Amendment standard is likely lower than Judge Westmore assumes.

In summary: For this part of the opinion, on the Fourth Amendment issue, I eagree with Judge Westore as to the result but have some disagreement as to the reasoning.

II. Compelled Biometrics Under the Fifth Amendment

The court next makes the very surprising holding that mandating biometric access would violate the Fifth Amendment privilege against self-incrimination. This is the part of the opinion that has drawn the most attention. But I think this ruling is incorrect for several reasons.

The first question raised by the Fifth Amendment aspects of compelled biometric access is whether it can be adjudicated now, before the warrant is signed. The opinion concludes that, as a matter of "moral imperative," it has to be adjudicated before the warrant is signed:

The undersigned has found no legal authority explicitly restricting the Court from considering the privileges and protections afforded by the Fifth Amendment prior to signing a warrant. In fact, the prejudice that suspects may suffer should the Fifth Amendment be ignored at this juncture—both due to the practical difficulty in prevailing on a motion to suppress and the fact that they are not represented in the warrant process—gives rise to a moral imperative demanding consideration of the Fifth Amendment. To do otherwise would be a miscarriage of justice.

This is pretty grand language, but I think it's wrong. The Supreme Court has been clear that the Fifth Amendment privilege against self-incrimination only comes into play when a person affirmatively asserts his Fifth Amendment privilege. As Justice Alito wrote in his controlling plurality opinion in Salinas v. Texas, there is ordinarily an "express invocation" requirement to the privilege. With a few exceptions presumably not implicated here, you have to affirmatively plead the Fifth before you can rely on the privilege. When you plead the Fifth, you put everyone on notice that you think you have rights at stake: A court can then assess whether the facts support your assertion of privilege.

Given the invocation requirement, I don't think a court can rule on the Fifth Amendment implications of a set of events that may or may not require someone to do something in which a person may or may not assert the privilege. You have to wait for the assertion of privilege to rule on it, I think.

Next, the court rules that biometric access will violate the Fifth Amendment because it is the functional equivalent of compelling a password. If the government tried to compel a person to disclose his password, the Fifth Amendment would be implicated; it should be no less implicated if the governmemnt figures out a way to access a device through biometric means. As the court puts it, "biometric features serve the same purpose of a passcode, which is to secure the owner's content, pragmatically rendering them functionally equivalent."

The Government expresses some urgency with the need to compel the use of the biometric features to bypass the need to enter a passcode. This urgency appears to be rooted in the Government's inability to compel the production of the passcode under the current jurisprudence. It follows, however, that if a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one's finger, thumb, iris, faee, or other biometric feature to unlock that same device.

But that doesn't follow. The reason compelling a passcode raises Fifth Amendment issues is that compulsion to disclose the password is testimonial. It requires a person to speak, either through express words or acts that necessarily imply a person's state of mind. Biometric access doesn't, at least outside very unusual circumstances presumably not raised here.

It's true that the purpose of bypassing biometric security is the same as the purpose of bypassing a password gate with a password. The purpose in both cases is to then search the device. But that's a Fourth Amendment issue, not a Fifth Amendment issue. The government already has established probable cause, satisfying the Fourth Amendment. The fact that a non-testimonial means of executing a search with a warrant happens to have the same purpose as a testimonial means doesn't make the former testimonial under the Fifth Amendment. It just means that they both require a warrant under the Fourth Amendment.

The court next argues that compelling a person to place a finger on a reader (or use any other biometric forms of access) has a testimonial aspect: "the act concedes that the phone was in the possession and control of the suspect, and authenticates ownership or access to the phone and all of its digital contents." But I have to respectfully disagree with that, too. I think Judge Westmore is mixing up the testimonial significance of an act with its evidentiary significance.

As I explained in this forthcoming article, the testimonial question under the Fifth Amendment is about what the person compelled is necessarily saying by completing the act. What thought does it reveal? Being compelled to place a finger on a reader doesn't reveal any thought. A person could do it asleep or dead. It may be that the fact that the fingerprint unlocks a particular phone gives the government important evidence; in Fifth Amendment terms, it may be incriminating. But it doesn't make it testimonial, so the Fifth Amendment privilege doesn't apply.

The court then concludes that the foregone conclusion doctrine doesn't apply. In the court's view, the foregone conclusion doctrine applies only if all of the evidentary value the evidence is known. But that can't be the case because electronic devices store so much information: "the Government inherently lacks the requisite prior knowledge of the information and documents that could he obtained via a search of these unknown digital devices, such that it would not be a question of mere surrender." I disagree with that part, as well, as I think the foregone conclusion doctrine only looks to whether the testimonial aspect of the act is known—not whether the evidentiary value of what the act may help reveal is known. Here there is no known testimonial act.

III. The Limit on Devices That Can Be Seized

I'll conclude by flagging a brief part of the opinion that is important but is also easy to miss. The court rules that the warrant cannot authorize the search and seizure of every computer found onsite:

The Government's request to search and seize all digital devices at the Subject Premises is similarly overbroad [as the request to get fingerprints from everyone onsite]. The Government cannot he permitted to search and seize a mobile phone or other device that is on a non-suspect's person simply because they are present during an otherwise lawful search.

While the warrant is denied, any resubmission must be limited to those devices reasonably believed by law enforcement to be owned or controlled by the two suspects identified in the affidavit.

I don't think that's right. The Ninth Circuit dealt with this most clearly in United States v. Adjani, where the government searched Adjani's apartment and seized (and later searched) a computer found there that belonged to someone else, Reinhold. The computer ended up having evidence on it, and Reinhold was charged together with Adjani. The Ninth Circuit rejected Reinhold's argument that her computer couldn't be searched on the ground that "probable cause analysis focuses not on the owner of the property, but rather on whether evidence of the crime can be found on the property given the circumstances."

Reinhold's argument that there was no probable cause to search her computer, a private and personal piece of property, because the warrant failed to list her as a "target, suspect, or co-conspirator" misunderstands Fourth Amendment jurisprudence. Although individuals undoubtedly have a high expectation of privacy in the files stored on their personal computers, we have never held that agents may establish probable cause to search only those items owned or possessed by the criminal suspect. The law is to the contrary. "The critical element in a reasonable search is not that the owner of the property is suspected of crime but that there is reasonable cause to believe that the specific `things' to be searched for and seized are located on the property to which entry is sought." Zurcher v. Stanford Daily, 436 U.S. 547, 556, 98 S.Ct. 1970, 56 L.Ed.2d 525 (1978); cf. United States v. Ross, 456 U.S. 798, 820-21, 102 S.Ct. 2157, 72 L.Ed.2d 572 (1982) ("A lawful search of fixed premises generally extends to the entire area in which the object of the search may be found and is not limited by the possibility that separate acts of entry or opening may be required to complete the search.").

I think that's equally true here. Further, the Ninth Circuit approved of the seizure and removal of computers to see if they contain the evidence sought in United States v. Hill, which I think is the correct rule as explained here.