Feds can’t force you to unlock your phone with finger or face, says judge

A Northern California federal judge ruled last week that police can’t force suspects to unlock their phones with their fingers, eyes or face, even with a warrant, because it amounts to the same type of self-incrimination as being forced to hand over your passcode.

If other courts apply her decision, it could set an important precedent in Fifth Amendment interpretation and the debate between compelling suspects to use “what they are” (i.e., forced use of their bodies) vs. “what they know” (i.e., forcing suspects to unlock their brains to get at their passcodes).

As Forbes reports, Judge Kandis Westmore ruled that compelled testimony is compelled testimony, regardless of whether it’s a passcode uttered aloud or a forced finger swipe. In this day and age, multiple forms of authentication unlock treasure troves of personal data, she wrote.

If a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device.

Judge Westmore wrote the decision in denial of a warrant to police who were investigating alleged extortion in Oakland, California. The suspects allegedly used Facebook Messenger to threaten a man with the release of an embarrassing video unless he coughed up money.

Police had two suspects, but they wanted the go-ahead to compel anybody located on the same premises to unlock their devices, be it with a finger/thumb, face or iris. Judge Westmore denied the request for a search warrant on Fourth and Fifth Amendment grounds.

She agreed that the officers had probable cause to search the suspects’ property, but not to unlock any and all devices or compel people to do so. That would be a fishing expedition, she said. The government can’t be permitted to search and seize people’s devices just because they happen to be present during a lawful search.

With regards to the Fifth Amendment, it protects against suspects being forced to be witnesses against themselves. In this particular case, Judge Westmore wrote, the issue is whether the use of a suspect’s biometrics to unlock their device(s) is considered “testimonial” under the Fifth Amendment.

Courts are trying to keep pace with technology

The challenge facing courts is that “technology is outpacing the law,” the judge wrote. She referred to a recent case in which the US Supreme Court told courts that they needed to adopt rules that “take account of more sophisticated systems that are already in use or in development.”

The case she referred to, Carpenter v. United States, had to do with a Radio Shack robbery and the privacy of the phone location data that got the robber convicted. In June 2018, the Supreme Court ruled it unlawful for law enforcement and federal agencies to access cellphone location records without a warrant.

The decision said that courts “have an obligation to safeguard constitutional rights and cannot permit those rights to be diminished merely due to the advancement of technology.”

In the past, using biometrics to unlock devices has been compared to compelled fingerprinting or DNA swabs. Judge Westmore wrote that it should more rightly be thought of as a shortcut for a passcode, given that they both secure a device owner’s content – “pragmatically rendering them functionally equivalent.”

Her decision could be significant for both digital privacy and the law around search and seizure of connected devices. However, there’s no guarantee that it won’t be challenged or overturned. As it is, that law has continued to evolve, and there’s been a patchwork of contradictory findings.

A little history of finger forcing

Ever since Apple introduced Touch ID, many privacy and legal experts have said that biometric information such as fingerprints are like our DNA samples or our voice imprints: they’re simply a part of us. They don’t reveal anything that we know, meaning that they don’t count as testimony against ourselves.

Therefore, the prevailing thinking has gone, forcing suspects to press their fingers to get into a phone doesn’t breach their Fifth Amendment rights against forced self-incrimination.

It’s similar to when police with a search warrant demand a key to a lockbox that contains incriminating evidence, the Supreme Court has suggested: turning over the key is just a physical act, not “testimony” about something we know.

Over the years, there have been numerous court cases where that line of thinking has supported forced biometrics unlocking as well as people’s rights not to be forced into giving up passcodes. Here are just a few of those:

• In 2014, when an Emergency Medical Services captain was charged with trying to strangle his girlfriend, a judge declared that cops could force phone unlocking with your fingerprint, but not with your passcode. Law enforcement in that case were after footage possibly recorded on video equipment in the suspect’s bedroom that might have shown the fight.
• In 2015, a Pennsylvania federal district court confirmed Fifth Amendment protection for passcodes in an insider trading case.
• In 2016, a Los Angeles judge forced a woman to unlock her iPhone with her finger so that police could get at evidence in a case concerning her alleged gang member boyfriend.
• In October 2018, we saw the first known case of a suspect being forced to unlock his iPhone with his face.

The reasoning hasn’t always been applied that way, though. In 2016, a Philadelphia court said that a suspected child abuser would stay locked up indefinitely until he decrypted the drive that investigators thought contained abuse imagery, Fifth Amendment or no Fifth Amendment.

Similarly, there’s no guarantee that other courts will choose to apply this recent no-forced-biometrics ruling. We’ll be sure to keep an eye on how the courts continue to adapt in this age of connected devices, but for now, the safest thing to do if you care about your data privacy is likely the same as always: use a passcode instead of biometrics. The privacy of that approach is supported by a good deal of court rulings.