Slashdot Mirror
Virginia Court: LEOs Can Force You To Provide Fingerprint To Unlock Your Phone
schwit1 writes with news of a Circuit Court decision from Virginia where a judge has ruled that a criminal defendant cannot use Fifth Amendment protections to safeguard a phone that is locked using his or her fingerprint.
According to Judge Steven C. Fucci, while a criminal defendant can't be compelled to hand over a passcode to police officers for the purpose of unlocking a cellular device, law enforcement officials can compel a defendant to give up a fingerprint. The Fifth Amendment states that "no person shall be compelled in any criminal case to be a witness against himself," which protects memorized information like passwords and passcodes, but it does not extend to fingerprints in the eyes of the law, as speculated by Wired last year.
Frucci said that "giving police a fingerprint is akin to providing a DNA or handwriting sample or an actual key, which the law permits. A passcode, though, requires the defendant to divulge knowledge, which the law protects against, according to Frucci's written opinion."
Yet another reason not to use biometrics to unlock devices.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Giving a fingerprint for the purpose is basically the same as giving a passcode, since either way they get access all sorts of information on your phone, which you're forced to help them retrieve. Unsurprising that a judge would try to find 'clever' ways around the spirit of the constitution and put little thought into their decision.
In reality, they shouldn't be able to force you to do any such thing. No passcodes, and no fingerprints for the purposes of granting them access to your information.
my fingerprint.
you didn't use your finger?
Just chew them off which ever finger print unlocks the phone. They don't get your info, and you get an insanity plea.
XDInd
So what's next you can be forced to be scanned and have your thoughts read, it's not testifying in the verbal or written sense. Letter by letter realtime
Tooo slippery...
The cops can do any damn thing they want, and nobody's lifting a finger to stop them. On the contrary, most people thing this is a good thing. That little factoid will be confirmed when the numbers start rolling in Tuesday night/Wednesday morning. It is not going to get any better any time soon. So, like they say, relax, it will hurt a lot less.
“He’s not deformed, he’s just drunk!”
Kind of gives a new meaning to giving the cops the finger...
So if a cop ever demands you unlock your phone for them, be sure to give them the finger!
D-
That fingerprint crap sucks.
"If any question why we died, Tell them because our fathers lied."
This is like being required to sign your name.
The security feature on your phone is designed to not unlock unless you signify approval.
Giving up a key or DNA sample is not signifying your approval; it's just surrendering information which is stored outside your brain.
Chop the finger off and burn it. Better than some sentences that could be handed out.
Your lack of privacy rights for American citizens do not apply to people who may or may not be citizens of countries you signed treaties with.
Translation: Nope.
When the US Senate affirms an international treaty, it overrides all lower decisions, including those of the US House signed into law.
Virginia is for lusers.
-- Tigger warning: This post may contain tiggers! --
Police have been collecting finger prints for decades, and they have caught thousands, if not millions, of criminals they otherwise wouldn't have caught as a result.
All this judge said was that you using your fingerprint on your phone doesn't give you a "get out of fingerprinting free" card when you get arrested. If it did every criminal in America would lock their phone with a fingerprint so they didn't have to get fingerprinted.
iOS implements this simply: after 48 hours of not logging in, or a phone reboot, it requires a passcode.
Any decent lawyer should be able to postpone any forcible press.
That being said, we are slowly losing our liberties.
Your lack of privacy rights for American citizens do not apply to people who may or may not be citizens of countries you signed treaties with.
Translation: Nope.
When the US Senate affirms an international treaty, it overrides all lower decisions, including those of the US House signed into law.
Virginia is for lusers.
No, that's not necessarily true.
There is a distinction between "self-executing treaties" and "non-self-executing treaties." Self-executing treaties become binding law when they are ratified by the Senate; non-self-executing treaties do not.
So non-self-executing treaties are still commitments the United States has made, but they are almost never considered part of the law of the United States. Rather, laws have to passed to satisfy those commitments.
Why not add a feature to register one or more of your fingers as "duress fingers" that trigger an immediate data wipe if used. Or if used, revert back to long password required.
What about the knowledge of which finger to use? Can they just try them all?
Assorted stuff I do sometimes: Lemuria.org
Lesson here is: if it appears you are going to be arrested, and you have the luxury of a few moments, turn off your phone.
I use my middle finger for the ID.
"Here ya go, Mr. Judge..."
Table-ized A.I.
If that's the case, then a possible solution would be an encryption that unlocks on one specific finger's fingerprint, but deletes all phone data for the other nine fingers. Since the ruling says you have to provide your fingerprints fine, but the knowledge of which finger's fingerprint is the correct one is knowledge in your brain, which doesn't have to be divulged. This would also, obviously, need to be combined with secure hardware that prevents the cops from simply copying the data and trying the fingerprints one at a time with the copy.
That way, you still have the convenience of a fingerprint unlock, but extra security against seisure, since the cops would only have a 10% chance of guessing the right finger.
The court has the authority to search your property without your permission (even without your knowledge) under some circumstances (they can issue a search warrant if they have probable cause).
lol - fucking nimwits... That would be hilarious...
But officer, I *DID* try to tell you, you fucking retard.
...Which I'm surprised none (to my knowledge) have been implemented.
If away from the home or other geofence, use more than one finger to unlock. If the wrong finger combo is used, the phone is locked to use passcode only.
If a certain voice command is given, phone locks to use passcode only.
If a certain finger is used, phone locks to use passcode only.
If a certain amount of time passes, phone locks to use passcode only.
There's all sorts of additional security measures that would be ideal for this situation. Biometrics are easy to use, but they're easy to abuse. These measures would put security back in the hands of the user, not Barney fucking Fife with an axe to grind.
... trustworthy?
It little behooves the best of us to comment on the rest of us.
Low Earth Orbits can now force you to provide your fingerprint to unlock your phone. ISS crew must be annoyed.
Get the best of both biometric security AND passcode security. Use somebody else's fingerprint to unlock your phone but refuse to divulge the knowledge of whose fingerprint!
Virtue finds and chooses the mean.
Aristotle, Ethica Nichomachea
That's one of the reasons he's safe. Boring, but safe.
According to this Apple support page: "If Touch ID doesn't recognize your finger, you'll be asked to try again. After three attempts, you'll be given the option to enter your passcode. After two more tries, you'll need to enter your passcode."
Who knows? The main argument has been against the compelling part, if they can read your mind through involuntary responses that may be legally permissible. They probably can't get a confession that way, but they might gather leads on what you may recognize or feeling or whatever. They show you a picture of your dead wife, your brain goes to hate. That cute secretary you have a secret affair with triggers a quite different and legally interesting response. And photos from where the body was dumped triggers recall responses more than shock responses, oh my. They are after all allowed to play mind games with you, that's what most interrig... sorry, interview techniques are all about. Maybe it'll be like sci-fi series where characters hum children's rhymes to avoid telepaths being able to read their thoughts.
Live today, because you never know what tomorrow brings
... how many people at the Virginia Tourism Authority are weeping into their beers tonight.
Giving up a key or DNA sample is not signifying your approval; it's just surrendering information which is stored outside your brain.
Technically isn't your fingerprint also information which is stored outside your brain? How is this really any different than requiring you to surrender a key to a locked filing cabinet? You could make the exact same argument about that as well: the key is just a means to signal approval.
Police already use fingerprint information to identify where you have been and what you have handled so you are already required to surrender this information. If you choose to have this information unlock your phone then that's your choice: stick to a password if you are worried about what is on there.
What you really want is a combination lock where you have to touch in with a combination of 6 fingers: you'd the convenience of biometrics and the protection of a pass code.
The Supreme Court defended needing a warrant to search a phone based upon the idea that a phone contained so much of a person's life. So the interesting thing here will be how much of a fishing expedition will be allowed, in that the cops would love to look for all crimes instead of evidence to back the one that they got the warrant for.
But where this is sort of funny is that most criminals don't even maintain their right to silence and blah blah about their innocence while the cops lead them down the path to either a confession or a whole lot of information such as why they were there and the relationship with the victim and so on. So to a certain extent I wonder if the cops are sad now that the evidence doesn't just land in their laps anymore.
Where all these privacy features are coming from is not that companies like Apple think that there is a huge market selling phones to criminals and terrorists but that the real criminals are the government types who want to violate all our rights and privacies on a routine basis and that like any sane group of people we want to prevent them from doing just that; thus we seek out products that will block them as a routine and easy feature.
So when the average consumer hears the FBI or the NSA whining that a phone is too secure that average consumer will flock to that device.
Have GOT to be loving this decision. I hope nobody here on /. holds stock in any of them... XD
Don't just stand there, get that other dog!
I thought LEO was Low Earth Orbit (like where the ISS is)
Put the fingerprint as the device panic to format the device.
Maybe I have been out of college and in the communications business for to long, but it took me quite a while to figure out that LEOs was law enforcement officers.
sorry for my comments, I'm drunk
The only finger I'm giving the police is my middle one.
Note: if you turn off your phone, the passcode will be required before the fingerprint will work...
Circuit Court of Viriginia, that is trial level shit. It's not a precedent and isn't final until the Appeals court or Supreme Court affirms or throws it out.
The error in the judges logic is that, by forcing a defendant to participate in unlocking of his device by providing a finger print, this in fact forces one to self incriminate and to act as a witness against himself.
In fact the defendant should not have to do anything he does not wish to comply with when the state wants to throw his ass in prison, guilty or not.
The act of complying with a judges order certainly is the same as providing a password or divulging information which he stored in his phone, which is an extension of himself.
http://www.obamasweapon.com/
What's the difference furthermore from information stored on a mans finger or in the atoms of his brain or in the energy states of his electronics/memory? ..
If you have an IOS device that uses fingerprint authentication, power it off before the police can seize it. When it reboots it will require the passcode before fingerprint access works.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Circuit Court of Virginia, that is trial level. It's not a precedent and isn't final until the Appeals court or Supreme Court affirms or throws it out.
The error in the judges logic is that, by forcing a defendant to participate in unlocking of his device by providing a finger print, this in fact forces one to self incriminate and to act as a witness against himself.
In fact the defendant should not have to do anything he does not wish to comply with when the state wants to throw his ass in prison, guilty or not. That was the intent of the 5th amendment. You either got proof, or you don't, and you cannot expect the defendant to have to help you convict him. It is not designed to be a perfect system of finding innocence or guilt. It's a way to execute both innocent and guilty people based on a set of rules; it does so both currently, and the only protection from it is to hold onto your rights to avoid being found guilty at all cost, including using your 5th amendment right.
The act of complying with a judges order certainly is the same as providing a password or divulging information which he stored in his phone, which is an extension of himself.
Furthermore, what's the difference from information stored on a mans finger or in the atoms of his brain or in the energy states of his electronics/memory?
Also if anyone in the community is listening, add an auto-wipe feature and multi-finger swipe; Meaning to actually unlock, two or more fingers may be used in specific combination entry, and perhaps a specific combination can initiate a device auto-wipe or disable fingerprint and replace with a high grade password until further notice.
There is no way the retarded judges can force one to divulge the specific finger used or the specific finger combination required to unlock a phone. At best refusing to do so is contempt, typically nothing more than a misdemeanor. Wiping or sabotaging your device w/ a specific combination is certainly within your rights to do as well.
http://www.obamasweapon.com/
Then give them the finger!
The anomaly here is due to the idea that fifth amendment protections should apply to passwords. Passwords can't be incriminating*; they only provide access to existing material that might be incriminating. There have been decisions both ways on this but my money is that eventually SCOTUS will rule that passwords are not protected.
* One potential loophole might be where someone claims their password itself is incriminating. I think the best solution here would be to allow "use immunity" for passwords and remove the rule about derived evidence for this situation.
Biometric identifiers are lousy protection against people who can use physical force, so you shouldn't use them.
Legally, the line needs to be drawn somewhere, and this seems like a reasonable place.
You cannot withhold your finger print.
You can withhold something which is in your mind. E.g. a pin.
Since only one (or two?) of your fingers unlock your phone. Your knowledge of the finger print possibly qualifies as secret knowledge. And multiple attempts will ultimately prevent use of finger prints.
The police would not (I think) be able to force you to disclose. They would be free to instruct you to use a specific finger and hope that it unlocks. But if it fails I don't think they would have any recourse.
So don't use your thumbs or index fingers. Which would be their starting point.
Yet another reason not to use biometrics to unlock devices.
I would argue its time for the shit-for-brains in washington and the state level to change such idiotic laws. ""Frucci said that "giving police a fingerprint is akin to providing a DNA or handwriting sample or an actual key, which the law permits. A passcode, though, requires the defendant to divulge knowledge, which the law protects against, according to Frucci's written opinion.""
Depending on the level of the court, I thought they were suppose to suggest changes to said laws. Or judge based on constitutional amendments. Pretty funny a "Republican" state talks about rights and yet allows such laws on their books, or judges in their courts. Just because its a "law" doesn't make it constitutional.
I say that not knowing exactly what this suspect or defendant is accused or charged with.
If any criminal is running around with iphone or android then they have to take the consequences. If youre just average guy who gets caught up in shit, i'd say destroy your phone, buy a new one before cops move in. Most career criminals are smart enough to run around with cheap disposable phones anyway. The way things are going i might contemplate an offline, encrypted computer just for all my photos, videos , everything i don't want on a cloud or stored on my phone. The whole "store everything in the cloud, in your phone" is getting out of hand.
Fingerprint for normals... then passphrase the dirty things you don't want people to look at... Sucks for things like the address book, but maybe if you purge call history and keep a protected address book then you'll be fine ... Lacks convenience though.
Why UNIX?
How does a Low Earth Orbit force me to do anything?
Program odd fingers to unlock the phone, then offer up your thumb to unlock it. After three tries it fails and requires your passcode, rendering your data safe. Right?
Apple should implement a geofence and timer to allow you configure when it should prompt for passcode vs fingerprint. Also allow it to force passcode after X invalid finger prints tried. Good luck figuring out which finger, knuckle, elbow, ear was used to program the touchID :P
http://www.threefeloniesaday.c...
You can pry my fingers from my cold, dead asshole.
Thanks. If I ever have to give my finger prints, my fingers are going up my asshole right before.
I liked the convenience of finger print ID for logging into my phone, but after thinking on it for a bit, I realized a LEO, or a criminal.. (not much distinction these days) could physically force me to touch that little disk with a fingertip. Now I use a complex passphrase. It is a pain in the ass, but I feel better knowing that it would take a lot more effort for an adversary to cause me to give that up than a fingertip. YMMV.
I got my finger right here!