Slashdot Mirror
Virginia Court: LEOs Can Force You To Provide Fingerprint To Unlock Your Phone
schwit1 writes with news of a Circuit Court decision from Virginia where a judge has ruled that a criminal defendant cannot use Fifth Amendment protections to safeguard a phone that is locked using his or her fingerprint.
According to Judge Steven C. Fucci, while a criminal defendant can't be compelled to hand over a passcode to police officers for the purpose of unlocking a cellular device, law enforcement officials can compel a defendant to give up a fingerprint. The Fifth Amendment states that "no person shall be compelled in any criminal case to be a witness against himself," which protects memorized information like passwords and passcodes, but it does not extend to fingerprints in the eyes of the law, as speculated by Wired last year.
Frucci said that "giving police a fingerprint is akin to providing a DNA or handwriting sample or an actual key, which the law permits. A passcode, though, requires the defendant to divulge knowledge, which the law protects against, according to Frucci's written opinion."
Yet another reason not to use biometrics to unlock devices.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Just chew them off which ever finger print unlocks the phone. They don't get your info, and you get an insanity plea.
XDInd
So what's next you can be forced to be scanned and have your thoughts read, it's not testifying in the verbal or written sense. Letter by letter realtime
Tooo slippery...
Doesn't this involve remembering which finger you used? IE., basically the same thing as remembering your passcode? Also, a lot of the article comments were about some Touch ID system where a few wrong print reads failed over to the passcode, also if the phone was turned off and/or rebooted, it forced the passcode. Basically, if you get pulled over, turn off your phone before the officer gets there.
Kind of gives a new meaning to giving the cops the finger...
ummm... you do know the first thing that happens when you are arrested is that they take your fingerprints right? So, they already take your fingerprint, and thus have it to unlock the device. The Court basically has simply stood up to the fact that taking of fingerprints is still a valid right of law enforcement to do, and using the fingerprint in any ways to connect the defendant to crimes is still a valid use of the fingerprint, be it weather it unlocks a phone, or matches a fingerprint found on a gun used to commit a crime.
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
This is like being required to sign your name.
The security feature on your phone is designed to not unlock unless you signify approval.
Giving up a key or DNA sample is not signifying your approval; it's just surrendering information which is stored outside your brain.
This is actually a good question. Just like when I have to type in my favorite book or street I grew up on to get into my bank account, my answers are rarely the actual answers to the question. So what if you used a different part of the body? Will the scanners pick up if you used a section of your palm? What about toes? Noses? Can I use my weiner?
XDInd
Chop the finger off and burn it. Better than some sentences that could be handed out.
iOS implements this simply: after 48 hours of not logging in, or a phone reboot, it requires a passcode.
Any decent lawyer should be able to postpone any forcible press.
That being said, we are slowly losing our liberties.
What about the knowledge of which finger to use? Can they just try them all?
Assorted stuff I do sometimes: Lemuria.org
If that's the case, then a possible solution would be an encryption that unlocks on one specific finger's fingerprint, but deletes all phone data for the other nine fingers. Since the ruling says you have to provide your fingerprints fine, but the knowledge of which finger's fingerprint is the correct one is knowledge in your brain, which doesn't have to be divulged. This would also, obviously, need to be combined with secure hardware that prevents the cops from simply copying the data and trying the fingerprints one at a time with the copy.
That way, you still have the convenience of a fingerprint unlock, but extra security against seisure, since the cops would only have a 10% chance of guessing the right finger.
Unsurprising that a judge would try to find 'clever' ways around the spirit of the constitution
Care to cite what part of the Constitution this gets around? Because near as I can tell, the constitution does not protect you from reasonable search and seizure. It never has. Police with a warrant can open doors, break chains, crack safes, pick locks, take your keys, or do pretty much anything else they want to do to get access to your private information. That's been true for as long as any of us can likely remember. That's the whole point of investigations and detective work. Did you think they just went, "Aww shucks!" every time they came across a locked door, or did you realize that if they needed to get in, they'd either find the keys or break it in?
The reason you can refrain from providing a passcode is because the 5th Amendment protects you against self-incrimination, and the very act of providing the passcode may in itself be incriminating, since it demonstrates that you have an awareness and knowledge of the device and the means to unlock it. Which is to say, while the police may have the authority (when authorized by a proper warrant) to search your phone, they do not have the authority to compel you to give up your own rights by providing a passcode.
But their authority to search your phone doesn't suddenly die just because they can't get your passcode. If an alternative method for accessing that data exists that does not involve trampling your rights, they are welcome to use it, whether it be decrypting the phone, tricking you into providing the passcode, or, yes, using your fingerprint.
Get the best of both biometric security AND passcode security. Use somebody else's fingerprint to unlock your phone but refuse to divulge the knowledge of whose fingerprint!
Virtue finds and chooses the mean.
Aristotle, Ethica Nichomachea
According to this Apple support page: "If Touch ID doesn't recognize your finger, you'll be asked to try again. After three attempts, you'll be given the option to enter your passcode. After two more tries, you'll need to enter your passcode."
Honestly, I'm a little surprised that they can't require you to divulge the passcode. From what I've read, the 5th is construed to prevent the government from forcing you to create new evidence that could be used to convict you of something; it does not protect any existing evidence (in a safe, in a file cabinet, on your computer, etc), and compelling a defendant to make potential evidence available for examination has been legit for a long time. It's just that until now, if the defendant refused, there was usually a way to get at it anyway...
Not saying I'm unhappy about it, just surprised.
The Supreme Court defended needing a warrant to search a phone based upon the idea that a phone contained so much of a person's life. So the interesting thing here will be how much of a fishing expedition will be allowed, in that the cops would love to look for all crimes instead of evidence to back the one that they got the warrant for.
But where this is sort of funny is that most criminals don't even maintain their right to silence and blah blah about their innocence while the cops lead them down the path to either a confession or a whole lot of information such as why they were there and the relationship with the victim and so on. So to a certain extent I wonder if the cops are sad now that the evidence doesn't just land in their laps anymore.
Where all these privacy features are coming from is not that companies like Apple think that there is a huge market selling phones to criminals and terrorists but that the real criminals are the government types who want to violate all our rights and privacies on a routine basis and that like any sane group of people we want to prevent them from doing just that; thus we seek out products that will block them as a routine and easy feature.
So when the average consumer hears the FBI or the NSA whining that a phone is too secure that average consumer will flock to that device.
Have GOT to be loving this decision. I hope nobody here on /. holds stock in any of them... XD
Don't just stand there, get that other dog!
How is this really any different than requiring you to surrender a key to a locked filing cabinet?
The key is a physical piece of property just like your physical phone which can be lawfully seized.
Technically isn't your fingerprint also information which is stored outside your brain?
Your fingerprint is information, BUT the application of your fingerprint to indicate your approval is a kind of signature, just like if you can't write, going to the bank, and using your fingerprint to approve a withdrawl is a form of validation.
The police have a gather information which constitutes your fingerprint, BUT they have no right to severe your finger, or to use their access to the information to impersonate you such as by using the information to defraud another person or service that they are you.
Same deal if you have a signature stamp which allows you to approve documents by applying a stamp; the police can seize the physical asset, but they have no right to pretend to be you and apply the signature stamp to a document advising your personal lawyer to take some action, such as drop the case, or produce a recording of your private session.
Also.... your iPhone has a built-in signature verifying device, and they have no right to forge your personal signature to impersonate you and cause your Apple product to take some action.
If you have an IOS device that uses fingerprint authentication, power it off before the police can seize it. When it reboots it will require the passcode before fingerprint access works.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
since it demonstrates that you have an awareness and knowledge of the device and the means to unlock it
And the device being able to recognize your fingerprint doesn't do the same thing?
Nope. The distinction here is that one act is communicative, while the other is not.
Let's go back to the 1966 Supreme Court case that established case law on these sorts of issues. That case dealt with a person involved in a car accident who was suspected of drunk driving. A police officer could smell the alcohol on his breath, so when the man was in the hospital after the accident, he directed a doctor to take a blood sample over the suspect's objections. In other words, his own blood was being used to incriminate him.
Some relevant passages:
We hold that the privilege protects an accused only from being compelled to testify against himself, or otherwise provide the State with evidence of a testimonial or communicative nature
Basically, they're saying that the 5th Amendment only protects evidence of a "testimonial or communicative nature". More on that below.
"[T]he prohibition of compelling a man in a criminal court to be witness against himself is a prohibition of the use of physical or moral compulsion to extort communications from him, not an exclusion of his body as evidence when it may be material. The objection in principle would forbid a jury to look at a prisoner and compare his features with a photograph in proof."
They're quoting an earlier case here, but basically they're saying that a person's body can be used to incriminate them, without it violating the Fifth Amendment. Without that being true, you'd get all sorts of nonsensical rules, like the one they cited, where the mere act of allowing the jury to see the defendant would mean violating his right against self-incrimination, since then they could compare him against a photo taken of the suspect at the crime scene. Hell, even witnesses wouldn't be able to see defendants, since they'd be able to recognize them, potentially. Clearly the Fifth was not intended to protect against such ridiculousness.
In the present case, however, no such problem of application is presented. Not even a shadow of testimonial compulsion upon or enforced communication by the accused was involved either in the extraction or in the chemical analysis. Petitioner's testimonial capacities were in no way implicated; indeed, his participation, except as a donor, was irrelevant to the results of the test, which depend on chemical analysis and on that alone. 9 Since the blood test evidence, although an incriminating product of compulsion, was neither petitioner's testimony nor evidence relating to some communicative act or writing by the petitioner, it was not inadmissible on privilege grounds.
I.e. While compulsion was indeed involved, A) that it was compelled didn't change anything, B) there was no testimony or communication involved at all, C) the compulsion didn't relate to testimony or communication.
All of this ties back in with fingerprint locks, since your fingerprint is just another form of physical evidence, like any other that you may be asked to provide, and all three of those apply here as well. Whether it's compelled or not doesn't change anything, and it, in and of itself, does not communicate anything. By providing your fingerprint, you aren't acknowledging your guilt. You aren't testifying that you did it. You aren't indicating an awareness of anything at all. You're merely providing your fingerprint...in this case on a device they have in evidence, rather than on a piece of paper. That your fingerprint's ability to unlock the device can be used to incriminate you does not mean that your rights are being violated. It merely means that "the glove fit", so to speak.
The same is not true of something like a passcode, which is, by its very nature, communicative.
IANAL. I'm just a guy who responded with a knee-jerk reaction that of course this was wrong of them to do, gave it some more thought, found a contrary view that actually made a great deal of sense, and decided to go look up some of the case history on the subject to find out what the real answer was since I found the topic fascinating.
Program odd fingers to unlock the phone, then offer up your thumb to unlock it. After three tries it fails and requires your passcode, rendering your data safe. Right?