Slashdot Mirror
Suspect Required To Unlock iPhone Using Touch ID in Second Federal Case (9to5mac.com)
An anonymous reader shares a report on 9to5Mac: A second federal judge has ruled that a suspect can be compelled to unlock their iPhone using their fingerprint in order to give investigators access to data which can be used as evidence against them. The first time this ever happened in a federal case was back in May, following a District Court ruling in 2014. The legal position of forcing suspects to use their fingerprints to unlock devices won't be known with certainty until a case reaches the U.S. Supreme Court, but lower court rulings so far appear to establish a precedent which is at odds with that concerning passcodes. Most constitutional experts appear to believe that the Fifth Amendment prevents a suspect from being compelled to reveal a password or passcode, as this would amount to forced self-incrimination -- though even this isn't certain. Fingerprints, in contrast, have traditionally been viewed as 'real or physical evidence,' meaning that police are entitled to take them without permission.Ars Technica has more details.
what about copying them and making there own 3d printer finger? They have the finger prints from booking right?
Was he compelled to actually put his finger on the phone, or was he just compelled to surrender his fingerprints? TFA is not precisely clear about that. If it's the former then that's incontrovertibly a violation of the Fifth Amendment. If it's the latter then it's just routine--he's going to leave a trace somewhere eventually.
In either case, the moral of the story is, don't use your biometrics to lock your phone.
your fingerprints aren't a testimony against yourself. Read the damn thing. "nor shall be compelled in any criminal case to be a witness against himself."
My fingerprint only works for a set period of time. Then it demands a password instead. What if the fingerprint doesn't work for the police, then what?
In Europe, we understand that, in this context, a fingerprint is equivalent to a password and deserves to be protected as such. You dumb fat Americans really should extend the same protections to fingerprints in this context.
I got an OTA pushed to my Note from TMobile and now the fingerprint unlock stops being the unlock after reboot or so much time goes by. It wants a password after that. So, OK judge, here's my finger. Sorry, forgot the password.
My iPhone 5S requires a password on reboot. Just reboot you iPhone before the cops can grab it.
Your finger print is a physical fact, so is your DNA (non-invasive gathered). So giving it freely to others to use to track you, like unlock your phone, or to a website to find your history is stupid.
Do not do it. Do not use cloud stored facts, since a third party has it now.
If you're not doing illegal stuff on your phone, you don't have to worry.
That works, until the government decides that your particular activity is a threat to government and makes it illegal. So no, you're incorrect, you should worry about what your government can do to you.
My particular solution would be to have a deadman's switch that erases the phone when using any finger but the one correct one. Or better yet, disable the Finger Prints from your phone, and use a proper PIN, which they cannot force you to divulge.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Since you can't be compelled to give up a password, the thing to do when crossing borders is to ensure you have full disk encryption on and power off the device when going through...
I know my Android phone has this and when powering back on it requires the password to decrypt. Since you can't be compelled to provide a password, this seems like the best thing to do to protect your privacy...
your fingerprints aren't a testimony against yourself. Read the damn thing. "nor shall be compelled in any criminal case to be a witness against himself."
Your fingerprints absolutely can be evidence against you. That's not even a question. The police have a long established right to take your fingerprints when you are arrested and to compare them with gathered evidence.
That said I have a hard time reconciling this with the right against self incrimination in the Constitution. In principle I feel a biometric pass code should be legally no different than a memorized one. Either way you are being forced to potentially incriminate yourself. But I suspect that the legal system will rule that they are different and so if you want your phone to be secure against search and seizure you must avoid biometric pass codes unfortunately. The problem here is that they are not comparing your fingerprints against evidence they have found. They are in effect forcing you to open a lock on their behalf. I don't have a problem with them having the right to search but I don't see why the target of the investigation should be forced to aid in that search. If they can break down a door to do a search (with a warrant) then have that right but I don't see why I should have to hand over the key to the house so to speak.
A lot of people are confused by what self-incrimination means. Self-incrimination is forcing someone to testify (testimonial obligation), be a witness against their own interest/side in a criminal action, or generally be forced to say/admit anything that might be used against them unwittingly later as part of a prosecution. The right to non self-incrimination does not mean you are immune from having evidence produced that incriminates you!
The key thing is that it is a right to not testify, or be a witness, which is the act of saying or stating something. If a person can be compelled to produce his/her fingerprints (something which in itself is not a testimonial act), then just because that unlocks something that incriminates the person does not mean they have been self-incriminated.
... how can it not be a case of the 5th amendment protections? If forced to choose between using the correct finger, or using a finger that will lock the phone, how can this not be a case of self-incrimination? This seems like extreme legal antics to ignore the fact this person has been accused of a crime, without sufficient evidence to prosecute on it's own merits.
ever since lenovo/ibm started adding finger swipes to their laptops, biometrics have been handily dismissed as entirely insecure. iphone thumbreaders have been bypassed with 3d printings of the deceased's fingers. and even simple scans and printouts of thumbs and fingers have been more than enough to render the technology ineffective.
the solution is complex passphrases, hardened keystores, and challenge limits. if you cant guess the password in 3 attempts, you now have to wait $N amount of time. if you cant guess it in $X attempts, the device destroys its private keys.
Good people go to bed earlier.
fingerprint id insecure by nature, because your fingerprint likely covers your device, your glasses and everything else you touch.
The original problem — one with actual passwords — came from the painfully perverted reading of the Fifth Amendment (I wish, ACLU et al were as liberal reading the Second!). If you have to tell police your password that could be used against you, then the password became testimony (written or verbal) and so the police could not compel you to do that under the Fifth Amendment.
Well, fingerprints are neither said nor written, so the Fifth Amendment does not apply. End of story — whether police can look at your smart phone's contents is now controlled by the Fourth... If the judge issues a warrant, you have to open up...
In Soviet Washington the swamp drains you.
Moral of the story is Don't leave evidence on your phone. Or anywhere else for that matter.
Idiotic statement. Sometimes what isn't actually evidence of anything can be used against you. Just because you have nothing to hide does NOT mean you have nothing to fear.
If you need an explanation why watch this video.
It means: transform Touch ID from a physical request to a knowledge request (thinking that would get the same protection as a password).
You have to give them a fingerprint ... but do you have to give them your knowledge of which fingerprint will unlock a device?
"Fingerprints, in contrast, have traditionally been viewed as 'real or physical evidence,'"
I wonder it these judges would also consider the practice of strapping a male baby to a board and cutting off part of it's penis without anesthesia to be acceptable because it is "tradition"
I can think of many other "traditions" that need to be reconsidered in light of modern times.
I think we should also require suspects to return to the crime scene and handle all the evidence with ink on their fingers.
You don't use your finger?
Nose? Penis ( men only )? Left Big Toe ( sandals hipsters...)?
Lower palm?
All viable alternatives, usually, and if no one knows what part you use, they may have to manipulate the 'member' quite a bit
to find the magic spot...
Can you say destruction of evidence is a crime?
There are many circumstances where it is a crime to destroy evidence.
I guess that would go in the same line as forcing something to give a DNA sample to match stuff found on the victim/crime scene?
Starting with iOS 9, there's an 8 hour timeout on TouchID. Longer than that, and you need to re-enter your passcode. TouchID won't work. (Source: http://www.macworld.com/articl...)
And of course as others have mentioned, on power up, passcode is required once. So if there's any possibility of a police interaction, crashboot your phone (hold power & home for five seconds), or shut it down normally if you have the time. Failing that, have your attorney appeal EVERYTHING to blow the 8 hour timeout away.
Also, FFS run the latest version of iOS, since this and other protections (some of which have worked in the San Bernardino case) aren't present in older releases.
And it's a lot like all the other states ( just 20 years late in adopting any trends... fashion, education, etc )
Yes, we use cell phones, and biometrics exist here.
Not as much animal husbandry as in the past... The women don't want ugly babies/stepkids....
Less inbreeding thanks to porn.
As for incriminating evidence or secrets - can't the android OS be made dual-booting? Fingerprint selection?
Add an optional second micro card that is visible to only one OS....
This is why biometric identification should be used as a username, never a password.
Bite off your fingertips and eat 'em!
systemd is Roko's Basilisk.
No 4 & 5 protect. Get fbi to pay another $1m to break in. If it comes from your mind it is not a fact.
This is consistent with previous interpretations of the law, and the reasoning is the fifth amendment only applies to the information that is stored in your brain. The fifth amendment is the only protection you have that prevents the government from being able to compel you to divulge your passwords. The important thing to take away from this is that all authentication systems that rely on biometric information can be lawfully circumvented with a court order. The only authentication system that is protected under the fifth amendment is a token stored in your mind.
It is very much related, but an ongoing debate within the justice system, I would say. Things like people being compelled to have their blood drawn (for the purpose of testing blood alcohol after a DUI) or their DNA tested (but in different circumstances compared to what you suggest), are extensions of the "fingerprint" argument.
And courts have held that these things can be compelled to be produced by (or from) a person without their consent if certain circumstances are met. But it requires a warrant -- it can't just be done by the police because they feel they need to.
In some states, if you're under suspicion of a felony DUI charge, the police can seek a warrant to have your blood drawn/tested for alcohol. Regarding DNA, for example, in California, if you are a suspect for a felony, you can be forced by the court to have your blood/DNA tested. In all 50 states, someone who has been convicted of a felony can have his/her blood/DNA required to be drawn.
...Fingerprints, in contrast, have traditionally been viewed as 'real or physical evidence,' meaning that police are entitled to take them without permission....
Historically, fingerprints have had value only as evidence. That is quite different than the biometric security usage that fingerprints also enjoy nowadays. Biometric security has morphed fingerprints from being only evidence to also being security passcodes.
.
imo, fingerprints, when used purely as evidence (i.e, as they have been used historically), should not require a search warrant.
However, when fingerprints are used for a security purpose (i.e.are not evidence, but a security key), then they should be treated as being part of a search that the security key enables.
It will be interesting to see how the Supreme Court eventually rules on this.
It is unconscionable to force a criminal defendant to assist his or her own prosecution in any way whatsoever.
Don't break the law. If you don't like the law, work to get it changed.
Unpossible. There are so many laws that can be interpreted in so many ways, if an agent wants to pin something on you, they WILL find something. It has been widely reported that the average American commits 3 felonies a day, without even knowing it.
"Somebody has to do something. It's just incredibly pathetic it has to be us."
--- Jerry Garcia
Not to use your fingerprint to unlock/decrypt anything.
Thieves will love having to chop off fingers rather than trusting a victims claim of what their password/PIN is....
Couldn't you, like, set it to be a password lock, then make your password a phrase that would be self-incriminating? Wouldn't you be unable to be forced to give the passcode as the passcode itself is incriminating?
Which is why you should reboot your phone (or power it off) if you're expecting an inspection.
With recent version of iOS, if you haven't unlocked your phone via Touch ID in the last 8 (?) hours, it asks you for your password/phrase. Your finger print won't work:
http://www.macworld.com/article/3072181/ios/new-touch-id-rules-why-you-have-to-enter-your-passcode-when-you-wake-up.html
I often have to type something in if I sleep in. I thought it was imagining things, but Apple actually reduced the time down from 48 hours.
So while you're right in that a reboot will do the same thing, if the iDevice has been sitting around for a while (and is running iOS 9+), then the passcode will kick in automatically.
My fingerprint won't unlock shit. I used my DICK as the fingerprint. Would they like me to whip it out to unlock it in front of them?
And this is yet another reason to think that instead of paying too much attention to "oh shiny".
I was against them as "passwords" due to - you can't change them if you're hacked.
I guess Apple isn't magic fairy dust after all...oh, wait.
Why guess when you can know? Measure!
Corporations are people.. if they can keep terabytes and beyond of data encrypted and just have their IT guy plead the 5th. Why would they not all do that?
iPhone users are not smart enough to have anything important.
And that, my friends, is why I also use my middle finger instead of my index finger as input to my phone's fingerprint scanner.! How many times does it need to fail before the phone locks you out? My phone requires a PIN code, not a fingerprint, every time it gets turned back on, and after updating software as well. Seems like a court order to "put your finger on the fingerprint scanner" would be VERY easy to make fail to actually unlock the phone, and charging with contempt of court for the phone not recognizing your fingerprint seems pretty shaky to me.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
By the time they get to that finger, it will require a passcode to be unlocked.
https://www.eff.org/https-everywhere
I thought everyone switched to passcode instead of PIN a while ago when we realized that iPhone will happily boot (properly signed) tampered firmware that can brute force PINs.
...to beat the 8 hour timeout which requires the PIN again. And of course if you care about this, all your email is cert-encrypted with its own PIN. But I digress.
Seems fair to me.
-- Tigger warning: This post may contain tiggers! --
THEN...
"Never write when you can talk. Never talk when you can nod.
And never put anything in an e-mail."
NOW...
"Never write when you can talk. Never talk when you can nod.
And never put anything in an e-mail, or on your smartphone."
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Is there any good reason to even use Touch ID or other fingerprint unlocks instead of just using a password or passcode?
Simple solution for iPhones....simply power off the phone completely if you think you'll be compelled to give up its contents. They can compel fingerprints, but they cannot compel passwords. Once powered off, it cannot be turned back on with a fingerprint....only a password.
Would that be stupid or clever?
The 4th and 5th amendment issues and the limitations of an All Writs are still not settled, so expect to sit in jail without a trial if you refuse to comply with the instructions from a judge to release your passwords. If an FBI agent or prosecuting attorney demand your password, you can tell them to go pound sand if you want. They have to convince a judge to order you before you really have to do anything. (IANAL)
There's no excuse for not using suspects fingerprints in this way, so long as they have legally obtained a search warrant. It's certainly no different than breaking a lock to enter someone's home. I believe this is mostly going to affect poorly educated criminals like drug dealers, petty thieves, and such. Anyone with half a brain would not rely on a simple phone lock to encrypt their data in the first place. It's so trivial to do, those who don't really must be the worst, most obnoxious criminals out there.
How exactly does the DA have a case if he doesn't have any evidence, or requires the evidence on the phone to further carrying the case?
....damage your fingerpad right after they take away your phone? By the time your fingerpad heals, the time limit will have passed.
"Authorities" required to demonstrate the legitimate source of their authority.
Requiem for the American Dream
yep, you are "racist". you like certain ethnic groups and hate others, and say some ethnic groups are subhuman - meaning you are not only racist, you are a racial supremist and hence ignore facts about human genetics, including the fact that there is only one human race - we probably killed the remaining human races 10's of thousands of years ago.
But isn't the government's stand that this is, essentially, discovery, which can be compelled in civil cases...?
So is there criminal discovery in states or federally that would compel a defendant or suspect to surrender incriminating evidence, and how does that not run afoul of the Fifth Amendment?
deleting the extra space after periods so i can stay relevant, yeah.
Passcodes are inconvenient for objects that are part of our daily lives. However, Apple did plug that firmware hole in the 5S and later phones. There have got to be vulnerabilities still, because there always are, but Apple's closing them as they find out about them.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
I may be later to this post but I seem to remember, backed up by this page clipping from Apple (https://support.apple.com/en-us/HT204587)
"To configure Touch ID, you must first set up a passcode. Touch ID is designed to minimize the input of your passcode; but your passcode will be needed for additional security validation:
After restarting your device
When more than 48 hours have elapsed from the last time you unlocked your device
To enter the Touch ID & Passcode setting"
Therefore, this is not this whole case moot, since 48 hours has most certainly expired since the phone was taken as evidence, thus the fingerprint is not a valid unlock and the legally protected passcode is back in play.