Slashdot Mirror
Suspect Required To Unlock iPhone Using Touch ID in Second Federal Case (9to5mac.com)
An anonymous reader shares a report on 9to5Mac: A second federal judge has ruled that a suspect can be compelled to unlock their iPhone using their fingerprint in order to give investigators access to data which can be used as evidence against them. The first time this ever happened in a federal case was back in May, following a District Court ruling in 2014. The legal position of forcing suspects to use their fingerprints to unlock devices won't be known with certainty until a case reaches the U.S. Supreme Court, but lower court rulings so far appear to establish a precedent which is at odds with that concerning passcodes. Most constitutional experts appear to believe that the Fifth Amendment prevents a suspect from being compelled to reveal a password or passcode, as this would amount to forced self-incrimination -- though even this isn't certain. Fingerprints, in contrast, have traditionally been viewed as 'real or physical evidence,' meaning that police are entitled to take them without permission.Ars Technica has more details.
what about copying them and making there own 3d printer finger? They have the finger prints from booking right?
Was he compelled to actually put his finger on the phone, or was he just compelled to surrender his fingerprints? TFA is not precisely clear about that. If it's the former then that's incontrovertibly a violation of the Fifth Amendment. If it's the latter then it's just routine--he's going to leave a trace somewhere eventually.
In either case, the moral of the story is, don't use your biometrics to lock your phone.
I got an OTA pushed to my Note from TMobile and now the fingerprint unlock stops being the unlock after reboot or so much time goes by. It wants a password after that. So, OK judge, here's my finger. Sorry, forgot the password.
My iPhone 5S requires a password on reboot. Just reboot you iPhone before the cops can grab it.
Your finger print is a physical fact, so is your DNA (non-invasive gathered). So giving it freely to others to use to track you, like unlock your phone, or to a website to find your history is stupid.
Do not do it. Do not use cloud stored facts, since a third party has it now.
If you're not doing illegal stuff on your phone, you don't have to worry.
That works, until the government decides that your particular activity is a threat to government and makes it illegal. So no, you're incorrect, you should worry about what your government can do to you.
My particular solution would be to have a deadman's switch that erases the phone when using any finger but the one correct one. Or better yet, disable the Finger Prints from your phone, and use a proper PIN, which they cannot force you to divulge.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
What if only one out of your nine fingers actually unlocked the phone, and the other nine deleted everything as a kill switch?
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Since you can't be compelled to give up a password, the thing to do when crossing borders is to ensure you have full disk encryption on and power off the device when going through...
I know my Android phone has this and when powering back on it requires the password to decrypt. Since you can't be compelled to provide a password, this seems like the best thing to do to protect your privacy...
your fingerprints aren't a testimony against yourself. Read the damn thing. "nor shall be compelled in any criminal case to be a witness against himself."
Your fingerprints absolutely can be evidence against you. That's not even a question. The police have a long established right to take your fingerprints when you are arrested and to compare them with gathered evidence.
That said I have a hard time reconciling this with the right against self incrimination in the Constitution. In principle I feel a biometric pass code should be legally no different than a memorized one. Either way you are being forced to potentially incriminate yourself. But I suspect that the legal system will rule that they are different and so if you want your phone to be secure against search and seizure you must avoid biometric pass codes unfortunately. The problem here is that they are not comparing your fingerprints against evidence they have found. They are in effect forcing you to open a lock on their behalf. I don't have a problem with them having the right to search but I don't see why the target of the investigation should be forced to aid in that search. If they can break down a door to do a search (with a warrant) then have that right but I don't see why I should have to hand over the key to the house so to speak.
A lot of people are confused by what self-incrimination means. Self-incrimination is forcing someone to testify (testimonial obligation), be a witness against their own interest/side in a criminal action, or generally be forced to say/admit anything that might be used against them unwittingly later as part of a prosecution. The right to non self-incrimination does not mean you are immune from having evidence produced that incriminates you!
The key thing is that it is a right to not testify, or be a witness, which is the act of saying or stating something. If a person can be compelled to produce his/her fingerprints (something which in itself is not a testimonial act), then just because that unlocks something that incriminates the person does not mean they have been self-incriminated.
... how can it not be a case of the 5th amendment protections? If forced to choose between using the correct finger, or using a finger that will lock the phone, how can this not be a case of self-incrimination? This seems like extreme legal antics to ignore the fact this person has been accused of a crime, without sufficient evidence to prosecute on it's own merits.
Would a key to the safe in which you keep your secret accounting be self-incrimination?
-=This sig has nothing to do with my comment. Move along now=-
ever since lenovo/ibm started adding finger swipes to their laptops, biometrics have been handily dismissed as entirely insecure. iphone thumbreaders have been bypassed with 3d printings of the deceased's fingers. and even simple scans and printouts of thumbs and fingers have been more than enough to render the technology ineffective.
the solution is complex passphrases, hardened keystores, and challenge limits. if you cant guess the password in 3 attempts, you now have to wait $N amount of time. if you cant guess it in $X attempts, the device destroys its private keys.
Good people go to bed earlier.
The original problem — one with actual passwords — came from the painfully perverted reading of the Fifth Amendment (I wish, ACLU et al were as liberal reading the Second!). If you have to tell police your password that could be used against you, then the password became testimony (written or verbal) and so the police could not compel you to do that under the Fifth Amendment.
Well, fingerprints are neither said nor written, so the Fifth Amendment does not apply. End of story — whether police can look at your smart phone's contents is now controlled by the Fourth... If the judge issues a warrant, you have to open up...
In Soviet Washington the swamp drains you.
I have the same question, I know that if I don't unlock my phone with my finger for several days (usually over the weekend) or if it powers down due to exhausted battery. it will require my entering my passcode. Unless they have a way to trick the phone into thinking no time has passed, I don't see what good a fingerpint will do them? The secure enclave will have dumped the fingerprint-tied key by that point and will require the regular passcode.
I work for the Department of Redundancy Department.
What if the courts subpoenaed your financial statements from last year, and instead you lit them on fire in front of the police? Nothing good. That's what would happen.
If they found that key on their own, no....if they forced you to provide the location of the key, yes. (I'm assuming in this case that they already have you in custody, so the whole "we know this key is in your pocket, give it to us" doesn't apply)
Moral of the story is Don't leave evidence on your phone. Or anywhere else for that matter.
Idiotic statement. Sometimes what isn't actually evidence of anything can be used against you. Just because you have nothing to hide does NOT mean you have nothing to fear.
If you need an explanation why watch this video.
It means: transform Touch ID from a physical request to a knowledge request (thinking that would get the same protection as a password).
You have to give them a fingerprint ... but do you have to give them your knowledge of which fingerprint will unlock a device?
That may be true, but in this case the issue is about unlawful searches of your personal papers...
However, with a judge's consent, authorities CAN search for evidence within your personal effects (papers, phones, computers what ever) and all it usually takes to get a Search Warrant is probable cause, and they had that. So in this case, I see no constitutional problem. If they have a search warrant, unlock the stupid phone and save yourself all the trouble. It's like opening the safe in your house.... If they have a warrant, just open it for them... Don't like that? Fine, just go directly to jail then..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Destruction of evidence is a crime (current political figures aside) which will get you sent to jail.
May I suggest that it's a stupid idea to knowingly destroy evidence if you are the subject of a criminal investigation (or a civil lawsuit for that matter)? Now I guess if you know you are guilty, it might be worth the risk to you, but in general it's going to be a bad idea..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Ah, okay. I guess there wouldn't be any negative repercussions at all then. No destroying evidence charges. No contempt.. no parallels at all, really. Thanks for the enlightenment!
Why? Given investigators apparently have a Search Warrant blessed by a judge, the whole affair has been subject to judicial review and meets the constitutional standards set forth in our bill of rights. It's not like jack booted thugs just physically forced somebody to unlock a phone, they have a court order. At this point, it's a stupid idea to resist, just unlock the phone.
Unless, of course, you know you are guilty and the prenatally for non-compliance is less than the crimes you know the phone will implicate you for... In which case, you are playing a loosing hand anyway. But for most of us, the smart thing to do is unlock the stupid phone at this point.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Can you say destruction of evidence is a crime?
There are many circumstances where it is a crime to destroy evidence.
Yup, because that's something (the location) that you know, not something that you are.
I guess that would go in the same line as forcing something to give a DNA sample to match stuff found on the victim/crime scene?
Starting with iOS 9, there's an 8 hour timeout on TouchID. Longer than that, and you need to re-enter your passcode. TouchID won't work. (Source: http://www.macworld.com/articl...)
And of course as others have mentioned, on power up, passcode is required once. So if there's any possibility of a police interaction, crashboot your phone (hold power & home for five seconds), or shut it down normally if you have the time. Failing that, have your attorney appeal EVERYTHING to blow the 8 hour timeout away.
Also, FFS run the latest version of iOS, since this and other protections (some of which have worked in the San Bernardino case) aren't present in older releases.
This is why biometric identification should be used as a username, never a password.
Bite off your fingertips and eat 'em!
systemd is Roko's Basilisk.
Destruction of evidence is a crime (current political figures aside) which will get you sent to jail.
May I suggest that it's a stupid idea to knowingly destroy evidence if you are the subject of a criminal investigation (or a civil lawsuit for that matter)? Now I guess if you know you are guilty, it might be worth the risk to you, but in general it's going to be a bad idea..
But you are under no obligation to indicate which finger correctly unlocks the phone. As long as you comply with the court order "place index finger on fingerprint sensor", you don't have to tell them that doing so will erase the phone.
This is consistent with previous interpretations of the law, and the reasoning is the fifth amendment only applies to the information that is stored in your brain. The fifth amendment is the only protection you have that prevents the government from being able to compel you to divulge your passwords. The important thing to take away from this is that all authentication systems that rely on biometric information can be lawfully circumvented with a court order. The only authentication system that is protected under the fifth amendment is a token stored in your mind.
It is very much related, but an ongoing debate within the justice system, I would say. Things like people being compelled to have their blood drawn (for the purpose of testing blood alcohol after a DUI) or their DNA tested (but in different circumstances compared to what you suggest), are extensions of the "fingerprint" argument.
And courts have held that these things can be compelled to be produced by (or from) a person without their consent if certain circumstances are met. But it requires a warrant -- it can't just be done by the police because they feel they need to.
In some states, if you're under suspicion of a felony DUI charge, the police can seek a warrant to have your blood drawn/tested for alcohol. Regarding DNA, for example, in California, if you are a suspect for a felony, you can be forced by the court to have your blood/DNA tested. In all 50 states, someone who has been convicted of a felony can have his/her blood/DNA required to be drawn.
There should be an option for a "complex bio-metric" unlock method which would allow you for example the use of two fingers to unlock in a particular order. Since the order in which the registered fingers is knowledge they can't compel you to unlock the device since it would be self-incrimination.
...Fingerprints, in contrast, have traditionally been viewed as 'real or physical evidence,' meaning that police are entitled to take them without permission....
Historically, fingerprints have had value only as evidence. That is quite different than the biometric security usage that fingerprints also enjoy nowadays. Biometric security has morphed fingerprints from being only evidence to also being security passcodes.
.
imo, fingerprints, when used purely as evidence (i.e, as they have been used historically), should not require a search warrant.
However, when fingerprints are used for a security purpose (i.e.are not evidence, but a security key), then they should be treated as being part of a search that the security key enables.
It will be interesting to see how the Supreme Court eventually rules on this.
Nope. Refuse to tell which finger unlocks the phone. They cannot COMPEL testimony, and that is what that would be. They have one in ten shot of getting it right.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
BINGO!
Refuse to testify against yourself, comply with orders to place "finger" (you didn't say which one) on the reader. Place finger on reader and ... ooops.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
It is unconscionable to force a criminal defendant to assist his or her own prosecution in any way whatsoever.
Don't break the law. If you don't like the law, work to get it changed.
Unpossible. There are so many laws that can be interpreted in so many ways, if an agent wants to pin something on you, they WILL find something. It has been widely reported that the average American commits 3 felonies a day, without even knowing it.
"Somebody has to do something. It's just incredibly pathetic it has to be us."
--- Jerry Garcia
Not to use your fingerprint to unlock/decrypt anything.
Thieves will love having to chop off fingers rather than trusting a victims claim of what their password/PIN is....
In Europe, we understand that, in this context, a fingerprint is equivalent to a password and deserves to be protected as such. You dumb fat Americans really should extend the same protections to fingerprints in this context.
Europeans don't know the difference between something you have and something you know. No wonder Great Britain wants out.
"Somebody has to do something. It's just incredibly pathetic it has to be us."
--- Jerry Garcia
My fingerprint won't unlock shit. I used my DICK as the fingerprint. Would they like me to whip it out to unlock it in front of them?
And this is yet another reason to think that instead of paying too much attention to "oh shiny".
I was against them as "passwords" due to - you can't change them if you're hacked.
I guess Apple isn't magic fairy dust after all...oh, wait.
Why guess when you can know? Measure!
Corporations are people.. if they can keep terabytes and beyond of data encrypted and just have their IT guy plead the 5th. Why would they not all do that?
Hell, don't even tell them that 9 of your 10 fingers will delete data. And don't offer a finger. Let them grab your hand, single out a finger, and swipe it over the reader on your phone.
Personally, I'd configure it such that none of my fingers unlocks the phone, they should all delete data. But only after.. I don't know, lets say 3... successful reads of my fingerprint. That way I don't accidentally erase my data myself.
"I'm not sure I like the fugnutish tone you used in your post!" -RogL (608926)-
And that, my friends, is why I also use my middle finger instead of my index finger as input to my phone's fingerprint scanner.! How many times does it need to fail before the phone locks you out? My phone requires a PIN code, not a fingerprint, every time it gets turned back on, and after updating software as well. Seems like a court order to "put your finger on the fingerprint scanner" would be VERY easy to make fail to actually unlock the phone, and charging with contempt of court for the phone not recognizing your fingerprint seems pretty shaky to me.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
You have 10 fingers. Use any finger except for the obvious one (right index finger), and you can pretty much guarantee the fingerprint scan will fail. Of course, you have to have the foresight to not use the obvious finger to program the fingerprint scanner BEFORE the court demands you unlock the phone, so this helps actual criminals a lot more than innocent civilians, but still... I need to redo my fingerprint scanner data.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
By the time they get to that finger, it will require a passcode to be unlocked.
https://www.eff.org/https-everywhere
Seems fair to me.
-- Tigger warning: This post may contain tiggers! --
THEN...
"Never write when you can talk. Never talk when you can nod.
And never put anything in an e-mail."
NOW...
"Never write when you can talk. Never talk when you can nod.
And never put anything in an e-mail, or on your smartphone."
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Is there any good reason to even use Touch ID or other fingerprint unlocks instead of just using a password or passcode?
But you ARE obligated to disclose what the court orders you too. You are risking a criminal contempt charge which gets you put in jail at the pleasure of the judge, no bail hearing, no trial, no passing go or collecting $200....
IF the order says "index finger" then so be it. However, if you have not been forthcoming about what might happen here (i.e. you mislead them into ordering you to use your index finger) then you are withholding evidence at best, and willfully destroying it at worst, neither of which will go well for you at trial.
Enjoy your time in the Big House... But if it's worth it to risk destroy evidence, have at it. I just suggest you get a lawyer and discuss it with them before you go out and do something unnecessarily stupid to yourself.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
There's no excuse for not using suspects fingerprints in this way, so long as they have legally obtained a search warrant. It's certainly no different than breaking a lock to enter someone's home. I believe this is mostly going to affect poorly educated criminals like drug dealers, petty thieves, and such. Anyone with half a brain would not rely on a simple phone lock to encrypt their data in the first place. It's so trivial to do, those who don't really must be the worst, most obnoxious criminals out there.
How exactly does the DA have a case if he doesn't have any evidence, or requires the evidence on the phone to further carrying the case?
"Authorities" required to demonstrate the legitimate source of their authority.
Requiem for the American Dream
yep, you are "racist". you like certain ethnic groups and hate others, and say some ethnic groups are subhuman - meaning you are not only racist, you are a racial supremist and hence ignore facts about human genetics, including the fact that there is only one human race - we probably killed the remaining human races 10's of thousands of years ago.
But isn't the government's stand that this is, essentially, discovery, which can be compelled in civil cases...?
So is there criminal discovery in states or federally that would compel a defendant or suspect to surrender incriminating evidence, and how does that not run afoul of the Fifth Amendment?
deleting the extra space after periods so i can stay relevant, yeah.
Passcodes are inconvenient for objects that are part of our daily lives. However, Apple did plug that firmware hole in the 5S and later phones. There have got to be vulnerabilities still, because there always are, but Apple's closing them as they find out about them.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
If you do have a duress finger, you could try not telling them. You can't legally prevent them from holding your fingers to the sensor, but I don't know that they can compel you to say which one. (If there's any doubt that the phone is yours, they probably can't.) However, there are people who, unlike me, have actually studied law and who can answer these sorts of questions much better than I can. Before relying on anything I may have said in a criminal case, ask one of those guys first.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
You can't be compelled to divulge a password that's incriminating in itself. Assuming it's legal to compel your cooperation anyway, it's legal to compel you to enter it yourself.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
I'm not a lawyer, I don't play one on TV and I didn't stay at a Holiday Inn Express.... BUT, I have been sued and a party to a couple of legal actions over my 5 decades, so I have some experience, but I'm no expert.
Please note that I almost ALWAYS say something along the lines of "consult YOUR lawyer" in posts that deal with legal questions. The law isn't really *that* difficult to understand if you *think* about it. I found that once you understood the principles underlying the whole, what the rules are actually make pretty good sense. Rules of evidence, in general are not that difficult to understand.
I do know that if you are ordered by the court to unlock your device, you are obliged to do so. I also know you are obliged to make sure you don't destroy potential evidence and cannot take steps to hide evidence from being found. Failing to follow any of these rules leaves you at risk of being sanctioned (punished) by the court. In criminal trials, you can plead the 5th and refuse to testify or assist law enforcement by answering their questions, but you cannot hide or destroy evidence or be misleading in the statements you DO choose to make. In civil court, the rules are a bit different because you are not being tried for a crime, you have less 5th amendment protection and generally MUST produce evidence requested and answer the questions asked by the other side truthfully and completely.
So don't think you will get away with destruction of evidence by claiming the court ordered you to do something.... You won't. But please ask your lawyer, though I'm pretty sure they will agree with me.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
In a criminal case, last I looked it appeared questionable whether you're required to provide unlocking information for a device in some circumstances. You can't be required to do that if providing that information is potentially incriminating in itself, and you can be required to provide a password if it shelters stuff that is already known to be on your device (the first case, I believe, was the guy who showed some of his child pornography to a customs agent). As you point out, the civil rules are different.
What I don't know, because I don't think it's settled, is how much information I need to provide if accused of a crime. Assume there's a phone with a duress fingerprint that is connected with a crime, and it isn't clear that I know how to unlock it. I don't have to volunteer a thing about unlocking the phone, since that would mean incriminating myself. If the police require me to put a finger on the sensor, I have to comply, whether it's the unlocking or duress finger, and what will happen will happen. Any warning or refusal to use the duress finger would incriminate me. I don't know the rules if the phone is known to be mine, but I suspect I'd get into serious trouble if I didn't warn about the duress fingerprint.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
I may be later to this post but I seem to remember, backed up by this page clipping from Apple (https://support.apple.com/en-us/HT204587)
"To configure Touch ID, you must first set up a passcode. Touch ID is designed to minimize the input of your passcode; but your passcode will be needed for additional security validation:
After restarting your device
When more than 48 hours have elapsed from the last time you unlocked your device
To enter the Touch ID & Passcode setting"
Therefore, this is not this whole case moot, since 48 hours has most certainly expired since the phone was taken as evidence, thus the fingerprint is not a valid unlock and the legally protected passcode is back in play.