Suspect Required To Unlock iPhone Using Touch ID in Second Federal Case (9to5mac.com)

An anonymous reader shares a report on 9to5Mac: A second federal judge has ruled that a suspect can be compelled to unlock their iPhone using their fingerprint in order to give investigators access to data which can be used as evidence against them. The first time this ever happened in a federal case was back in May, following a District Court ruling in 2014. The legal position of forcing suspects to use their fingerprints to unlock devices won't be known with certainty until a case reaches the U.S. Supreme Court, but lower court rulings so far appear to establish a precedent which is at odds with that concerning passcodes. Most constitutional experts appear to believe that the Fifth Amendment prevents a suspect from being compelled to reveal a password or passcode, as this would amount to forced self-incrimination -- though even this isn't certain. Fingerprints, in contrast, have traditionally been viewed as 'real or physical evidence,' meaning that police are entitled to take them without permission.Ars Technica has more details.

Comments

TFA is not terribly clear...

[LichtSpektren]

Was he compelled to actually put his finger on the phone, or was he just compelled to surrender his fingerprints? TFA is not precisely clear about that. If it's the former then that's incontrovertibly a violation of the Fifth Amendment. If it's the latter then it's just routine--he's going to leave a trace somewhere eventually.

In either case, the moral of the story is, don't use your biometrics to lock your phone.

Re: TFA is not terribly clear...

[ArmoredDragon]

I don't think it makes a difference. It's well known that in IT security, the authentication factors are who you are, what you have, and what you know. The Constitution only protects the what you know factor. The who you are factor, which is almost entirely biometric, has almost zero protection. Why? Because all three branches of the government can compel you to identify who you are, and there is nothing in either the Constitution or any written laws saying otherwise.

Re:TFA is not terribly clear...

[Aaden42]

There's (not a lot of...) case law that suggests a truly deadman switch that erases a device isn't considered destroying evidence. If you *do* something actively that triggers it, that's destruction and you can be charged. If by doing nothing, the device is erased, that's okay. You're also not under any obligation to mention such a thing exists.

So for example if you set something up to wipe the device if you sent a magic text message, that would be a problem. Something that wipes if you don't touch it for a week is generally considered legal. It generally goes with the idea that you can be held to consequences for your *actions*, but there's a higher bar to hold you accountable for your *inactions*.

Re: TFA is not terribly clear...

[Anonymous Coward]

I would like to see a "duress fingerprint". Force me to use my fingerprint? Fine, I'll use my middle finger which disables all biometrics until further notice.

Re:TFA is not terribly clear...

[naughtynaughty]

Routinely destroying evidence to avoid implicating yourself could be a crime. However, having an automatic data retention policy likely would not be a crime. If you routinely back up your data to encrypted storage, a good practice, and then automatically delete old data you are being prudent, not a criminal. Just don't sit around with your partners in crime discussing how to thwart law enforcement by using data retention policies.

Intent matters. And intent is difficult to prove if there isn't any hard evidence and your actions have a legitimate purpose.

Re:TFA is not terribly clear...

[Anubis IV]

If [he was compelled to put his finger on the phone], then that's incontrovertibly a violation of the Fifth Amendment.

As someone who used to stand by that view, nowadays it strikes me as the stance of someone who values their privacy (as we all should!), but who hasn't thought through the ramifications of their stance yet.

For instance, I'd wager you have no problem when the police swab a suspect for their DNA, nor when a passed-out drunkard is compelled to provide a blood sample in the hospital after a DUI, yet in both cases the suspect is being compelled, potentially against their will, to provide something incriminating of themselves to a machine in the police's custody that will tell the police whether the evidence from the suspect is incriminating or not. That's no different than compelling a suspect to provide their fingerprint to a phone in the police's custody that may have the ability to incriminate the suspect.

In fact, both DNA evidence and the BAC measurement situation I described have made it through and been affirmed by the Supreme Court already (in some cases, multiple times), for the simple reason that the right against self-incrimination only extends to "testimonial" evidence (a.k.a. "communicative" evidence), not to "real" evidence...nor should it.

I recall reading portions of the majority opinions for some of the seminal cases in this area a year or two back when researching the topic, and one of them basically stated that if we took the notion that we can't collect incriminating "real" evidence to its logical conclusion, we wouldn't even be able to compel someone to reveal enough of their physical appearance for them to be recognizable to an eyewitness, which they asserted was utterly absurd and was clearly beyond the bounds of the protections afforded by the 5th Amendment. More or less, so long as the police have a warrant and aren't trying to compel any form of demonstration of knowledge (i.e. testimony), they're within their rights.

You've already said that you're fine with the police collecting fingerprints, which is good, since fingerprints are not testimonial/communicative in nature. But how the police collect and use them is left up to them to decide. Whether they collect them on a piece of paper, via an electronic scanner that stores them to local database, or by way of a sensor that writes them into a transient piece of memory on a mobile device makes no difference. In all three, they're simply compelling the suspect to provide a piece of evidence in their custody to a device or system in the police's custody. It's a simple transfer of physical evidence from the suspect to the police. The means may be different, but the thing being compelled is the same in all three cases.

That the evidence can be used to incriminate the suspect does not mean their rights have been violated. And the best course of action if you don't like that fact is to stop using real evidence (e.g. keys, fingerprints, etc.) as a locking mechanism.

Re:More Federal Stupidity

[Archangel Michael]

If you're not doing illegal stuff on your phone, you don't have to worry.

That works, until the government decides that your particular activity is a threat to government and makes it illegal. So no, you're incorrect, you should worry about what your government can do to you.

My particular solution would be to have a deadman's switch that erases the phone when using any finger but the one correct one. Or better yet, disable the Finger Prints from your phone, and use a proper PIN, which they cannot force you to divulge.

confusion about self-incrimination

[supernova87a]

A lot of people are confused by what self-incrimination means. Self-incrimination is forcing someone to testify (testimonial obligation), be a witness against their own interest/side in a criminal action, or generally be forced to say/admit anything that might be used against them unwittingly later as part of a prosecution. The right to non self-incrimination does not mean you are immune from having evidence produced that incriminates you!

The key thing is that it is a right to not testify, or be a witness, which is the act of saying or stating something. If a person can be compelled to produce his/her fingerprints (something which in itself is not a testimonial act), then just because that unlocks something that incriminates the person does not mean they have been self-incriminated.

Nothing to hide != nothing to fear

[sjbe]

Moral of the story is Don't leave evidence on your phone. Or anywhere else for that matter.

Idiotic statement. Sometimes what isn't actually evidence of anything can be used against you. Just because you have nothing to hide does NOT mean you have nothing to fear.

If you need an explanation why watch this video.

Re:Forcing you to aid in a search

[Curunir_wolf]

your fingerprints aren't a testimony against yourself. Read the damn thing. "nor shall be compelled in any criminal case to be a witness against himself."

Your fingerprints absolutely can be evidence against you. That's not even a question. The police have a long established right to take your fingerprints when you are arrested and to compare them with gathered evidence.

That said I have a hard time reconciling this with the right against self incrimination in the Constitution. In principle I feel a biometric pass code should be legally no different than a memorized one. Either way you are being forced to potentially incriminate yourself. But I suspect that the legal system will rule that they are different and so if you want your phone to be secure against search and seizure you must avoid biometric pass codes unfortunately. The problem here is that they are not comparing your fingerprints against evidence they have found. They are in effect forcing you to open a lock on their behalf. I don't have a problem with them having the right to search but I don't see why the target of the investigation should be forced to aid in that search. If they can break down a door to do a search (with a warrant) then have that right but I don't see why I should have to hand over the key to the house so to speak.

Courts have long held that you are required (once a proper warrant has been issued) to provide keys to any lock (such as a safe) that is the subject of search or evidence. However, you cannot be compelled to provide the combination of a safe that is secured that way. So they're using the same principle. Your fingerprint is something that you HAVE, so you can be required to provide it. A combination or password is something that you KNOW, and you're allowed to keep your mental secrets secret.