Slashdot Mirror
Cops Are Now Opening iPhones With Dead People's Fingerprints (forbes.com)
An anonymous reader shares a report: In November 2016, around seven hours after Abdul Razak Ali Artan had mowed down a group of people in his car, gone on a stabbing spree with a butcher's knife and been shot dead by a police officer on the grounds of Ohio State University, an FBI agent applied the bloodied body's index finger to the iPhone found on the deceased. The cops hoped it would help them access the Apple device to learn more about the assailant's motives and Artan himself.
This is according to FBI forensics specialist Bob Moledor, who detailed for Forbes the first known case of police using a deceased person's fingerprints in an attempt to get past the protections of Apple's Touch ID technology. Unfortunately for the FBI, Artan's lifeless fingerprint didn't unlock the device. In the hours between his death and the attempt to unlock, when the feds had to go through legal processes regarding access to the smartphone, the iPhone had gone to sleep and when reopened required a passcode, Moledor said. He sent the device to a forensics lab which managed to retrieve information from the iPhone, the FBI phone expert and a Columbus officer who worked the case confirmed. That data helped the authorities determine that Artan's failed attempt to murder innocents may have been a result of ISIS-inspired radicalization.
Where Moledor's attempt failed, others have succeeded. Separate sources close to local and federal police investigations in New York and Ohio, who asked to remain anonymous as they weren't authorized to speak on record, said it was now relatively common for fingerprints of the deceased to be depressed on the scanner of Apple iPhones, devices which have been wrapped up in increasingly powerful encryption over recent years. For instance, the technique has been used in overdose cases, said one source. In such instances, the victim's phone could contain information leading directly to the dealer.
This is according to FBI forensics specialist Bob Moledor, who detailed for Forbes the first known case of police using a deceased person's fingerprints in an attempt to get past the protections of Apple's Touch ID technology. Unfortunately for the FBI, Artan's lifeless fingerprint didn't unlock the device. In the hours between his death and the attempt to unlock, when the feds had to go through legal processes regarding access to the smartphone, the iPhone had gone to sleep and when reopened required a passcode, Moledor said. He sent the device to a forensics lab which managed to retrieve information from the iPhone, the FBI phone expert and a Columbus officer who worked the case confirmed. That data helped the authorities determine that Artan's failed attempt to murder innocents may have been a result of ISIS-inspired radicalization.
Where Moledor's attempt failed, others have succeeded. Separate sources close to local and federal police investigations in New York and Ohio, who asked to remain anonymous as they weren't authorized to speak on record, said it was now relatively common for fingerprints of the deceased to be depressed on the scanner of Apple iPhones, devices which have been wrapped up in increasingly powerful encryption over recent years. For instance, the technique has been used in overdose cases, said one source. In such instances, the victim's phone could contain information leading directly to the dealer.
Trigger happy cops will now be happier. The dead will not resist that caps use its fingerprints to unlock their phone... :(
Proof gathered this way should be invalidated or else cops will be more inclined to kill the suspects to access more easily their phones
I'm not sure there is a 4th amendment issue here if the suspect is dead, as they would no longer have an expectation of privacy, and the item was found after the commission of a crime. I'm open to the possibility that I'm wrong on this, looking forward to hear arguments.
Taking guns away from the 99% gives the 1% 100% of the power.
No, but a simple mask would. Oh you poor fanboys!
It would be nice if these devices automatically unlocked after some time limit, like 1 year. At least we could get into a device after someone died or after the police confiscated a device long enough, without having to hand over some backdoor keys that compromises the security of all our devices.
There really is no perfect solution that protects our rights and provides security and allows law enforcement to do their job. Some reasonable compromise has to be found. I'm of the mind that our rights has the highest priority, followed by the security of millions of people, and then finally the needs of a small number of criminal investigators.
“Common sense is not so common.” — Voltaire
That's why I never use finger print scanners, albeit Apple wants to shove those down everyone's throat by asking for a fingerprint every time you download an app, if you happened to register 1 finger print at least once.
I stopped reading Forbes articles when they started requiring me to disable my adblocker.
Tell you what. If I'm murdered and the cops think there might be something on my phone that would tell them who murdered me, I'm cool with them using my finger to unlock it.
Why not?
systemd is Roko's Basilisk.
Trigger happy cops will now be happier. The dead will not resist that caps use its fingerprints to unlock their phone... :(
Proof gathered this way should be invalidated or else cops will be more inclined to kill the suspects to access more easily their phones
Dude. No. No cop I've ever known would kill a drug user just to get a line on the dealer. Climb out of the youtube-hate.
The police are most likely covered by probable cause. Since the criminal was shot dead, he was obviously up to no good and the police had every right to search his phone for further threat, motive, accomplices, etc.
Moral of the story is don't go on killing spree. Or the cops might just use your dead fingers to unlock your phone.
Tell you what. If I'm murdered and the cops think there might be something on my phone that would tell them who murdered me, I'm cool with them using my finger to unlock it.
Apropos of nothing, are you cool with them having an incentive for shooting you rather than taking you in, in order to get at your information?
A simple mask wouldn't work either, you appear to know nothing about FaceiD or technology. Oh you poor Apple Haters!
The mask (singular) you read about unlocking an iPhone X? It was rather complex, requiring a full 3D scan, IR photos of the area round the eyes placed exactly right, which also require a living subject to capture... how are you going to get that photo after they are dead? Your "point" in the end is just more Hater bullshit, pointless in relation to the current article and doing more to highlight your own ignorance and ineptness than relevancy.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
when I said that we should NOT do the fingerprint lock on the phone. I have to say that it will actually encourage somebody killing you, and taking your hand, or such as the police using it.
HOWEVER, where it DOES make sense, is for app access. IOW, once you have unlocked the phone, but an app, say credit card needs to be unlocked again, the finger print makes sense. Kind of wish that we could do say 1-3 prints for the key. That would truly limit the likelihood of somebody being able to use it.
I prefer the "u" in honour as it seems to be missing these days.
Why not?
I've heard people complaining that it doesn't always work right after they've been asleep... so it's not surprising it might not work after the Big Sleep.
#DeleteChrome
Apple FaceID requires the person have that smug look of self-importance. Dead faces all appear as Windows users to FaceID.
after Abdul Razak Ali Artan had mowed down a group of people in his car, gone on a stabbing spree with a butcher's knife ... on the grounds of Ohio State University...
I'm confused - I thought guns were the problem.
Do you have ESP?
Just sayin'
Also wouldn't work with a 4 digit pin. Seems like we solved this problem long before it existed.
You don't need to get a payday loan to afford phone security anymore.
You're welcome.
OSU is always "The". always always
...when you unlock it with my cold, dead hands.
I don't want my dead fingers to be more useful to the cops than my living fingers. That's a bad-mojo sort of incentive brewing right there.
Well, iPhones are not for poor people.
Also wouldn't work with a 4 digit pin.
Sure it would, if he had a friend or roommate or GF that knew the PIN (which most would). Lots more ways to get a PIN after someone is dead.
You don't need to get a payday loan to afford phone security anymore.
We live in a world where $40k cars are common now and you complain that a phone you could use for three to four years costs $1k? You use a phone every day. I use it vastly more often than my car. And you can get it free through some channels like carrier subsidy... there's a way for anyone to have an X that really wants one.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Now our President? I'm not so sure anymore.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Try uBlock Origin.
Lower memory/CPU footprint than a lot of the others, and lots of places don't detect it (like Forbes).
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
Index finger? Maybe they should have used the thumb.
Heh, this certainly gives new meaning to that expression!
Body dead too long? Too bad. Get a warrant.
Druggie too stoned to give consent? Get a warrant.
Want to access my phone FOR ANY REASON? Get a fucking WARRANT.
Scruting the inscrutable for over 50 years.
You can't steal a password off someone's body, dead or alive.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Privacy advocates: "Over my dead body!"
Police: "Challenge accepted!"
"It would be nice if these devices automatically unlocked after some time limit, like 1 year."
This gives you an easy attack vector: just reset the clock.
http://www.geoffreylandis.com
Abdul Razak Ali Artan had mowed down a group of people in his car, gone on a stabbing spree with a butcher's knife and been shot dead by a police officer on the grounds of Ohio State University,
Attention, you millennial ornate hexagonal crystals of dihydrogen monoxide! For how much longer are we going to let people ride around in these personal weapons of mass destruction, wielding kitchen utensils that can kill silently at any time? The UK is taking knives away from people now, and so can we. #CarsKillKnivesKillBusesForAll
Am I the only one who noticed?
an FBI agent applied the bloodied body's index finger
Uh... Perhaps using the thumbprint instead would have been better since that is what the iPhone uses?
What would happen if, say, during the commission of a crime, the suspects finger was lost (got ripped off ... something gross)? If the cops recovered it, could they use it to attempt an unlock? If that's the case, we are one step from suspects "accidentally" losing a finger, conveniently.
I've always said English was my second language. Had Romeo and Juliet been written in C, I might have understood it.
Biometrics: Uses and Abuses by Bruce Schneier
TL;DR:
Biometrics are powerful and useful, but they are not keys.
But always keep in mind that biometrics are not secrets.
NOTE: Article is ~20 years old, but the advice is as timely as ever.
Mmmm...k? He probably had brown people photos (family) in his phone and went on rants within social media like everyone else. Maybe he owned a few guns. What he did was called a drive-by folks, not terrorism, though I'm sure UK people would disagree given that a couple of guys with knives (in U.S. they'd have been shot in 5 minutes) qualify over there. The reality is that there are simply just crazy people in this world with no explanation because that's how crazy works. Him getting out of the car to stab people afterwards proves it. No inspiration needed. Wonder what kind of bonuses and promotions are handed out for labeling like this? I guess only white people go postal insane while the rest of the races are terrorists. Being named Andul probably doesn't help much either.
In that case Martin Shkreli's face can probably unlock any apple phone with FaceID enabled.
I don't care. If you're dead, you should have absolutely zero rights.
-- 'The' Lord and Master Bitman On High, Master Of All
Well, it can use any finger you register. I use a thumb and an index finger.
Of course, you only get so many attempts (fewer than 10) so you can't go through all fingers without getting a lockdown.
I think you want to reply to the parent, as I have not suggested the time-based unlock is feasible in a secure smart phone.
However, the issue of resetting the clock can be mitigated by requiring the phone to be unlocked to access those settings. Alternatively the "mechanism to unlock after 1 year" could require a digitally signed request that is also countersigned by multiple secure timestamping authorities possessiong X509 security certificates from trusted Root CAs holding the timestamping role trusted by the smartphone that agree that the 1yr unlocking request has been submitted to them at exactly Y time.
There are good reasons for Apple's practices of purging the decryption key from RAM and requiring a full key be entered after some hours --- assuming an adversary has hijacked physical possession of the powered on phone but not managed to gain access; keeping the key in RAM increases the risk that the decryption key could be stolen by tampering with the device and reading the RAM directly: as time progresses, the chance of discovering a previously unknown unpatched "Unlocking" vulnerability grows --- the vulnerabilities cannot be safely fixed when the owner is not in physical possession of their device to authorize a code update.
High time too; thieves have been using Hands of Glory for hundreds of years now, it's nice to see the police finally catching up with modern necromantic technology...
Agreed in that it's all about circumstances. If a person was randomly found dead and was unidentifiable, I think it's perfectly reasonable to do this to try and identify who they were, reach out to next of kin. Same with a murder victim in that the fingerprint could help lead to their killer. However, if this is someone gunned down by police, or they find a victim who they can identify, unless there is an immediate threat as defined by the law (e.g. a bomb is planted and about to go off), I don't think there's any reason for police to be able to dig through their phone.
This is why I use my toes to unlock my phone!
From another source:
In theory, Apple’s Face ID authentication is supposed to require eye movement to work. But Marc Rogers, researcher and head of information security at Cloudflare, told Forbes that he’s recently discovered that photos of open eyes work just fine.
A few months ago, Vietnamese researchers did the same thing. With a mask.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Just sayin'
Also wouldn't work with a 4 digit pin.
Which has the added advantage that you can't be legally compelled to give up your PIN without a warrant.
Biometrics, not so much.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
The physical device hardly matters. Everything is in the "cloud" and can be subpoenaed. Hell you don't even need a subpoena, you can pay retail price for any Verizon customer's browsing history.
My phone is unlocked with no password required. If I had anything to hide it would be in plain sight.
- His phone looked like a gun to the officer who shot him. We did not find anything incriminating the deceased, but he did have the contact of another known suspect, which confirms our initial suspicions. At this point in time we will be asking the second suspect to provide us access to his phone, in order to continue the investigation.
Apple FaceID requires the person have that smug look of self-importance. ...
Apple FaceID also requires a 5 o'clock shadow & bed-head to function correctly.
The idea that a fingerprint somehow is a "secret" is just unbearably fucking stupid.
A password is something kept inside your mind expressed by your will.
It is perfectly OK to use as a Login name.
Deathbed: "Promise me. Promise: You'll delete my browser history—"
Friend: "Yes. Browser history. Got it."
Deathbed: "And obliterate my index finger's prints."
Friend: "Yeah-yeah. Finger's prints. I promise."
Deathbed: "And destroy my burner phones."
Friend: "I prom—'phones'?"
Deathbed: "And disable my Coprophagy Friend Finder account."
Friend: "Say WHA—?"
Deathbed: "And delete my Amazon 'special intimates' wishlist."
Friend: "Just a darned minute—"
Deathbed: "You can have my Love Client Number Nine Platinum Card."
Friend: "Yeah. Uh-No..."
Upon the death of someone, their possessions transfer to their next of kin.
So the police ought to need authority from the new owner, or the executor of the deceased's will, or some other person who has assumed legal authority over the possessions.
U are SPOT on.
I leave my phone locked at all times for that very reason. In fact, because so many ppl are relaxed at home, they will tend to believe that there is no cause for concern. Wrong attitude.
In fact, Drive-bys happen all the time here where I live. I used to have a honey pot so that I could see what was happening in our area. Amazing how often I would get an alert and right in front of my house was a car parked across the street from the house, with the driver bent downwards and not aware that I had several cameras on him (and 1 her), and their plates.
I prefer the "u" in honour as it seems to be missing these days.
Alternatively the "mechanism to unlock after 1 year" could require a digitally signed request that is also countersigned by multiple secure timestamping authorities possessiong X509 security certificates from trusted Root CAs holding the timestamping role trusted by the smartphone that agree that the 1yr unlocking request has been submitted to them at exactly Y time.
Or forget the CAs (which are vulnerable to hacking, of the technical, social, and political varieties) and instead require as input one year's worth of valid blocks from the Bitcoin blockchain, starting at a known checkpoint updated the last time the phone was online. Easy to do if a year has actually passed, cost-prohibitive otherwise. One thing proof-of-work blockchains are very good at is providing evidence of the passage of time.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat