Slashdot Mirror
Cops Are Now Opening iPhones With Dead People's Fingerprints (forbes.com)
An anonymous reader shares a report: In November 2016, around seven hours after Abdul Razak Ali Artan had mowed down a group of people in his car, gone on a stabbing spree with a butcher's knife and been shot dead by a police officer on the grounds of Ohio State University, an FBI agent applied the bloodied body's index finger to the iPhone found on the deceased. The cops hoped it would help them access the Apple device to learn more about the assailant's motives and Artan himself.
This is according to FBI forensics specialist Bob Moledor, who detailed for Forbes the first known case of police using a deceased person's fingerprints in an attempt to get past the protections of Apple's Touch ID technology. Unfortunately for the FBI, Artan's lifeless fingerprint didn't unlock the device. In the hours between his death and the attempt to unlock, when the feds had to go through legal processes regarding access to the smartphone, the iPhone had gone to sleep and when reopened required a passcode, Moledor said. He sent the device to a forensics lab which managed to retrieve information from the iPhone, the FBI phone expert and a Columbus officer who worked the case confirmed. That data helped the authorities determine that Artan's failed attempt to murder innocents may have been a result of ISIS-inspired radicalization.
Where Moledor's attempt failed, others have succeeded. Separate sources close to local and federal police investigations in New York and Ohio, who asked to remain anonymous as they weren't authorized to speak on record, said it was now relatively common for fingerprints of the deceased to be depressed on the scanner of Apple iPhones, devices which have been wrapped up in increasingly powerful encryption over recent years. For instance, the technique has been used in overdose cases, said one source. In such instances, the victim's phone could contain information leading directly to the dealer.
This is according to FBI forensics specialist Bob Moledor, who detailed for Forbes the first known case of police using a deceased person's fingerprints in an attempt to get past the protections of Apple's Touch ID technology. Unfortunately for the FBI, Artan's lifeless fingerprint didn't unlock the device. In the hours between his death and the attempt to unlock, when the feds had to go through legal processes regarding access to the smartphone, the iPhone had gone to sleep and when reopened required a passcode, Moledor said. He sent the device to a forensics lab which managed to retrieve information from the iPhone, the FBI phone expert and a Columbus officer who worked the case confirmed. That data helped the authorities determine that Artan's failed attempt to murder innocents may have been a result of ISIS-inspired radicalization.
Where Moledor's attempt failed, others have succeeded. Separate sources close to local and federal police investigations in New York and Ohio, who asked to remain anonymous as they weren't authorized to speak on record, said it was now relatively common for fingerprints of the deceased to be depressed on the scanner of Apple iPhones, devices which have been wrapped up in increasingly powerful encryption over recent years. For instance, the technique has been used in overdose cases, said one source. In such instances, the victim's phone could contain information leading directly to the dealer.
I'm not sure there is a 4th amendment issue here if the suspect is dead, as they would no longer have an expectation of privacy, and the item was found after the commission of a crime. I'm open to the possibility that I'm wrong on this, looking forward to hear arguments.
Taking guns away from the 99% gives the 1% 100% of the power.
It would be nice if these devices automatically unlocked after some time limit, like 1 year. At least we could get into a device after someone died or after the police confiscated a device long enough, without having to hand over some backdoor keys that compromises the security of all our devices.
There really is no perfect solution that protects our rights and provides security and allows law enforcement to do their job. Some reasonable compromise has to be found. I'm of the mind that our rights has the highest priority, followed by the security of millions of people, and then finally the needs of a small number of criminal investigators.
“Common sense is not so common.” — Voltaire
That's why I never use finger print scanners, albeit Apple wants to shove those down everyone's throat by asking for a fingerprint every time you download an app, if you happened to register 1 finger print at least once.
I stopped reading Forbes articles when they started requiring me to disable my adblocker.
Tell you what. If I'm murdered and the cops think there might be something on my phone that would tell them who murdered me, I'm cool with them using my finger to unlock it.
Why not?
systemd is Roko's Basilisk.
Trigger happy cops will now be happier. The dead will not resist that caps use its fingerprints to unlock their phone... :(
Proof gathered this way should be invalidated or else cops will be more inclined to kill the suspects to access more easily their phones
Dude. No. No cop I've ever known would kill a drug user just to get a line on the dealer. Climb out of the youtube-hate.
Tell you what. If I'm murdered and the cops think there might be something on my phone that would tell them who murdered me, I'm cool with them using my finger to unlock it.
Apropos of nothing, are you cool with them having an incentive for shooting you rather than taking you in, in order to get at your information?
A simple mask wouldn't work either, you appear to know nothing about FaceiD or technology. Oh you poor Apple Haters!
The mask (singular) you read about unlocking an iPhone X? It was rather complex, requiring a full 3D scan, IR photos of the area round the eyes placed exactly right, which also require a living subject to capture... how are you going to get that photo after they are dead? Your "point" in the end is just more Hater bullshit, pointless in relation to the current article and doing more to highlight your own ignorance and ineptness than relevancy.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
when I said that we should NOT do the fingerprint lock on the phone. I have to say that it will actually encourage somebody killing you, and taking your hand, or such as the police using it.
HOWEVER, where it DOES make sense, is for app access. IOW, once you have unlocked the phone, but an app, say credit card needs to be unlocked again, the finger print makes sense. Kind of wish that we could do say 1-3 prints for the key. That would truly limit the likelihood of somebody being able to use it.
I prefer the "u" in honour as it seems to be missing these days.
Yea, how dare they shoot a terrorist during on a killing spree ... I mean ... such a lovely person who just wanted to spread his message of harmony with his truck of peace and knife of cultural coexistence.
Why not?
I've heard people complaining that it doesn't always work right after they've been asleep... so it's not surprising it might not work after the Big Sleep.
#DeleteChrome
spread his message of harmony with his truck of peace.
Heh, this also applies to '60s hippies and all-time pedophiles.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
Apple FaceID requires the person have that smug look of self-importance. Dead faces all appear as Windows users to FaceID.
Just sayin'
Also wouldn't work with a 4 digit pin. Seems like we solved this problem long before it existed.
You don't need to get a payday loan to afford phone security anymore.
You're welcome.
OSU is always "The". always always
...when you unlock it with my cold, dead hands.
No, guns are the CURRENT problem. Once they've banned those and murders are still happening they'll get around to knives and trucks.
I think you're confusing Muhammads. Just sayin'...
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
I don't want my dead fingers to be more useful to the cops than my living fingers. That's a bad-mojo sort of incentive brewing right there.
Nor will the living. At least not successfully. The cops already will just hold your finger on the scanner if you refuse to do it when they tell you (and then charge you with obstruction.)
Your ad here. Ask me how!
Also wouldn't work with a 4 digit pin.
Sure it would, if he had a friend or roommate or GF that knew the PIN (which most would). Lots more ways to get a PIN after someone is dead.
You don't need to get a payday loan to afford phone security anymore.
We live in a world where $40k cars are common now and you complain that a phone you could use for three to four years costs $1k? You use a phone every day. I use it vastly more often than my car. And you can get it free through some channels like carrier subsidy... there's a way for anyone to have an X that really wants one.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Yes, you are very confused. His 'mowing down group of people' and 'stabbing spree' caused only injuries. The only person to die was Artan who got shot. Now compare the body count with typical shooting spree.
Now our President? I'm not so sure anymore.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Try uBlock Origin.
Lower memory/CPU footprint than a lot of the others, and lots of places don't detect it (like Forbes).
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
But the court CAN require your password and hold you in contempt (and toss you in jail for the duration) for not providing it. Pleading the 5th won't get you out of this.
Also, My I-phone requires that the password be entered before the fingerprint scanner will work.... So if you are a criminal, just power down your phone if you fear you will have to interact with the cops and they won't be able to open your phone in case of your untimely death (or by physically forcing you to apply your finger).
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Heh, this certainly gives new meaning to that expression!
Body dead too long? Too bad. Get a warrant.
Druggie too stoned to give consent? Get a warrant.
Want to access my phone FOR ANY REASON? Get a fucking WARRANT.
Scruting the inscrutable for over 50 years.
You can't steal a password off someone's body, dead or alive.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Police have had a solution to that one for years. It's why the 'no knock' warrant exists - they just need to convince a judge there is reason to believe the suspect will destroy evidence if given the opportunity.
If the police believe you have evidence at your home or on your person, they will get a warrant to search you. But if they believe the evidence is easily destroyed - a phone you can lock, or documents you can burn - then they will break into your home while you are at work. Or smash the door down and force everyone to the floor at gunpoint. Or you'll be walking down the street one moment, and the next two plainclothes officers have snuck up behind you and are pinning you against the wall while they get the cuffs on.
Recall the Dread Pirate Roberts arrest? Police knew his laptop would lock if he closed the lid, so they had to arrest him while he had it open. They used an officer posing as a waitress to get close enough without arousing suspicion, who pinned him to the floor while another ran in to grab the laptop.
This isn't something new. The legal system had had solutions for many years to address the problem of suspects who may destroy evidence if they know they are about to be arrested.
Holding you in jail doesn't give them the password though... so locking you up doesn't give them anything to go on other than that you didn't want to give out your password. What I think would be particularly interesting is to tie some sort of dead-man's switch to the password so that if you have to surrender the device, then you no longer have the ability to unlock it for them either. Can they still hold you in contempt for that?
File under 'M' for 'Manic ranting'
"It would be nice if these devices automatically unlocked after some time limit, like 1 year."
This gives you an easy attack vector: just reset the clock.
http://www.geoffreylandis.com
As of today, passwords have been deemed protected by the 5th while fingerprints have not. Passwords are a thing you know and as such, sharing them would be self incriminating. Fingerprints are a physical artifact and are not self incriminating.
Abdul Razak Ali Artan had mowed down a group of people in his car, gone on a stabbing spree with a butcher's knife and been shot dead by a police officer on the grounds of Ohio State University,
Attention, you millennial ornate hexagonal crystals of dihydrogen monoxide! For how much longer are we going to let people ride around in these personal weapons of mass destruction, wielding kitchen utensils that can kill silently at any time? The UK is taking knives away from people now, and so can we. #CarsKillKnivesKillBusesForAll
Am I the only one who noticed?
an FBI agent applied the bloodied body's index finger
Uh... Perhaps using the thumbprint instead would have been better since that is what the iPhone uses?
What would happen if, say, during the commission of a crime, the suspects finger was lost (got ripped off ... something gross)? If the cops recovered it, could they use it to attempt an unlock? If that's the case, we are one step from suspects "accidentally" losing a finger, conveniently.
I've always said English was my second language. Had Romeo and Juliet been written in C, I might have understood it.
Thinking about this.... The problem is that YOU cannot destroy evidence once you become aware that it might be wanted by law enforcement or subject to civil lawsuit.
IF your device is programed to do a secure erase after a given length of time w/o a successful login by you, I suppose that you could conceivably wait that length of time... The key would be that you'd have to specifically NOT take any action to erase the device (like entering the wrong password or something) and that you are not misrepresenting your ability to actually unlock the device. Basically, you would have to explain that the device was programmed to secure erase anytime it was out of your control for a specific duration.
I'm no lawyer, but that *might* be sufficient to destroy the evidence w/o being held responsible for it, but I'm betting that it might not be a good idea in the long run. Better to just not keep any data on the portable device where it's obvious in the first place.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
In that case Martin Shkreli's face can probably unlock any apple phone with FaceID enabled.
I don't care. If you're dead, you should have absolutely zero rights.
-- 'The' Lord and Master Bitman On High, Master Of All
Well, it can use any finger you register. I use a thumb and an index finger.
Of course, you only get so many attempts (fewer than 10) so you can't go through all fingers without getting a lockdown.
But would you be obligated to explain that *before* they ask for the device or take it from you?
File under 'M' for 'Manic ranting'
I think you want to reply to the parent, as I have not suggested the time-based unlock is feasible in a secure smart phone.
However, the issue of resetting the clock can be mitigated by requiring the phone to be unlocked to access those settings. Alternatively the "mechanism to unlock after 1 year" could require a digitally signed request that is also countersigned by multiple secure timestamping authorities possessiong X509 security certificates from trusted Root CAs holding the timestamping role trusted by the smartphone that agree that the 1yr unlocking request has been submitted to them at exactly Y time.
There are good reasons for Apple's practices of purging the decryption key from RAM and requiring a full key be entered after some hours --- assuming an adversary has hijacked physical possession of the powered on phone but not managed to gain access; keeping the key in RAM increases the risk that the decryption key could be stolen by tampering with the device and reading the RAM directly: as time progresses, the chance of discovering a previously unknown unpatched "Unlocking" vulnerability grows --- the vulnerabilities cannot be safely fixed when the owner is not in physical possession of their device to authorize a code update.
High time too; thieves have been using Hands of Glory for hundreds of years now, it's nice to see the police finally catching up with modern necromantic technology...
Agreed in that it's all about circumstances. If a person was randomly found dead and was unidentifiable, I think it's perfectly reasonable to do this to try and identify who they were, reach out to next of kin. Same with a murder victim in that the fingerprint could help lead to their killer. However, if this is someone gunned down by police, or they find a victim who they can identify, unless there is an immediate threat as defined by the law (e.g. a bomb is planted and about to go off), I don't think there's any reason for police to be able to dig through their phone.
That's a question for your lawyer friend.. I do not know.
The issue is that YOU have the responsibility to preserve any and all information that you reasonably know is relevant to criminal or civil legal actions if you can. You are afforded the right to delete any information as part of an automated processes and can legally delete any and all records/documents prior to becoming aware of the legal action and as long as you are taking reasonable care to preserve any data as soon as you are aware.
The question you are asking has to do with the period between when you become aware of the data should be preserved and when you can turn off the automation that deletes it. Seems this would put this squarely in the grey area, where you cannot reach the device to turn off the automatic scrub but you know it will delete information. Your justification would be that you couldn't stop the automation because they had your device. I suppose they would argue you had an obligation to tell them but you would also be able to claim that you didn't have access to the device because they took it so you couldn't stop the process. I'm guessing the court would have to figure what side that falls on, which might be good, if you are trying to avoid criminal prosecution.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
This is why I use my toes to unlock my phone!
From another source:
In theory, Apple’s Face ID authentication is supposed to require eye movement to work. But Marc Rogers, researcher and head of information security at Cloudflare, told Forbes that he’s recently discovered that photos of open eyes work just fine.
A few months ago, Vietnamese researchers did the same thing. With a mask.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Just sayin'
Also wouldn't work with a 4 digit pin.
Which has the added advantage that you can't be legally compelled to give up your PIN without a warrant.
Biometrics, not so much.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
My phone is unlocked with no password required. If I had anything to hide it would be in plain sight.
Yes, you are very confused. His 'mowing down group of people' and 'stabbing spree' caused only injuries. The only person to die was Artan who got shot.
So what you're saying is that a good guy with a gun...
An enigma, wrapped in a riddle, shrouded in bacon and cheese
- His phone looked like a gun to the officer who shot him. We did not find anything incriminating the deceased, but he did have the contact of another known suspect, which confirms our initial suspicions. At this point in time we will be asking the second suspect to provide us access to his phone, in order to continue the investigation.
Yes, you are very confused. His 'mowing down group of people' and 'stabbing spree' caused only injuries. The only person to die was Artan who got shot.
So what you're saying is that a good guy with a gun...
Be careful, little heads may explode if you finish that :)
Do you have ESP?
Was that far right, white, Christian bomber in Austin a terrorist then? Or is terrorist reserved only for those of other skin tones?
New Zealanders are well balanced with a chip on each shoulder. One represents Australia, the other the rest of the world
Deathbed: "Promise me. Promise: You'll delete my browser history—"
Friend: "Yes. Browser history. Got it."
Deathbed: "And obliterate my index finger's prints."
Friend: "Yeah-yeah. Finger's prints. I promise."
Deathbed: "And destroy my burner phones."
Friend: "I prom—'phones'?"
Deathbed: "And disable my Coprophagy Friend Finder account."
Friend: "Say WHA—?"
Deathbed: "And delete my Amazon 'special intimates' wishlist."
Friend: "Just a darned minute—"
Deathbed: "You can have my Love Client Number Nine Platinum Card."
Friend: "Yeah. Uh-No..."
Police officer to be exact. Which makes is pretty much a model case for advocating gun control.
U are SPOT on.
I leave my phone locked at all times for that very reason. In fact, because so many ppl are relaxed at home, they will tend to believe that there is no cause for concern. Wrong attitude.
In fact, Drive-bys happen all the time here where I live. I used to have a honey pot so that I could see what was happening in our area. Amazing how often I would get an alert and right in front of my house was a car parked across the street from the house, with the driver bent downwards and not aware that I had several cameras on him (and 1 her), and their plates.
I prefer the "u" in honour as it seems to be missing these days.
Recall the Dread Pirate Roberts arrest? Police knew his laptop would lock if he closed the lid, so they had to arrest him while he had it open. They used an officer posing as a waitress to get close enough without arousing suspicion, who pinned him to the floor while another ran in to grab the laptop.
Considering that the so-called Dread Pirate Roberts was arrested at a library, your "waitress" story doesn't hold a lot of water.
Breakfast served all day!
Because police officers are always good guys?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Alternatively the "mechanism to unlock after 1 year" could require a digitally signed request that is also countersigned by multiple secure timestamping authorities possessiong X509 security certificates from trusted Root CAs holding the timestamping role trusted by the smartphone that agree that the 1yr unlocking request has been submitted to them at exactly Y time.
Or forget the CAs (which are vulnerable to hacking, of the technical, social, and political varieties) and instead require as input one year's worth of valid blocks from the Bitcoin blockchain, starting at a known checkpoint updated the last time the phone was online. Easy to do if a year has actually passed, cost-prohibitive otherwise. One thing proof-of-work blockchains are very good at is providing evidence of the passage of time.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat
I am quite sure I read it was a waitress at the time it was current news, but perhaps the news coverage made some mistakes in the rush to be first to report. Or it may be an error in my memory. In either case, the argument holds. Wired offers this rather dramatic account of the arrest: "At 3:14 pm, DPR was typing away, writing to Cirrus. Just then, a middle-aged woman and man came toward Ross, ambling along in the kind of semihomeless shuffle you might often see in a San Francisco library. “Fuck you!” the woman yelled when they were directly behind Ross’ chair. As if they were a deranged couple about to fight, the man grabbed the woman by the collar and raised his fist. Ross turned around for just a second, during which a hand reached across the table and grasped Ross’ Samsung. The petite, unassuming young Asian woman sitting across from Ross this whole time was, to everyone’s surprise, also an FBI agent. Ross lunged for his machine, a hair too late, as she turned like a quarterback for a quick handoff to Kiernan, who appeared out of nowhere—as instructed—to get the laptop. It took less than 10 seconds."
The point of all this is that if the police believe their suspect may destroy the evidence if given even a few seconds warning, and they believe the suspect is important enough to be worth the expense, they have both the legal power and the history to take measures to prevent destruction of evidence - including ambush arrests by non-uniformed agents.