According to The Virginian-Pilot, Judge Steven Frucci ruled that making suspects provide their passwords so police can snoop through their phones is a violation of the Fifth Amendment because it would force suspects to incriminate themselves. But in the same ruling, the presiding judge decided that demanding suspects to provide their fingerprints to unlock a TouchID phone is constitutional because it’s similar to compelling DNA, handwriting or an actual key—all of which the law allows.
Note that this ruling only applies in one Circuit in Virginia, but the logic would seem to apply. So, use passwords/passcodes on your iDevices!
Related Stories
The US Constitution's Fifth Amendment protection against self-incrimination does not prohibit police officers from forcing a suspect to unlock a phone with a thumbprint scan, a federal appeals court ruled yesterday. The ruling does not apply to all cases in which biometrics are used to unlock an electronic device but is a significant decision in an unsettled area of the law.
The US Court of Appeals for the 9th Circuit had to grapple with the question of "whether the compelled use of Payne's thumb to unlock his phone was testimonial," the ruling in United States v. Jeremy Travis Payne said. "To date, neither the Supreme Court nor any of our sister circuits have addressed whether the compelled use of a biometric to unlock an electronic device is testimonial."
A three-judge panel at the 9th Circuit ruled unanimously against Payne, affirming a US District Court's denial of Payne's motion to suppress evidence. Payne was a California parolee who was arrested by California Highway Patrol (CHP) after a 2021 traffic stop and charged with possession with intent to distribute fentanyl, fluorofentanyl, and cocaine.
[...] US District Courts applying Doe and Hubbell have reached different conclusions on biometric unlocking. The 9th Circuit decided that the compelled use of Payne's thumb "required no cognitive exertion" because it "merely provided CHP with access to a source of potential information, much like the consent directive in Doe. The considerations regarding existence, control, and authentication that were present in Hubbell are absent or, at a minimum, significantly less compelling in this case. Accordingly, under the current binding Supreme Court framework, the use of Payne's thumb to unlock his phone was not a testimonial act and the Fifth Amendment does not apply."
[...] Yesterday's ruling from the 9th Circuit also rejected Payne's argument that California Highway Patrol violated his Fourth Amendment rights. The Fourth Amendment dispute involved a special search condition in Payne's parole "requiring him to surrender any electronic device and provide a pass key or code, but not requiring him to provide a biometric identifier to unlock the device," the ruling said.
Despite that parole condition, "the search was authorized under a general search condition, mandated by California law, allowing the suspicionless search of any property under Payne's control," the ruling said.
"Moreover, we hold that any ambiguity created by the inclusion of the special condition, when factored into the totality of the circumstances, did not increase Payne's expectation of privacy in his cell phone to render the search unreasonable under the Fourth Amendment," the panel wrote.
Previously on SoylentNews:
It's Unconstitutional for Cops to Force Phone Unlocking, Court Rules - 20200625
Fingerprint Analysis Could Finally Get Scientific, Thanks to a New Tool - 20180519
Search Warrant for Your Fingerprint - 20160503
Police can Compel Fingerprint Unlocking of Phones - in Virginia - 20141104
(Score: 3, Interesting) by Fnord666 on Tuesday November 04 2014, @03:24PM
(Score: 5, Interesting) by RobotMonster on Tuesday November 04 2014, @03:58PM
Or use the wrong fingers - after a few fails it requires your passcode.
Knowledge of which fingers work is essentially part of your touchID "password".
(Score: 2, Interesting) by anubi on Wednesday November 05 2014, @04:15AM
I would think that duress programs could just as easily be installed, so that if you were forced to surrender the phone under duress, logging on with the wrong finger just instructs the phone to wipe itself, resetting itself to original default settings, much like the init switch on some routers.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
(Score: 2) by monster on Wednesday November 05 2014, @04:37PM
That would probably amount to willful destruction of evidence.
(Score: 2) by urza9814 on Thursday November 06 2014, @12:47PM
That's actually an interesting question. If you comply with their orders and what they order causes the phone to be wiped, can you really call that *willful* destruction?
Of course, that depends on if they say 'unlock your phone' or 'swipe your finger'; or if you can get the judge to buy a story of 'I was under a lot of stress and accidentally swiped wrong'...
(Score: 1) by monster on Thursday November 06 2014, @03:48PM
IMHO, if they can show that the real intention for the mechanism is indeed to wipe the data, it's still willful destruction, even if the police didn't say the "correct" words. Kind of like putting a shotgun in a mount, tieing a cord to the trigger and to the pommel of your door, then arguing that since it was the person who tried to open it who made the shot, you should be clear of manslaughter charges.
(Score: 2) by urza9814 on Thursday November 06 2014, @04:30PM
Yeah, that probably is how they'd try to prosecute at least. But there's a couple issues with your analogy. First, any reasonable person looking at the shotgun booby-trap would conclude that the only possible intention was to kill someone. If you set all that up, you wanted *someone* dead. Compare it to a magician -- the guy who helps Houdini put on the handcuffs doesn't get charged with murder if Houdini dies unless they can prove he did something directly malicious. Intent matters. With the phone wiping, there are other immediately obvious reasons you might install that software, and there are other immediately obvious reasons you might swipe the wrong finger. Which, at least theoretically, should mean that they have to prove you did it specifically intending to destroy evidence. And that's damn near impossible to do.
Ultimately, if you're rich and can afford a good lawyer, I think you could escape charges for doing that. If you do it and you've got a public defender, you're going to prison.
(Score: 3, Interesting) by Adamsjas on Tuesday November 04 2014, @10:58PM
Stop using biometrics.
These have already proven ineffective to any kid who can read a blog.
http://arstechnica.com/security/2013/09/defeating-apples-touch-id-its-easier-than-you-may-think/ [arstechnica.com]
(Score: 2) by doublerot13 on Tuesday November 04 2014, @03:38PM
They can force you give up fingerprints, have access to all your email accounts, text messages...pretty much every channel used in two factor auth.
Maybe a really long pass is the only way to go.
(Score: 2) by WizardFusion on Tuesday November 04 2014, @03:59PM
Why anyone would use a fingerprint lock is beyond me. It's not secure at all.
Saying that, it's much more secure than not setting at form of lock code at all - which I know some people do.
(Score: 3, Insightful) by VLM on Tuesday November 04 2014, @04:11PM
Saying that, it's much more secure than not setting at form of lock code at all - which I know some people do.
How so?
Obviously, its 2014, any .com, .gov, or criminal who gets physical custody of the device owns the device, although the amount of time required varies by device and threat level. Also if .gov and/or .com are serious, they don't need physical custody to gain complete access to all your data.
So a lock code or fingerprint merely stops the non-criminal elements of the general public and family members, or rephrased, people who aren't much of a threat.
The result seems to be nothing at all other than wasted effort on the part of the user while providing a false sense of security.
(Score: 0) by Anonymous Coward on Tuesday November 04 2014, @05:05PM
> So a lock code or fingerprint merely stops the non-criminal elements of the general public and family members, or rephrased, people who aren't much of a threat.
Think of all the places you (or probably not you since you are an uberman, so a normal person then) leave your phone momentarily unattended. Situations where you would notice it being stolen - and then remotely wipe it, but wouldn't notice if it were gone for just a couple of minutes. That is what fingerprint locking is good for.
Also, the very fact that the police want to force people to do this contradicts your claim that it is easy for them to work around.
(Score: 0) by Anonymous Coward on Wednesday November 05 2014, @04:40PM
I don't know what kind of places you talk about, what the kind I know fall in two types: The ones you could consider 'friendly' and so low risk and the ones where if you leave your phone unattended you can forget about getting it again.
(Score: 2, Insightful) by Anonymous Coward on Tuesday November 04 2014, @04:16PM
I don't see how this can pass the 4th ammendment. The very first thing on the list of things to be secure in is "their persons." If they got a warrant, that would be one thing. Taking a fingerprint or a DNA sample in order to record/search in their own database is a narrowly defined purpose, but forcing someone to apply their fingerprint to use on a non-police computer system is a major expansion. The judge seems to be doing that autistic thing where they ignore the intent of why fingerprints are collected and saying well since you can collect them for one narrow purpose it is OK to use them for any purpose because once you've got them it is a free-for-all.
(Score: 2) by hubie on Tuesday November 04 2014, @04:20PM
Autistic thing???
(Score: 0) by Anonymous Coward on Tuesday November 04 2014, @04:31PM
Yes. One of the characteristics of autism is a lack of understanding nuance when dealing with people.
(Score: 3, Informative) by CRCulver on Tuesday November 04 2014, @05:20PM
It has been some months now since a Supreme Court ruling that police need a warrant to search cell phones. Please try to keep up. This particular ruling concerns compelling defendents to provide their fingerprints in order to unlock a phone that police have already decided to search on the basis of a warrant.
(Score: 0) by Anonymous Coward on Tuesday November 04 2014, @07:58PM
Seems ambiguous to me. The police got themselves a warrant to search the phone, they did not get a warrant to force the defendant to unlock it for them.
(Score: 0) by Anonymous Coward on Tuesday November 04 2014, @10:07PM
Please clarify. Does a warrant compel compliance?
If the police have a warrant to search your house are you required to give them the keys? How about to your safe?