A U.S. federal judge has ruled that law enforcement can’t force people to unlock their iPhones using the phone’s biometric capabilities – like FaceID or TouchID.
The ruling comes from a Jan. 10 filing, for which police were seeking a search warrant as part of a cyber-extortion case. The victim was allegedly being threatened on Facebook Messenger to pay two extortionists money – or else an “embarrassing” video would be released to the public.
Law enforcement wanted to use the warrant to search through the suspects’ belongings – including unlocking any devices on the premises via fingerprinting or facial recognition. That would mean compelling the suspects to use their fingers or other “biometric features” to unlock their personal devices.
However: “The Court finds that the government’s request runs afoul of the Fourth and Fifth Amendments, and the search-warrant applications must be denied,” according to the ruling for the case, which was filed in the U.S. District Court for Northern California.
Judge Kandis Westmore, who was behind the ruling, said that forcing suspects to open their phone via biometrics would be in violation of the Fourth Amendment, which protects the right of citizens to be secured against unreasonable searches; as well as the Fifth Amendment, which protects a citizen’s right against self-incrimination (i.e., someone can’t be compelled in criminal cases to be a witness against themselves).
For Electronic Frontier Foundation (EFF) Staff Attorney Jamie Williams, that ruling was a step in the right direction when it comes to mobile privacy.
“As Magistrate Judge Westmore correctly recognized, given the sheer amount of data on modern day cell phones, the government simply cannot anticipate the full contents of someone’s phone, and any order compelling someone to unlock their phone — whether via a numeric pass code or a fingerprint scan— violates the Fifth Amendment privilege against self-incrimination,” he told Threatpost.
Other Biometrics Rulings
Is forcing the fingerprinting to unlock devices in violation of the Constitution? Opinion has varied over the past few years.
This most recent incident is reminiscent of a previous case in 2017, where law enforcement sought the right to coerce people to open seized phones via fingerprinting. The 2017 case, which was part of a child pornography investigation, was also denied by the federal magistrate judge who it was brought to in Chicago.
In a separate 2016 case the court actually approved two searches that would allow law enforcement to force the suspects to unlock their phones via fingerprinting.
Fingerprinting and biometrics is also a separate case from forcing passcodes to be entered on phones. Courts that addressed the passcode issue in the past found that it cannot be coerced, due to the Fifth Amendment.
That’s because the act of communicating the passcode is considered “testimonial” as “the expression of the contents of an individual’s mind falls squarely within the protection of the Fifth Amendment,” according to the filing.
But biometric protection is different, as it involves the physical features and attributes of a suspect.
“It’s important that courts are looking closely at how searches of digital devices affect our constitutional rights,” Williams told us. “The Supreme Court has made clear that digital searches raise serious privacy concerns that did not exist in the age of physical searches, because our devices carry a wealth of highly sensitive, personal information. This has implications not only on law enforcement’s ability to lawfully search a phone, but also on law enforcement’s ability to force people to unlock their phones and thereby serve as witnesses against themselves.”
Mobile Privacy Challenges
Mobile privacy has long been a challenge for U.S. courts. As devices house more and more personal data, law enforcement and the Department of Justice have increasingly clashed over the years about what level of privacy should be maintained on phones as part of various criminal cases.
The debate came to a head in 2016 when a U.S federal magistrate judge ordered that Apple help the FBI break into an iPhone 5C belonging to one of the shooters involved a terrorist attack in San Bernardino, Calif. (Eventually the FBI withdrew its request, announcing that it found a third-party to assist in unlocking the phone).
Other cases have cropped up regarding mobile privacy since then: In 2018, the court ruled law enforcement needs a warrant to obtain mobile phone tower records that can reveal a user’s location over time.
In this most recent case, Westmore said in the ruling that courts are facing the increasing challenge of “technology outpacing the law.”
“The challenge facing the courts is that technology is outpacing the law,” she said. “In recognition of this reality, the United States Supreme Court recently instructed courts to adopt rules that ‘take account of more sophisticated systems that are already in use or in development.'”
