Another Federal Court Says Compelled Production Of Fingerprints To Unlock A Phone Doesn't Violate The Constitution

Legal Issues

from the must-be-going-so-dark-fingerprint-readers-won't-even-work dept

Where the Fifth Amendment ends for device owners largely seems to be determined by their favored security measure. If it’s a password keeping a device encrypted, courts seem more willing to call compelled production a Fifth Amendment violation. If it’s a biometric feature — most commonly fingerprints or faces — the courts are more likely to consider body parts non-testimonial.

There’s not enough of a consensus either way to make it a clear choice, but courts seem to feel faces/fingerprints are like “keys” and passwords like “combinations” when it comes to the metaphorical lockbox that is your phone.

Adding to the case law that is “fingerprints are lockbox keys” is this decision [PDF] from a federal court in Illinois. (via FourthAmendment.com) The court says the Supreme Court says this is how it must be, even if the Supreme Court has yet to field a device encryption case.

The government wants to look in the defendant’s phone for evidence of his threats against a confidential informant. There’s a built-in limit to this, although it’s not one of the government’s making. Investigators want to apply the suspect’s fingers and thumbs to the seized iPhone to unlock it. The suspect’s mind is being taken out of the equation (as it were), which could result in the government getting what it wants in this request without actually getting what it wants from the man’s iPhone.

In connection with the government’s motion to revoke Barrera’s bond conditions, District Judge Robert W. Gettlemen ordered that Barrera’s iPhone be turned over to Pretrial Services. The government seeks to search this iPhone, with a home button, that was taken from Barrera in order to develop evidence of his alleged threats. The iPhone has a fingerprint lock function (known as Touch ID), and the government asked this Court for a warrant to compel the defendant to place his fingers and thumbs on the iPhone home button in an attempt to unlock the phone. The government alleged in the affidavit in support of its request for a search warrant that it will select the fingers and thumbs to press on to the home button, and that the iPhone fingerprint unlock function will disable after five incorrect attempts. At that time, the iPhone function will demand a passcode to unlock the phone.

The court says any Fourth Amendment concerns are addressed by the government’s warrant, which puts it on the right side of the Riley decision. With that settled, the court addressed the Fifth Amendment issues. (Emphasis in the original.)

Applying those three requirements in reverse order here, a biometric scan is certainly compelled—the government is explicitly requesting the Court’s authority to force the scan. The act may also be incriminating, as unlocking the phone may lead to the discovery of a nearly unlimited amount of potential evidence including text messages, social media posts, call logs, emails, digital calendars, photographs and videos, and location data. […]

But if a compelled act is not testimonial, and therefore not protected by the Fifth Amendment, it cannot become protected simply because it will lead to incriminating evidence. As a result, the relevant Fifth Amendment inquiry here is whether the compelled act of scanning a subject’s fingerprint to unlock a device is a testimonial act.

The court decides it isn’t a Fifth Amendment violation because the government will be choosing the five digits it will apply to the iPhone button, rather than the suspect. To complete the metaphor, the government has ten keys to choose from, but only has five attempts to pick the right key. Since the government is doing all the choosing, the suspect isn’t doing anything testimonial since he isn’t being asked to tell the government which of his fingers will unlock the phone.

First, the Court holds that the biometric unlock procedure is more akin to a key than a passcode combination. The Supreme Court in Doe, and later in Hubbell, has illustrated the difference between testimonial and non-testimonial physical acts via this helpful comparison, which aptly applies to an iPhone that has two different unlock features – a fingerprint and a passcode. In Doe, the Court noted that the Fifth Amendment permits the government to force an individual to surrender a key to a strongbox containing incriminating documents, but not to reveal the combination to a subject’s wall safe. Thus, using the Doe framework, this Court examines whether a biometric scan of an individual’s finger or thumb is more like a key or a combination.

A combination passcode requires a verbal statement from the possessor of the code. More importantly, compelling someone to reveal a passcode also requires an individual to communicate something against her will that resides in her mind. A key, however, is a physical object just like a finger — it requires no revelation of mental thoughts. Nor does a finger require a communication of any information held by that person, unlike a passcode. In fact, the application of a finger to the home button on a iPhone “can be done while the individual sleeps or is unconscious,” and thus does not require any revelation of information stored in a person’s mind.

But even this conclusion is not that simple. The government must show it knows the phone is owned or controlled by the suspect before it can start asking the court to give it permission to apply the person’s fingers to the phone. The court doesn’t address whether the government has met this evidentiary burden but rather waves it away by citing a 1988 Supreme Court decision (Doe) dealing with the production of financial records.

[T]he Court holds that the implicit inference from the biometric unlock procedure, that the individual forced to unlock had some point accessed the phone to program his or her fingerprint, is not sufficient to convert the act to testimonial. The Supreme Court considered this similar concept in Doe, when it found that requiring a petitioner to execute a consent directive that would result in the production of bank records would not have testimonial significance.

[…]

Similarly, the implicit inference that one might draw from the biometric unlock procedure — that the cell phone was at some point accessed in order to program the biometric lock feature — is no different in significance than any of the above inferences. It is of the same scale that existed in Doe, Gilbert and the other cases discussed above. The implicit inference is also not necessarily as firm as on first impression – the Touch ID feature on an iPhone permits up to five fingerprints to be programmed, thus allowing the potential for multiple users to program the feature. As a result, the Court concludes that any implicit inference that can be drawn from a biometric unlock procedure is not of testimonial significance.

This decision further muddies the federal waters, making it more likely the Supreme Court will have to address these Fifth Amendment issues in the near future. But until it’s all settled, odds are passwords are better than fingerprints if your main concern is unwanted access by government employees.

Filed Under: 4th amendment, 5th amendment, biometrics, compelled production, fingerprints, passwords