Yottabytes: Storage and Disaster Recovery

Jan 27 2019   8:38PM GMT

Don’t Get Too Excited About the Fingerprint Ruling

Sharon Fisher Sharon Fisher Profile: Sharon Fisher

Tags:
government
privacy
Security

For some time now, it’s been true that, while people may or may not be required to give their cell phone passwords to law enforcement, they were required to give fingerprints and other biometric agents. That’s because a fingerprint is something you have, similar to the way that you can be compelled to give up a blood sample to test for alcohol. And just last August, law enforcement forced a suspect to unlock their iPhone with their face.

But due to a recent court ruling, that may be changing, and people might not be forced to unlock their phones using biometric agents, either.

“Judge [Kandis] Westmore declared that the government did not have the right, even with a warrant, to force suspects to incriminate themselves by unlocking their devices with their biological features,” writes Thomas Brewster in Forbes. “Previously, courts had decided biometric features, unlike passcodes, were not ‘testimonial.’ That was because a suspect would have to willingly and verbally give up a passcode, which is not the case with biometrics. A password was therefore deemed testimony, but body parts were not, and so not granted Fifth Amendment protections against self-incrimination.”

But the judge didn’t agree with this, Brewster writes. “That created a paradox: How could a passcode be treated differently to a finger or face, when any of the three could be used to unlock a device and expose a user’s private life? And that’s just what Westmore focused on in her ruling. Declaring that ‘technology is outpacing the law,’ the judge wrote that fingerprints and face scans were not the same as ‘physical evidence’ when considered in a context where those body features would be used to unlock a phone. ‘If a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device,’ the judge wrote.”

Oh my. Isn’t that going to be interesting.

Of course, we’re a long way from this case changing anything universally. “The magistrate judge decision could, of course, be overturned by a district court judge, as happened in Illinois in 2017 with a similar ruling,” Brewster points out.

That ruling was when a U.S. Magistrate Judge in the Northern District of Illinois used the Fourth and Fifth Amendments to deny a warrant to compel individuals present at the scene of an investigation to use their “fingerprints and/or thumbprints” to unlock Apple devices, writes Ian Lopez in the Recorder.

“By using a finger to unlock a phone’s contents, a suspect is producing the contents on the phone,” the Illinois judge noted. “With a touch of a finger, a suspect is testifying that he or she has accessed the phone before, at a minimum, to set up the fingerprint password capabilities, and that he or she currently has some level of control over or relatively significant connection to the phone and its contents.”

Not everyone agrees with the judge’s ruling, which also can’t be used as a precedent. Orin Kerr, of the Volokh Conspiracy, who has written about a number of these issues, doesn’t agree that providing a fingerprint  violates the Fifth Amendment, for example. “Westmore’s opinion will only make things less clear and more complicated,” writes Josephine Wolff in Slate. “All of her reasoning completely ignores the fundamental idea that what the Fifth Amendment protects is the contents of your mind—not the pattern of your fingertip or anything else about your physical attributes. Just because fingerprints and passwords can both be used for the same purpose when it comes to encryption does not mean that they are both testimony or should both be treated in the same way under the law.”

Eventually, the whole case could end up in the Supreme Court’s lap.

Interestingly, the ruling cited a recent Supreme Court case, Carpenter, about cell phone location data, as well as another one, Riley, requiring a warrant to search a cell phone. The judge also used the Fifth Amendment argument that providing a biometric was self-incrimination, just as courts have recently been deciding that knowing an encryption password wasn’t on its face self-incrimination.

It’s also likely to get civil liberties’ organizations such as the American Civil Liberties Organization, the Electronic Frontier Foundation, and the Electronic Privacy Information Center pretty excited,  because up until now the “have to provide a fingerprint” thing was fairly settled. Lopez quoted an ACLU representative as saying that he expected to see a lot more of these cases going forward.

 Comment on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: