Technological Self-Incrimination: The Precedent of Biometric Unlocking
In September 2013, Apple unveiled Touch ID: a mechanism that allows a user to unlock his or her iPhone using a fingerprint.[1] Since the unveiling of Touch ID, courts have been forced to consider how evidence can legally be obtained from locked smartphones without violating the Fifth Amendment protection against self-incrimination. The increased use of biometric unlocking by technology companies such as Apple may make phones more secure than a weak passcode, but more vulnerable to searches by law enforcement.
The Fifth Amendment to the United States Constitution states that no person “shall be compelled in any criminal case to be a witness against himself.”[2] This is commonly referred to as the Self-Incrimination Clause, which protects an individual from being forced to supply the prosecution with information that could be used in court as evidence of his or her guilt.[3]
There are two types of evidence: “testimonial” evidence and “non-testimonial” evidence.[4] The Supreme Court distinguished these two types of evidence under the Fifth Amendment in the 1988 case Doe v. United States. According to the decision in Doe, testimonial evidence must “relate a factual assertion or disclose information.”[5] Compelling a suspect to give up non-testimonial evidence would be a violation of his or her Fifth Amendment right against self-incrimination.[6] Non-testimonial evidence, on the other hand, refers to evidence such as fingerprints, DNA, and hair samples, which do not force a suspect to disclose “any knowledge he might have.”[7] The U.S. Department of Homeland Security calls “physical characteristics” that can be used to identify an individual—such as DNA or fingerprints—biometrics.[8] However, the “foregone conclusion” doctrine states that the government cannot compel evidence to be produced by a suspect unless the existence of that evidence is confirmed and its whereabouts are known.[9]
In 2014, Commonwealth of Virginia v. Baust came before the Second Circuit Court. David Baust, the defendant, allegedly recorded evidence of an assault he committed on his personal phone, which required a fingerprint or a passcode to unlock.[10] The prosecution and the defense disputed over whether or not compelling Baust to give up the video—by forcing him to unlock his phone with a passcode or fingerprint—was “self-incrimination” under the Fifth Amendment.[11] The judge ruled that compelling Baust to give up the password to his iPhone would qualify as testimonial evidence, and therefore be a violation of Baust’s Fifth Amendment right against self-incrimination.[12] In this situation, “the foregone doctrine conclusion did not apply” because “the password is not a physical thing” and “only exists in [the defendant’s] mind.”[13]
Forcing Baust to unlock his phone using his fingerprint was not found to be a violation of the Self-Incrimination Clause, as fingerprints are non-testimonial evidence. Whereas giving up his passcode would have required Baust to “disclose the contents of his own mind,” forcing Baust to unlock his phone using a fingerprint did not require him to disclose any of his own “knowledge.”[14]
A police officer or other law enforcement official cannot compel one to unlock their phone with a fingerprint just because they are suspicious. In the case of Riley v. California, a 2013 Supreme Court case decided just before the release of the iPhone with Touch ID, a police officer conducted a warrantless search of an iPhone after arresting a suspect. The Court ruled that cell phones cannot be searched without a warrant, with the exception of emergencies, as digital data does not typically pose a life-threatening risk to police officers.[15] However, the decision in Riley v. California did not provide a way to compel a suspect to help bypass the passcode.[16]
On February 25, 2016, at 12:28 PM, a U.S. Magistrate Judge in Los Angeles, California, issued a warrant allowing an F.B.I. agent to compel Patysar Bkchadzyhan to unlock her phone using Touch ID.[17] According an Atlantic article by Kaveh Waddell, this was the first time such a warrant had ever been issued. If Bkchadzyhan had locked her iPhone using a passcode instead of Touch ID, the article noted, the judge would not have been able to issue a warrant forcing her to unlock it.[18] The same Atlantic article that reported on Bkchadzyhan’s warrant also noted that “biometric indicators” also include “your likeness.”[19] While this little bit of information may not have meant much in 2016, when the article was first published, it has recently taken on a whole new meaning in terms of biometric unlocking.
In September 2017, Apple unveiled the iPhone X, which allows a user to unlock his or her phone using his or her face with Face ID.[20] iOS 11, Apple’s newest operating system for the iPhone, has a so-called “cop button” that disables Face ID. If a user presses the power button five times, Face ID is disabled until the passcode is entered.[21] It is also unclear whether Face ID will work only when the person is physically present or if a photograph can unlock the iPhone X as well.[22]
The American Civil Liberties Union (ACLU) has already raised concerns over Face ID. The ACLU predicts that courts will view Face ID the same way they did Touch ID with respect to self-incrimination.[23] Technology seems to be moving faster than courts can keep up with it. It typically takes several years for a case to reach the Supreme Court, but Face ID was unveiled just four years after Touch ID.[24] Precedent does not become binding on a federal level unless there is a Supreme Court ruling. Circuit Courts cannot establish precedent on a federal level, which means that there will not be a nationwide standard on issues of biometrics and the Fifth Amendment until and unless a case comes before the Supreme Court.[25] Therefore, there is no binding, nationwide standard for whether or not suspects can be compelled to unlock their phones using biometrics. While courts so far seem to be ruling similarly in cases involving biometric phone unlocking, it is possible that judicial decisions on this issue could vary widely between Circuit Courts until and unless a nationwide standard is set.
Some, like Brett Max Kaufman of the ACLU, argue that “forcing an individual to decrypt data on a digital device will always be testimonial,” meaning that the Fifth Amendment should apply regardless of whether a passcode, Touch ID, or Face ID is used to secure a phone.[26] According to this argument, individuals would have the opportunity to refuse to give up their data under the Self-Incrimination Clause. Just this year, U.S. Magistrate Judge David Weisman noted that “[equating] the limited protection afforded a fingerprint used for identification purposes to forced fingerprinting to unlock an Apple electronic device” did not seem to be “supported by Fifth Amendment jurisprudence.”[27] Weisman did not grant the request to compel unlocking Apple iPhones equipped with Touch ID.[28] However, it is important to note that the warrant request Weisman was replying to did not include specific information about whose phone was to be searched—presenting an issue with the application of the foregone conclusion doctrine—and offered an “outdated” view of technology. Thus, Weisman’s belief that “forced fingerprinting” should not be used “to unlock an Apple electronic device” was not the only reason the request was not granted.[29]
Current case law as a whole does not seem to support Kaufman’s argument or Weisman’s opinion. At this point, compelling suspects to unlock their iPhones using Touch ID in situations where the foregone conclusion doctrine applies and a present warrant is legal. It is unclear what perspective courts will take on this issue in the future or what will be said about Face ID. For now, setting a passcode on your phone may make a user’s data more secure – at least under the Fifth Amendment.
[1] Apple, Inc., Apple Announces iPhone 5s—The Most Forward-Thinking Smartphone in the World, Apple Newsroom (2017), online at https://www.apple.com/newsroom/2013/09/10Apple-Announces-iPhone-5s-The-Most-Forward-Thinking-Smartphone-in-the-World/ (visited October 1, 2017).
[2] US Const. amend. V
[3] The Gale Group, Inc., Fifth Amendment, The Free Dictionary (2008), online at http://legal-dictionary.thefreedictionary.com/Self-Incrimination+Clause (visited October 1, 2017).
[4] Doe v. United States, 487 U.S. 201 (1998)
[5] Ibid.
[6] Commonwealth of Virginia v. Baust, No. CR14-1439 (2nd Cir. Oct. 28, 2014)
[7] Doe v. United States, 487 U.S. 201 (1998)
[8] U.S. Department of Homeland Security, Biometrics, Homeland Security (2017), online at https://www.dhs.gov/biometrics (visited October 1, 2017).
[9] Commonwealth of Virginia v. Baust, No. CR14-1439 (2nd Cir. Oct. 28, 2014)
[10] Ibid at 1-2.
[11] Ibid at 2.
[12] Ibid at 5.
[13] Ibid at 4.
[14] Ibid at 5.
[15] Oyez, Riley v. California, Oyez (2013), accessed online at https://www.oyez.org/cases/2013/13-132 (visited October 1, 2017).
[16] Riley v. California, 573 U.S. __ (2014)
[17] warrant from Kaveh Waddell, Police Can Force You to Use Your Fingerprint to Unlock Your Phone, The Atlantic (2016), online at https://www.theatlantic.com/technology/archive/2016/05/iphone-fingerprint-search-warrant/480861/ (visited October 1, 2017).
[18] Kaveh Waddell, Police Can Force You to Use Your Fingerprint to Unlock Your Phone, The Atlantic (2016), online at https://www.theatlantic.com/technology/archive/2016/05/iphone-fingerprint-search-warrant/480861/ (visited October 1, 2017).
[20] Apple, Inc., iPhone X, Apple Newsroom (2017), online at https://www.apple.com/iphone-x/ (visited October 1, 2017).
[21] Tom Warren, iOS 11 has a ‘cop button’ to temporarily disable Touch ID, The Verge (2017), online at https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-disable-emergency-services-lock (visited October 1, 2017).
[22] Jay Stanley, Apple’s Use of Face Recognition in the New iPhone: Implications, ACLU (2017), online at https://www.aclu.org/blog/privacy-technology/surveillance-technologies/apples-use-face-recognition-new-iphone (visited October 1, 2017).
[24] Arizona Judicial Branch, How a Case Moves Through the Court System, Azcourts.gov (2017), online at https://www.azcourts.gov/guidetoazcourts/How-a-Case-Moves-Through-the-Court-System (visited October 1, 2017).
[25] Georgetown University Law Writing Center, Which Court is Binding? Mandatory vs. Persuasive Cases, The Writing Center at GULC (2004), online at http://www.law.georgetown.edu/academics/academic-programs/legal-writing-scholarship/writing-center/upload/WHICH_COURT_IS_BINDING_Painter-and-Mayer-FINAL.pdf (visited October 1, 2017).
[26] Brett Max Kaufman, Will Apple’s FaceID Affect Your Rights?, ACLU (2017), online at https://www.aclu.org/blog/privacy-technology/surveillance-technologies/will-apples-faceid-affect-your-rights (visited October 1, 2017).
[28] Jason Meisner and Steve Schmadeke, Judge blocks FBI from forcing fingerprints from targets to unlock iPhones, Chicago Tribune (2017), online at http://www.chicagotribune.com/news/ct-forced-fingerprinting-iphones-met-20170305-story.html (visited October 15, 2017).