Every smartphone of note these days has some sort of biometric unlock option, be that fingerprint, iris scanning, or face unlock. US courts have held that your right against self-incrimination does not extend to these biometric features, making them less secure than a password. However, a federal judge just said quite the opposite in a ruling. The District Court for the Northern District of California says that police can’t force you to unlock a phone with your face or fingerprints.
This is a complicated situation, but it all traces back to the Fifth Amendment to the US Constitution. That’s the one that forbids the government from forcing someone to give evidence against themselves. When you hear about someone “taking the fifth,” they’re refusing to answer a question on the grounds that it may incriminate them. The Fifth Amendment also means you don’t have to talk to the police — the rights police enumerate when arresting someone include “you have the right to remain silent.”
Courts have previously held that police can’t force a suspect to provide a password to unlock an electronic device. That counts as “testimonial” information and is protected by the Constitution. A body part is a different matter. Can a physical feature be protected under the Fifth Amendment? Most judges have said no, and police have used this rationale to unlock phones with the suspect’s fingerprints and more recently their face. That’s been a boon to investigators in this era when most phones are encrypted out of the box.
Now, judge Kandis Westmore has disagreed with that legal reasoning. The California case revolved around an attempted extortion scam in which a suspect demanded money to prevent the release of “embarrassing” videos. Police requested a search warrant that allowed them to unlock any smartphone found at the location using a fingerprint, face, or iris scan.
The judge, in this case, denied the warrant on two grounds. First, the request to search all phones at the location was overly broad. More significantly, Westmore equated biometric features to a password. “If a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device,” the judge wrote. In short, forcing someone to use their body to unlock a phone counts as self-incrimination under the Fifth Amendment.
Higher courts could easily disagree with this ruling, and the law is still very much unclear. Police will probably continue to use biometric features to unlock devices until someone mounts a major challenge to the practice that could take years to wind its way through the courts. In the meantime, a password is still the best way to protect your data.
- Researchers Create ‘Master Fingerprints’ to Unlock Phones
- iOS 11 Will Implement a ‘Cop Button’ to Disable Touch ID
- Feds serve warrant demanding fingerprints from all home residents to unlock their phones