Feds Can't Force You to Unlock Your iPhone with Finger or Face, Judge Rules

https://www.forbes.com/sites/thomasbrewster/2019/01/14/feds-cant-force-you-to-unlock-your-iphone-with-finger-or-face-judge-rules/#12fbd51842b7

by koolba • 8 years ago

787 281 8 years ago

forbes.com

kevin_b_er• 8 years ago

I won't believe this ruling is safe until it goes thru higher levels. The Executive Branch has over the past 2 decades has shown a large propensity for attempts to disregard the 4th and 5th amendments, and I see no change in this posture or the attempts to subvert them with the current political climate.

lgleason• 8 years ago

There is a high probability that this will be challenged at a higher level.

gigatexal• 8 years ago

Let’s hope the Supreme Court hears it and it stands.

AmericanChopper2• 8 years ago

The judicial branch and the legislature have also been quite hostile to the 4th during that period. Its absolutely not a problem isolated to the executive.

lukifer• 8 years ago

Thank you, Antonin "Emails aren't Papers" Scalia.

burtonator2• 8 years ago

Bio identification is for usernames... not passwords.

NEVER use a fingerprint or an iris scan for a password. That's insane!

Just don't do it.

Joky• 8 years ago

What about a second factor for TFA?

parent5446• 8 years ago

Most people don't have attackers going after them who are harvesting fingerprints to get into their devices.

Angostura• 8 years ago

What about for devices that don't have usernames?

chrischen2• 8 years ago

Well out of convenience you kind of have to. But if you really wanted to you can just disable it at ports of entry.

grahamburger• 8 years ago

Meh, convenience matters. The alternative to me using a fingerprint reader oh my phone isn't me typing 16char alphanumeric password every time I pull my phone out, it's to not use a password at all.

ransom1538• 8 years ago

"I won't believe this ruling is safe until it goes thru higher levels."

Yes - right now, there are people being held indefinitely for not decrypting hard drives the US [1]. The law used is: "All Writs Act (28 U.S.C. § 1651)". As one judge said, "We don't want your password - we just want the hard drives in unencrypted state."

https://www.bleepingcomputer.com/news/legal/man-who-refused-...

5ML• 8 years ago

I fear I'll be barbecued for asking, but I must: What's the alternative? I am a privacy advocate and understand that the law can (and likely will) abuse a forced decryption law.

However, the story you linked is about a _police officer_ who was suspected of child pornography. His sister reported him to the police and 'content stored on the encrypted hard drive matched file hashes for known child pornography content'.

How can you look in the mirror and think he should go free without the evidence being examined? I couldn't live in a world where a suspect could say "Well, I forgot the password" and walk away Scott-free on such an ugly crime.

rayiner4• 8 years ago

It’s okay if you think we should not force people to unlock their phones pursuant to a criminal investigation. But it’s disingenuous to paint this as an attempt to “disregard” the 4th and 5th amendments. The Supreme Court in the 1950s and 1960s expanded the scope of those amendments far beyond the text. They turned the 4th amendment into a general purpose “privacy” amendment, even though the amendment doesn’t use that word or anything nearly as expansive. And they took the 5th amendment, which refers only to forcing someone to testify against themselves in a criminal case, and turned it into a broad protection against self incrimination. But that amendment doesn’t use the phrase “self incrimination” or anything nearly as broad.

This is not novel. It’s always been the rule that the police can force you to turn over evidence in your possession, even though they can’t force you to serve as a “witness” against yourself. The idea that turning over a password is like forcing someone to testify against himself because it involves a mental recollection is already a very stretchy interpretation of the 5th amendment. Extending that even further to situations that aren’t testimonial in any way (Face ID or Touch ID) is hard to defend as a matter of Constitutional interpretation (even if you think it is good policy).

The background principle of the law is that courts are entitled to all the evidence so they can find the truth. The amendments are exceptions to those rules created for specific purposes. But they are exceptions; they are not the rule. To the extent that anyone is trying to “bypass” something, folks reading those amendments unreasonably broadly are trying to bypass the general rule in favor of discovering evidence.

foxhill2• 8 years ago

bear in mind that whilst the scope of those ammendments may have been, for want of a better term, “extended” (SC sets precedent for interpretation, as far as i’m aware, i.e. the amendments do not actually change), you must also bear in mind that the scope and power of the government has expanded incredibly since they were written.

the concept of privacy, outside of say, what a married couple do in the bedroom, didn’t really exist when the constitution was created.

devices that are essentially extensions to ones “self” in the digital world couldn’t even have been imagined, let alone the rights required to make that one as as free as the america that was being created.

mch82• 8 years ago

What about Ammendments 9 and 10 that leave all rights and powers to the people unless they’re explicitly given to the government?

Amendment IX

The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people.

Amendment X

The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people.

stordoff2• 8 years ago

Read on their own, I'd be inclined to agree - neither the 4th or the 5th on their own appear to prevent this. However, taken together, I'm not so sure. Clearly a person can be searched under the 4th, and the discovered evidence used. However, when the accused has to take a more active role (Face ID/Touch ID/password), that would seem to go towards being a witness against yourself. As such, any search under the 4th would go towards being an unreasonable search, warrant notwithstanding, as it is predicated on a potential breach of the 5th.

It's a bit of a stretch, but I don't think it's _wholly_ without merit.

raxxorrax• 8 years ago

Unlocking your phone does give law enforcement access to more than evidence. Especially since in most cases the existence of said evidence isn't even ensured. What remains is a violation of privacy.

Unlocking a phone is just another fruit of the forbidden tree.

If you look at the last 20 years, giving law enforcement additional competency didn't improve anything.

jakelazaroff• 8 years ago

Relevant excerpt:

“The undersigned finds that a biometric feature is analogous to the 20 nonverbal, physiological responses elicited during a polygraph test, which are used to determine guilt or innocence, and are considered testimonial.”

So it's analogous to a passcode because you're divulging something stored by your body, as opposed to e.g. a metal key which is artificial.

Tangentially related, it's astounding to me that polygraphs are still considered valid evidence given how widely they've been discredited.

tick_tock_tick• 8 years ago

Look up studies on the reliability of witness testimony if you want to get really scared on how courts run.

SketchySeaBeast2• 8 years ago

Even forensic science can be used questionably. Really, once you're in the court room it's entirely rhetoric and fudge-factor.

TheSpiceIsLife4• 8 years ago

And jurors.

This one's my favourite:

The jurors who used a Ouija board to find a murderer guilty - https://www.abc.net.au/news/2018-05-08/ouija-board-juror-mis...

Buttons840• 8 years ago

The Drunkards Walk talks about the misuse of statistics in court as well. Not only do they get the math wrong easily, or make common mistakes ("the odds that it's raining given the ground is wet, is the same as the odds that the ground is wet given it's raining"), but if someone accurately states there is only a 1 in 100,000 chance of something happening by chance, the jury will think that means the "something" was not by chance, instead of "oh, so it happens by chance to thousands and thousands of people" like they should.

cmplxconjugate• 8 years ago

I once had to go to court as an individual had attempted to stab myself and another (we had tried to stop them from escaping the police).

During the suspect identification process I failed completely; the suspect was bald and had a spider tattoo on their face. I realised that I couldn’t even remember how they looked, it shocked me quite a lot. I assume it was the adrenaline.

derekp72• 8 years ago

I thought that polygraphs were not accepted as evidence in court, but are still used by some government and private agencies.

Also, just curious, have they been discredited as in that double-blind trials show no more than a 50/50 chance of being correct (i.e., flipping a coin)? Or is it that a high enough percentage of people will fail them even if innocent, or pass them even if guilty?

The thing I don't like about them is the method of reading them, where it is up to the subjective judgment of the examiner. That is, there isn't an algorithm that can be written down so that, for example, an untrained person or computer program can read it (and therefore be subjected to large enough random tests).

Retra4• 8 years ago

What does it mean for a polygraph to be "correct?" They're not lie detectors, they are stress detectors. You can't "fail" a polygraph in any reliable sense.

chooseaname2• 8 years ago

I thought that polygraphs were not accepted as evidence in court...

Only if you "pass". Fail one and admissible or not, it'll be brought up.

disishhsha• 8 years ago

The polygraph test is an interrogation technique. The examiner uses the reading to guide the questioning. I think taking a human out of that loop would be as difficult as a Turing test.

zik• 8 years ago

have they been discredited as in that double-blind trials show no more than a 50/50 chance of being correct?

Yes. The reading of polygraphs is very subjective and it's been found that they reflect only whether the person administering the test thinks the subject is guilty.

leggomylibro• 8 years ago

They're notoriously inaccurate, but I don't think that courts have given up on them yet. And if you think that's bad, just wait until you're given an inaccurate brain scan to tell whether you're lying.

https://www.sciencedirect.com/science/article/pii/S016926070...

The rates of correct detection in guilty and innocent subjects were 86%, which was better than other previously used methods.

Eh, that sounds close enough to 'beyond a reasonable doubt', right?

6nf3• 8 years ago

Individuals can also 'train' for polygraphs, basically learning to spoof the readings. So really you just can't rely on polygraphs for anything at all.

Retra4• 8 years ago

My understanding is that the police use polygraphs simply as a 'primed' question-asking session for people who agree to take them. It is no different from sitting down and asking someone questions, except maybe they will believe you can tell that they are lying, and so might be more honest. The polygraph doesn't have to be evidence because your answers to questions are evidence by themselves. Whether you are hooked up to a polygraph is irrelevant.

TheSpiceIsLife4• 8 years ago

Whether you are hooked up to a polygraph is irrelevant.

I'm going to go with strongly disagree here.

owenmarshall• 8 years ago

In this respect they're not really any different from an officer administering a field sobriety test or a breathalyzer to someone they've stopped for a suspected DUI: these prime the suspect to give more information than legally required.

And worse, these will provide opportunities for the state to build probable cause for a stop that otherwise might not exist.

DannyBee3• 8 years ago

"Tangentially related, it's astounding to me that polygraphs are still considered valid evidence given how widely they've been discredited."

They generally are not considered valid evidence.

DannyBee3• 8 years ago

(to expand, they are not admissible without consent of both parties, and even then, the court would likely find it not relevant)

bootlooped• 8 years ago

I'm not sure how the courts will differentiate between biometric data related to authentication and biometric data from blood tests, breathalyzers or DNA tests. The latter are, in a sense, examples of forcing you to divulge something stored in your body.

rando444• 8 years ago

The only difference I can see is that in the case of alcohol, biometric data is the thing you are looking for.

In the case of telephones, biometric data is being used to get access to something else.

checkyoursudo• 8 years ago

Implied consent (the authority the police use to try to force you to divulge your blood alcohol content) is a well-established area of law.

The courts can differentiate it by saying that the legislature has written implied consent laws that cover what you are deemed to have consented to when operating a motor vehicle, and that the legislature has not written implied consent laws for cell phones/etc.

Right now it's a pretty easy case for the courts, though higher courts have justified much worse with much less.

It's possible a legislature could write implied consent laws for cell phones, but I don't think they have yet. Not sure if they'd withstand court review, but I am afraid they might.

tialaramex• 8 years ago

The UK fixed this for drink driving by making it an offence to refuse to submit to the alcohol tests. So they don't force you to implicate yourself for drink driving, you can choose instead to be prosecuted for refusing to provide a sample and have everybody assume (not at all unreasonably) that you refused because you knew you'd fail badly.

Sometimes people are _so_ drunk they refuse to provide a sample without really comprehending that this will itself directly lead to getting arrested and prosecuted but minus any opportunity to get the results thrown out for any reason since it'll just come down to "Officer, did the suspect refuse consent to the required sample?".

You couldn't do that exact workaround in the US because of the Constitution, but I'm sure a creative work around can be invented.

mcv4• 8 years ago

The article is quite clear about that differentiation:

"the judge wrote that fingerprints and face scans were not the same as “physical evidence” when considered in a context where those body features would be used to unlock a phone."

(Emphasis mine.)

It's the context of using those body features to unlock a phone, that makes them testimonial rather than physical evidence. Outside that context, they can still be physical evidence.

But does that mean the police can't use physical evidence to unlock your phone? I don't know if it's possible to get a fingerprint from a glass and use that to unlock a phone, but if it was, would that still be legal? What about if someone wrote their password on a note?

burtonator2• 8 years ago

considered valid evidence

They're considered a valid tool for coercion.

Stupid criminals who watch too much TV think they work and some cop comes in and says he failed a lie detector test and they confess.

In that way they actually do work.

Assuming all you want is a confession but if the person actually provides evidence of their own guilt they so be it.

amelius• 8 years ago

So it's analogous to a passcode because you're divulging something stored by your body, as opposed to e.g. a metal key which is artificial.

Also, shouldn't the act of entering someone's phone be analogous to entering someone's house? I.e., wouldn't a search warrant/court order be required?

mcv4• 8 years ago

The article is about the warrant. The warrant was for forcing unspecified non-suspects to be forced to unlock their phones so they could be searched for evidence. The judge judges to be "overbroad".

porpoisely• 8 years ago

But can they seize your phone and crack it and look through your stuff without your permission or getting a warrant/judicial oversight?

Otherwise, the only thing this does is add one extra step ( and additional cost which doesn't matter since taxpayers are footing the bill ) for the Feds to break into your phone.

krastanov• 8 years ago

Law enforcement is permitted to do that only if they have a warrant. The question is whether they can compel you to give up a password (mostly no) or compel you to give up biometric key (unknown, but this court says no).

And it is not just an extra step. Cracking an encryption is infeasible or extremely expensive when properly encrypted.

vorpalhex• 8 years ago

Cracking an encryption is infeasible or extremely expensive when properly encrypted

This depends highly on your threat model. What your local sheriff's office can do, versus the FBI, versus the NSA. Mall security Rent-A-Cops can peek through an unlocked phone, but probably aren't going to be doing any kind of cracking other than the obvious possibilities.

spaceheeder• 8 years ago

They do need a warrant now, although they did not used to, and obviously don't need one if you hand an unlocked phone over upon request (same as if you go along with 'let me see your backpack').

It's unlikely this ruling will be upheld since providing biometrics to unlock a phone is difficult to construe as 'testimony' since it's performing an action, like complying with a court order to unlock your front door in response to a warrant should you not desire for the police to kick said door in.

The biggest gray area currently is whether typing in a password is 'something you do' or 'something you know', and you can find different precedent to support both conclusions in US jurisprudence for the time being. Hopefully SCOTUS will come down on the side of 'something you know' if/when such a case ever makes it before them.

perpetualpatzer• 8 years ago

It's unlikely this ruling will be upheld since providing biometrics to unlock a phone is difficult to construe as 'testimony'

Agreed, feels like this rises and falls with the forced blood draws issue that was decided in the 60s [0]. Maybe if you claim the phone isn't yours, unlocking it with your face or password would be testimonial? Not sure if that defense would survive them calling the number that was registered to you.

[0] https://en.wikipedia.org/wiki/Schmerber_v._California

rocqua5• 8 years ago

The biggest gray area currently is whether typing in a password is 'something you do' or 'something you know'

It seems pretty clear to me that a password is 'something you know', whilst a fingerprint is 'something you are'. Moreover, typing in a password is very clearly a communicative act, whilst placing a finger on a scanner is a lot more murky. It might communicate intent, but it can't communicate ideas.

Maybe things change if you need to know which fingers work.

laurentl• 8 years ago

Any idea if and how this ruling (if upheld) can be used to refuse phone seizures / password requests by CBP when entering the country? The ruling relies on the 5th amendment so its scope is limited to American citizens I guess. And whatever the rule of law it’s probably not a good idea to piss off a CBP agent... but still, it’d be nice to be able to travel to the US without having to wipe one’s phone and social media accounts.

briandear• 8 years ago

There is a Border Search Exception to the 4th Amendment established by the courts; this ruling has no relevance at at port of entry.

dreamcompiler• 8 years ago

It has no relevance to the Border Patrol within 100 miles of a US border or coastline, which is even more ridiculous.

justadudeama2• 8 years ago

I highly doubt it, even for American citizens at the border. The "Border search exception" pretty much says that anywhere within 100 miles of a boarder, the fourth amendment doesn't apply[1]. I imagine they would make a similar rule for the fifth amendment.

[1] https://en.wikipedia.org/wiki/Border_search_exception

mikeash2• 8 years ago

Citizens can’t be denied entry. Worst case if you refuse to turn over your phone password is a short (hours, maybe days) detention, and confiscation of your phone.

Non-citizen admittance is at the discretion of the immigration officer and they can turn you away for just about any reason.

Either way, yes, this ruling wouldn’t change anything there.

mcv4• 8 years ago

Wait, within 100 miles of a border the 4th amendment doesn't apply? There are entire cities, large ones, within 100 miles of a border. Does the 4th amendment not apply to the citizens of those cities? That would be a rather serious problem.

scarface742• 8 years ago

This nice and all in theory but looking through the lens of reality where police are legally allowed to lie to get a confession - claiming they have evidence that they don’t have to coerce a confession and seeing that “rubber hose decryption” is real, it really doesn’t mean much in practice.

Edit:

Since people don’t seem to believe that police are actually legally allowed to lie during an interrogation:

https://www.njmoorelaw.com/10-ways-police-can-lie-to-you

oskkejdjdkjd4• 8 years ago

Police are absolutely allowed to lie during an interrogation. I’ve seen it done multiple times. The most disturbing interrogation I’ve ever seen was actually the one where a teenager murdered his own father while under the influence of magic mushrooms. He was taken into the interrogation room shortly after the murder but enough time had elapsed that he was sober and just starting to understand the gravity of what he had done. The police sent in a soft-voiced female who spoke in a very caring and patient way. 99/100 people who watch that interrogation video would say that the woman was a therapist or councilor of some kind. Everything she asked and stated appeared to concern the wellbeing of this kid and the resolution of the terrible even that had taken place. In reality, everything she did was a cunning ploy with some kind of hidden goal. The entire interaction was calculated to extract information from him, very specific information, to be used against him in court. Every tangent of questioning she went on, seemingly random to the untrained eye, was highly specific in its value in a legal context.

An interrogation like this is not an example of outright lying, which is legal and commonly practiced, but it is much more sinister. It is an example of an interrogator assuming another identity and drawing the suspect into a false sense of warmth and security in order to make the suspect incriminate himself. To me, it is the same as having a conversation with your mother after a traumatic event, only to see her rip her own face off, a mask, to reveal the grotesque face of a police interrogator, and then going to jail for what you disclosed. Absolutely terrifying and dystopian. You absolutely must be proactive and protect yourself in this world. Even in “free” countries like the USA. https://youtu.be/rBpDHJIwcUk?t=1495

TLDR: the police are allowed to lie to you https://youtu.be/_WnhP91NJeU?t=1600

baroffoos2• 8 years ago

Did you expect the guy to get off free for murder?

brokenmachine4• 8 years ago

I have seen that interrogation video and I have no problem with her asking questions in a caring and patient way. In fact I would prefer all interrogations were like that one.

There are many, many, much worse examples.

The first one that comes to mind to me is when they interviewed that simple guy on the Netflix show, Making a Murderer. They basically told him everything would be ok if he just admitted to murdering someone, and prompted every detail by just badgering him. He had no idea how serious the charges were that he was admitting to, and clearly had no idea of the details of the murder until they prompted him. I'm sure he should have had a lawyer or guardian helping him, as you would with a child.

He's still in jail AFAIK.

gammateam5• 8 years ago

When people downvote you on this website, it doesnt mean they dont believe you

They just dont like what you say

mcv4• 8 years ago

It means they don't think you're adding anything of value to the discussion.

newnewpdro2• 8 years ago

So they just need to reproduce your likeness to unlock your poorly-secured device? Sounds significant, when you're already in custody. /s

mikeash2• 8 years ago

And do so within 48 hours, and with enough fidelity not to trigger a lockout with failed attempts.

newnewpdro2• 8 years ago

Sounds like a process that will be quickly automated and sold to law enforcement for a pretty penny.

Immediately take retinal scan and face scan, fingerprint, and photograph. A minute later a 3d-printed head and finger emerges back in the basement of the station.

nerflad• 8 years ago

This might be a good time to let others know: Android (at least my OnePlus) has a "Lockdown" mode in the shutdown menu that locks the screen and prevents the usage of the biometric methods. You have to use the password. This is good because passwords have already been hashed out in court and are unequivocally protected by the fifth amendment; you don't have to tell an officer your password (and entering it for them constitutes telling them).

miles2• 8 years ago

In iOS 11 and higher, you can disable Touch ID by pressing the power button 5 times in quick succession:

https://www.macrumors.com/2017/08/17/ios-11-emergency-sos-di...

In iOS 11, Apple has added an "Emergency SOS" feature that's designed to give users a quick and easy way to summon emergency services should the need arise. As it turns out, there's a secondary benefit to Emergency SOS - it's also a way to quickly and discreetly disable Touch ID. ... This is a handy hidden feature because it allows Touch ID to be disabled discreetly in situations where someone might be able to force a phone to be unlocked with a fingerprint, such as a robbery or an arrest. With Touch ID disabled in this way, there is no way to physically unlock an iPhone with a finger without the device's passcode.

gph1234• 8 years ago

"Pressing power button 5 times in quick succession" doesn't work on my iPhone 8 Plus running iOS 12. To achieve the same effect, I need to hold the power button and one of the volume buttons for a couple of seconds.

darkpuma7• 8 years ago

"summon emergency services should the need arise"

What does that mean? It calls 911 or the local equivalent? That doesn't seem like desired behavior if you're triggering it in anticipation of crossing a border.

jedberg• 8 years ago

iPhone too. Press the power button five times and it goes into password only mode.

coralreef• 8 years ago

Holding the power + volume button also forces a lock, and is more discreet in that it doesn't make blaring beeps and call emergency.

dylan6044• 8 years ago

it depends on what phone you have. the key press combo is different depending on what model you have. the 6s+ is 5 presses of the power key, but that is a very conspicuous thing to do. other/newer models have a much more inconspicuous button press combo that could be done while "attempting" to hand over the device.

chrisper• 8 years ago

It's also in EMUI 9 (Huawei) now.

chucksmash• 8 years ago

Don't know how vanilla this is, but on a Moto g^6 I have configured biometric auth but have to auth via PIN 1) every time I boot the phone and 2) every 24 hours.

Waiting for a case where the FBI bangs down Google's door to get access to a locked Android phone before I make any assumptions about the security implications of that though.

dragonwriter• 8 years ago

Lockdown mode is a new feature in Android Pie: https://www.androidauthority.com/android-pie-lockdown-securi...

eloisant• 8 years ago

Also, and I think it works on all Android, if you press the fingerprint sensor with the wrong finger 5 times it deactivates it. So just hit it with your pinky or any other non-registered finger.

renholder3• 8 years ago

This is assuming you have the time to do so. In the shock and awe practices of law enforcement in the states, no-knock-warrants by SWAT teams at 3am in the morning aren't an unheard of thing. Do you honestly think, in that precise moment, you'll remember to run and grab your phone and implement the lockdown mode before they breach into the premises?

I'd say it's better security practice to only use a passcode and, if you must use any biometrics, use an obscure finger (like the side of your pinky finger or something) - whilst also enabling the the auto-wipe feature after 10 failed login attempts.

IANAL but from what I understand of the current goings on in the states, the police have to tell you which digit to try. Just as a password is protected, knowledge of which digit and how it should be placed is also - technically - protected. Think of it like two-factor authentication: The fingerprint is what you are, which was can be used to unlock the phone, but divulging the "which finger and how it should be placed" is what you know.

I can't seem to find it but people were "hacking" the biometrics of Androids with 3D printed heads. The trade-off of convenience for security isn't really worth it.

Again, IANAL, and IMHO, and - if you care about privacy - you shouldn't use biometrics whatsoever but I understand the trade-offs between convenience and security and why so many people fall into that trap.

mirimir2• 8 years ago

As others have noted, this decision comes from a low-level court. And from what I've seen recently, it won't stand.

Indeed, the basis of the opinion is iffy:

“If a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device,” the judge wrote.

Because defendants' right under the 5th to withhold passcodes is not at all settled. And even if they can't be compelled, they can be jailed indefinitely for contempt of court. Even if, as that ex cop in Philadelphia claims, they've forgotten it.

So anyway, this is iffy advice:

The best advice for anyone concerned about government overreach into their smartphones: Stick to a strong alphanumeric passcode that you won’t be compelled to disclose.

brianpgordon3• 8 years ago

I didn't read the opinion but even the quotes that Forbes pulled are eyebrow-raising. Like:

“The undersigned finds that a biometric feature is analogous to the 20 nonverbal, physiological responses elicited during a polygraph test, which are used to determine guilt or innocence, and are considered testimonial.”

This is the kind of wacky magistrate judge ruling that I'm sure the US Attorney rolls their eyes at.

Zak• 8 years ago

Stick to a strong alphanumeric passcode that you won’t be compelled to disclose.

I can imagine this having value against criminals as well. The number of people willing to beat a password out of a victim is smaller than the number of people willing to hold a victim up against the wall for a second to press their finger to a reader.

mamon• 8 years ago

Except criminals that could beat you up on a street are not interested in your data, they just want to sell the hardware and have money for drugs. It's easier for them to just type wrong passcode 10 times and have the phone wipe its whole content.

basil-rash2• 8 years ago

Does the wipe put it back into factory default mode? It was my understanding that it would put it into a "locked to X user" mode, requiring an iCloud password to reactivate.

throw2016• 8 years ago

There is something extremely disturbing about the state wanting to go through your private papers.

The only way this should be possible in a democracy is rarely and only by due process with a judge's order and ample safeguards, explicit conditions built into the law with no room for abuse by 'friendly judges' or 'overzealous' state machinery.

Anything else is a police state in the making. This is fundamental to the definition of a democracy and you can't dilute this without diluting the meaning of democracy at which point you should use some other word to describe your system.

brokenmachine4• 8 years ago

This is 100% true.

I really wish the lobotomized "I have nothing to hide" sheep would understand this.

For every one of these laws, you need to think about what a world in which searches like this happened routinely to everyone - even the "good guys™" - would be like.

supernova87a2• 8 years ago

I doubt this will hold up.

You can be compelled by a court to have your blood withdrawn if a warrant is issued while you're under suspicion of DUI. Why would it not be similarly allowable to have your finger placed on the unlock button?

Testimonial privilege (against being forced to testify) is about not being made to say / speak statements against your own prosecution. Speech. Testimony.

Having evidence taken is not forcing you to speak, testify, or make a statement, at least in the current interpretation of evidence.

This ruling is not for sure at all.

gammateam5• 8 years ago

“A California [federal] judge” yeah I stopped reading there

Even the 9th circuit appeals court upholding this ruling wouldnt be something to trust

This part of the country simply doesnt have consensus with the rest and doesnt have power over the constitution, whether I like the ruling or not.

pc869• 8 years ago

Until a higher court overturns it this is the law of the land in that jurisdiction. Whether they agree with a court 2,000 miles away is completely irrelevant.

Also you should occasionally read things that you disagree with, if only to test your own assumptions and prejudices about yourself and the world around you. It makes you an objectively better person.

arcturus17• 8 years ago

In the eyes of the law, how is this different to being compelled to give your passcode though? Of course it’s easier and they could maybe even unlock a phone with your corpse but in jurisdictions where the law protects the individual’s privacy above all else this shouldn’t make a difference.

rocqua5• 8 years ago

Its 'something you know' vs 'something you are'.

In some sense, the issue here is that we use fingerprints as authorization whilst they should be authentication.

supernova87a2• 8 years ago

It is fundamentally, very importantly, different.

Being compelled to say / give your password is forcing you to admit or testify that you know the code and can unlock your phone. You can choose not to give testimony (statements) that could be used against you.

On the other hand, if you are in possession of a physical key or code written on a piece of paper... or fingerprint... you can be compelled to turn that piece of evidence over to the government.

IkmoIkmo• 8 years ago

As I understand it, we are not required to incriminate ourselves. e.g. we can not be told or forced to confess, similarly we cannot be told to open a lock. In fact, there is no way to determine wether you indeed do know (or remember), or do not know/remember the passcode prior to forcing you to hand it over. Any punishment for not cooperating may be a punishment for not remembering, or worse, not even ever knowing the passcode.

But we can be be 'used' to build evidence. For example, being detained and forced to stand in a line-up so that a witness may recognise you. Or having your speech recorded, so it may be compared to a criminal telephone recording. Or having your fingerprint taken to be compare to fingerprints found at a crimescene. Having your key be taken to unlock a vault which is suspected to contain stolen items. Or indeed, having your finger or face scanned to unlock the same thing.

These seem like fundamentally different things, one which may lead to improper judgements, another which leads to generally reasonable judgements.

pc869• 8 years ago

Testimonial privilege (against being forced to testify) is about not being made to say / speak statements against your own prosecution. Speech. Testimony.

As the article states, polygraph results are (were) legally considered testimony. That's the results, not what you actually said. So "testimony === speech" is incorrect at both the practical and the legal level. This court is simply saying that your fingerprint is much closer to testimony than it is to objective chemical proof of a crime, as in your blood draw DUI/DWI example.

m-p-3• 8 years ago

And also, the problem with biometrics is that they're not passwords, they're usernames.

It's by no mean secret, although somewhat unique to the individual.

tptacek• 8 years ago

My bet is that this doesn't stand, because (from the haphazard reading I've done) it doesn't comport with the reasoning used to allow people to refuse passwords, which is that the act of disclosing a password is a form of self-testimony --- not that rifling through a phone is intrinsically self-testimony. If I understand correctly (and there are lawyers on HN who can shoot this down) people have tried and failed to make this same claim about breathalyzer and blood tests and failed.

Just having an opinion about the case isn't all that interesting, and other people have said roughly the same thing on this thread, so what I'd like to contribute is the offer to go in on a long bet against the precedential value of this particular case. If it's eventually overturned, $100 to the charity of my choice; if it's exhausted procedurally and allowed to stand, $100 to yours. Any takers?

tedunangst• 8 years ago

But this ruling has to do with a sort of bulk unlock. Isn't there case law that the police can't go around collecting blood from a whole group looking for a match?

abalone• 8 years ago

Tip 1, which most people know: To quickly disable Face/TouchID you can squeeze left and right side buttons together (any combo) for two seconds to bring up the power off display.

Tip 2, which probably most people don't know: If you aren't holding the phone -- if someone shoves it in your face -- you can close your eyes to prevent FaceID from working and say "Hey Siri, who's phone is this?"

Not that it's wise to do this to frustrate a violent attacker, but it might work for some situations.

renholder3• 8 years ago

...you can close your eyes to prevent FaceID from working and say "Hey Siri, who's phone is this?"

That's specific to Apple and I wouldn't be surprised if that got you an obstruction charge in the states. Plus, if you don't produce the password, afterwards, you're now sitting in jail for contempt - even if you may have actually forgotten it.

It's a much safer avenue, legally, to just use a password to unlock the device.

devilindetails• 8 years ago

so, I get arrested and fall asleep and then the fingerprint reader works, so is the face rockon, unlocking my phone... do not trust human mediocracy of law enforcement or otherwise,

tjpnz• 8 years ago

As someone not from the US how could you be compelled to unlock your device using biometrics? Does this actually involve violence?

wnevets• 8 years ago

INAL but I believe its usually contempt of court, you'll be locked up til you comply.

nubbins• 8 years ago

Aren’t all laws ultimately backed by threat of force whether to take your property or imprison you (not sure I’d call this violence)? You can be held in contempt if you ignore a court order but I doubt they would like smash your thumb down on the screen.

adriancristi• 8 years ago

As if a court order ever stopped a highly motivated group of people from using technology however they wanted, with or without either your consent or the consent of the company providing the technology platform ...

anigbrowl2• 8 years ago

Actually court orders do that all the time. Sure, it can't stop physical force being used but it can invalidate the results for legal purposes.

__derek__• 8 years ago

U.S. District Court for the Northern District of California

Ah, OK, so this is as meaningful as the judge who decided that the ACA was unconstitutional.

torstenvl2• 8 years ago

This is a magistrate's response to a warrant application. It doesn't have minimal jurisprudential value, it has zero jurisprudential value.

The headline is wrong to even use the word "judge" - at the federal level, there is a meaningful distinction between a judge and a magistrate.

crazyc51• 8 years ago

As a Root Android user, any time I have reason to believe that a situation with the police is going to end even slightly bad on my end, I power off my phone. And as a Root user I have several layers of security on all my devices. I also take a mental note of what my battery percentage is at, that way I know if my phone has been turned on at all.

As for a little back story on myself; I am wrongly labeled as a drug felon. My wife (separated for over a year) decided to try meth shortly after our wedding and got hooked in a bad way. I have a history with said drug and didn't want her to try but she insisted saying that it would help her understand why I am the way I am. I didn't know about her use of the drug and was in jail for 2 weeks because she had them in the car and I got pulled over and searched. After my release the cops in the area basically harassed me by pulling me over every other day at minimum. I was in and out of jail several times within 2 months. I had come into possession of the phone she had when I was in jail because she got a new one and I always saved the old phones to test my rooting and hacking skills with. Even though the phone was wiped, by her deleting all of her account info and messages, I was able to do a text recovery on the phone. I found in a few chats that she had with some of her friends and family while I was in jail for the 2 weeks, her telling them that I was in jail for her drugs. Of course everyone thinks that it's weed first, but we were in Colorado, so she clarified that it was for meth.

Now because of specific laws I can't even use those messages to clear my name and she won't take the stand to the law and accept her punishment for the use of the drugs.

_Codemonkeyism• 8 years ago

I guess they will just put your phone to your face and claim it was unlocked.

pseingatl• 8 years ago

It'll be just a short time before this is overturned. Fingerprints are non-testimonial. So is a photograph of your face. So is a sample of your handwriting. You can be forced to give a handwriting sample. As to polygraphs, at the federal criminal level, they have been approved in only one federal circuit, and then only under limited circumstances. See, U.S. v. Picinonna. Despite this federal non-acceptance, they are widely used at the federal administrative level for security clearances and the like. In the private sector, there are little restrictions on their use. You could also use divining rods, tarot cards, crystal balls and similar implements to discover the truth of a statement if you wanted to. However you can't weight a person down and throw him in the lake to see if he floats.

rocqua5• 8 years ago

If you fall asleep, can the police just hold your finger to your phone?

It seems very clear to me that this is not a testimonial act. Nor is their 'coercion' here in the communicative sense. I'm guessing there are other laws that prevent police from handling your body to retrieve evidence, or at the very least, laws that require a warrant for such actions.

ChicagoBoy11• 8 years ago

The FAA would require that drones have “an anti-collision light illuminated and visible for at least three statute miles,” as well as testing and training.

I'm a private pilot, and I have the hardest time spotting airplane traffic from 3sm miles away. Ready to sit back and have some popcorn reading articles about how manufacturers are supposedly complying with this rule. Unless there's some novel lighting technology I don't know about, this seems like a nontrivial problem to me.

swarnie_• 8 years ago

Wait.... What?

Did you get lost on your way here? https://news.ycombinator.com/item?id=18907490

Feds Can't Force You to Unlock Your iPhone with Finger or Face, Judge Rules

Related Stories