Feds Finally Get Around To Using Someone's Face To Unlock Their Cellphone
from the FaceTime:-FBI-Edition dept
The only surprise about this is that it took this long to happen.
A child abuse investigation unearthed by Forbes includes the first known case in which law enforcement used Apple Face ID facial recognition technology to open a suspect's iPhone. That's by any police agency anywhere in the world, not just in America.
It happened on August 10, when the FBI searched the house of 28-year-old Grant Michalski, a Columbus, Ohio, resident who would later that month be charged with receiving and possessing child pornography. With a search warrant in hand, a federal investigator told Michalski to put his face in front of the phone, which he duly did. That allowed the agent to pick through the suspect's online chats, photos and whatever else he deemed worthy of investigation.
This won't become a Fifth Amendment test case for several reasons.
First, Michalski apparently consented to the search by using his face to unlock the phone. If this was as voluntary as it appears, it pretty much eliminates a Constitutional challenge.
Beyond that, it's unlikely a court would find someone's face testimonial. For the most part, courts haven't found fingerprints to be testimonial, even if the application of a fingerprint leads directly to the production of evidence to be used against the phone's owner.
The "foregone conclusion" argument would only require law enforcement prove the phone belongs to the person they're asking to unlock it -- information easily acquired with a subpoena from the service provider.
Even if all these hurdles could be jumped, actions taken by the investigating agent pretty much eliminated any evidence the defendant might have challenged, as Forbes' Thomas Brewster reports.
Whilst Knight may've found some evidence of criminal activity when he manually searched the device, in one respect the forced Face ID unlock of the iPhone X was a failure. It wasn't possible to siphon off all the data within using forensic technologies. That was because the passcode was unknown.
In modern iPhones, to hook the cellphone up to a computer and transfer files or data between the two, the passcode is required if the device has been locked for an hour or more. And forensic technologies, which can draw out far more information at speed than can be done manually, need the iPhone to connect to a computer.
It appears Knight didn't keep the device open long enough and so couldn't start pulling out data with forensic kits. He admitted he wasn't able to get all the information he wanted, including app use and deleted files. What Knight did get he documented by taking pictures.
Michalski's lawyer confirms in a comment to Forbes there's been no evidence produced from the unlocked iPhone, leaving him nothing to challenge in court.
Even if this case is a wash in terms of Constitutional challenges, that doesn't mean the status quo will remain unchanged as more phone manufacturers move towards biometric-based security features. Courts may recognize -- as they have with smartphones and cell location data -- that old assumptions about privacy and presumed government access are no longer valid in a world almost wholly reliant on portable devices filled to the brim with personal data and documents.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: encryption, face, faceid, iphones, unlocking phones
Companies: apple
Reader Comments
Subscribe: RSS
View by: Time | Thread
Ummm, Ya?
USE something that cant be duplicated, EASILY..
Use your hand over your face to create a different pattern..
IF the program is GOOD, and works properly...It will KNOW what you did..
[ link to this | view in chronology ]
Re: Ummm, Ya?
[ link to this | view in chronology ]
Re: Ummm, Ya?
[ link to this | view in chronology ]
[ link to this | view in chronology ]
I have a stupid question...
[ link to this | view in chronology ]
Re: I have a stupid question...
If you want protection from decryption orders by a judge you must introduce a system before hand that automatically destroys data as part of its regular every days cycle.
For example, require that a USB key you posses be presented to an encrypted system at least once per day or it changes encryption keys regardless of if it is attached or not. Justice works slowly you will be in jail and if your system AND encryption device changes keys apart from each other then you are safe.
Like a dead mans switch. As long as this process is enshrined in your daily routine then you are free of criminal charges of evidence tampering unless such evidence already meets laws the require you to keep it for x amount of time. It is not your fault if the police throw you in jail preventing you from performing the daily requirement of key encryption recovery.
Not only that but you should most certainly keep a shadow partition filled with even more critical data so that nothing looks amiss under forensic scrutiny. There are many ways to keep your data secure. Fake profiles is one simplified example of this.
[ link to this | view in chronology ]
Re: Re: I have a stupid question...
Any confession is testimonial.
[ link to this | view in chronology ]
Re: Re: Re: I have a stupid question...
multiple passwords..1 open the phone, the other simple ones, Erase data..corrupt the phone..
Or open different sections of the phone, safe, and Private sections..
dongles are nice, but dongles get lost. OR left in the device.
What would be Neat, is a skin tag, that has a mag signature to open the phone..and only YOU know on what part of the body to use it.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Protection
If at all possible, I'd do this before (or while) having to hand the phone over, and I'd definitely do it before hitting a TSA or Homeland security checkpoint.
It's gotten to the point where some people recommend traveling with a burner phone that has a minimum amount of personal information contained within it.
[ link to this | view in chronology ]
Re: Protection
I get where Apple was going with how Face-ID works. The camera catches your eyes, recognizes your face and unlocks the phone in next to no time, that's pretty handy. Just the execution wasn't well thought out.
The 'Fix' should be to add a voice command prompt to complete the unlock. Nothing extraordinary, just the basics: Open/Unlock; Shutdown/Restart; SOS; LOCK. If I were Apple I'd probably throw in voice print recognition to the owner just for an extra layer of security.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
I've got a pair of "Clark Kent" glasses…
effectively disarmed Big Brother yet again; particularly
because I carry dissimilar reading glasses by necessity. ; ]
[ link to this | view in chronology ]
Submission versus consent
Was it truly consent? Or just submission to authority?
When held at gunpoint by a mugger and one voluntarily gives over one's money, that does not imply consent.
[ link to this | view in chronology ]
Re: Submission versus consent
Nonsense, what possible coercive element could there be in an FBI investigator showing up at your house and telling you to do something?
[ link to this | view in chronology ]
How is this still a thing?
A physical feature like a face, eye or fingerprint should only ever be used as a form of user name, never as a password. At most presenting a face to the camera should identify which account on it the person is requesting access to, it should not unlock the account/device itself.
[ link to this | view in chronology ]
Re: How is this still a thing?
[ link to this | view in chronology ]
#changepassword
[ link to this | view in chronology ]
Re: #changepassword
[ link to this | view in chronology ]