Another Federal Court Says Compelled Production Of Fingerprints To Unlock A Phone Doesn't Violate The Constitution

from the must-be-going-so-dark-fingerprint-readers-won't-even-work dept

Where the Fifth Amendment ends for device owners largely seems to be determined by their favored security measure. If it's a password keeping a device encrypted, courts seem more willing to call compelled production a Fifth Amendment violation. If it's a biometric feature -- most commonly fingerprints or faces -- the courts are more likely to consider body parts non-testimonial.

There's not enough of a consensus either way to make it a clear choice, but courts seem to feel faces/fingerprints are like "keys" and passwords like "combinations" when it comes to the metaphorical lockbox that is your phone.

Adding to the case law that is "fingerprints are lockbox keys" is this decision [PDF] from a federal court in Illinois. (via FourthAmendment.com) The court says the Supreme Court says this is how it must be, even if the Supreme Court has yet to field a device encryption case.

The government wants to look in the defendant's phone for evidence of his threats against a confidential informant. There's a built-in limit to this, although it's not one of the government's making. Investigators want to apply the suspect's fingers and thumbs to the seized iPhone to unlock it. The suspect's mind is being taken out of the equation (as it were), which could result in the government getting what it wants in this request without actually getting what it wants from the man's iPhone.

In connection with the government’s motion to revoke Barrera’s bond conditions, District Judge Robert W. Gettlemen ordered that Barrera’s iPhone be turned over to Pretrial Services. The government seeks to search this iPhone, with a home button, that was taken from Barrera in order to develop evidence of his alleged threats. The iPhone has a fingerprint lock function (known as Touch ID), and the government asked this Court for a warrant to compel the defendant to place his fingers and thumbs on the iPhone home button in an attempt to unlock the phone. The government alleged in the affidavit in support of its request for a search warrant that it will select the fingers and thumbs to press on to the home button, and that the iPhone fingerprint unlock function will disable after five incorrect attempts. At that time, the iPhone function will demand a passcode to unlock the phone.

The court says any Fourth Amendment concerns are addressed by the government's warrant, which puts it on the right side of the Riley decision. With that settled, the court addressed the Fifth Amendment issues. (Emphasis in the original.)

Applying those three requirements in reverse order here, a biometric scan is certainly compelled—the government is explicitly requesting the Court’s authority to force the scan. The act may also be incriminating, as unlocking the phone may lead to the discovery of a nearly unlimited amount of potential evidence including text messages, social media posts, call logs, emails, digital calendars, photographs and videos, and location data. [...]

But if a compelled act is not testimonial, and therefore not protected by the Fifth Amendment, it cannot become protected simply because it will lead to incriminating evidence. As a result, the relevant Fifth Amendment inquiry here is whether the compelled act of scanning a subject’s fingerprint to unlock a device is a testimonial act.

The court decides it isn't a Fifth Amendment violation because the government will be choosing the five digits it will apply to the iPhone button, rather than the suspect. To complete the metaphor, the government has ten keys to choose from, but only has five attempts to pick the right key. Since the government is doing all the choosing, the suspect isn't doing anything testimonial since he isn't being asked to tell the government which of his fingers will unlock the phone.

First, the Court holds that the biometric unlock procedure is more akin to a key than a passcode combination. The Supreme Court in Doe, and later in Hubbell, has illustrated the difference between testimonial and non-testimonial physical acts via this helpful comparison, which aptly applies to an iPhone that has two different unlock features – a fingerprint and a passcode. In Doe, the Court noted that the Fifth Amendment permits the government to force an individual to surrender a key to a strongbox containing incriminating documents, but not to reveal the combination to a subject’s wall safe. Thus, using the Doe framework, this Court examines whether a biometric scan of an individual’s finger or thumb is more like a key or a combination.

A combination passcode requires a verbal statement from the possessor of the code. More importantly, compelling someone to reveal a passcode also requires an individual to communicate something against her will that resides in her mind. A key, however, is a physical object just like a finger — it requires no revelation of mental thoughts. Nor does a finger require a communication of any information held by that person, unlike a passcode. In fact, the application of a finger to the home button on a iPhone “can be done while the individual sleeps or is unconscious,” and thus does not require any revelation of information stored in a person’s mind.

But even this conclusion is not that simple. The government must show it knows the phone is owned or controlled by the suspect before it can start asking the court to give it permission to apply the person's fingers to the phone. The court doesn't address whether the government has met this evidentiary burden but rather waves it away by citing a 1988 Supreme Court decision (Doe) dealing with the production of financial records.

[T]he Court holds that the implicit inference from the biometric unlock procedure, that the individual forced to unlock had some point accessed the phone to program his or her fingerprint, is not sufficient to convert the act to testimonial. The Supreme Court considered this similar concept in Doe, when it found that requiring a petitioner to execute a consent directive that would result in the production of bank records would not have testimonial significance.

[...]

Similarly, the implicit inference that one might draw from the biometric unlock procedure — that the cell phone was at some point accessed in order to program the biometric lock feature — is no different in significance than any of the above inferences. It is of the same scale that existed in Doe, Gilbert and the other cases discussed above. The implicit inference is also not necessarily as firm as on first impression – the Touch ID feature on an iPhone permits up to five fingerprints to be programmed, thus allowing the potential for multiple users to program the feature. As a result, the Court concludes that any implicit inference that can be drawn from a biometric unlock procedure is not of testimonial significance.

This decision further muddies the federal waters, making it more likely the Supreme Court will have to address these Fifth Amendment issues in the near future. But until it's all settled, odds are passwords are better than fingerprints if your main concern is unwanted access by government employees.

Filed Under: 4th amendment, 5th amendment, biometrics, compelled production, fingerprints, passwords

Millions Of Biometric Records Collected By Companies And Governments Left Exposed On The Web

from the one-stop-shopping-for-identity-thieves dept

One of the many problems with collecting biometric data is you need to have someplace safe to store it. Sure, you could lock it away in something disconnected from the net, but then it's not much use to the dozens of private companies and government agencies that want access to the data they've collected. So, back on the web it goes, where it can be prodded for weaknesses by security researchers and malicious hackers alike.

We can only hope the security researchers got there first.

The fingerprints of over 1 million people, as well as facial recognition information, unencrypted usernames and passwords, and personal information of employees, was discovered on a publicly accessible database for a company used by the likes of the UK Metropolitan police, defence contractors and banks.

The data breach was discovered by vpnMentor researchers, who were performing their usual port scans and checking familiar IP blocks for weaknesses. They found a big one at BioStar 2, the third-party platform that provides access to the biometric databases maintained by over 5,700 companies and government agencies. Only minimal precautions were taken to protect BioStar's data from outside threats -- and even that minimal effort was easily thwarted.

The team discovered that huge parts of BioStar 2’s database are unprotected and mostly unencrypted. The company uses an Elasticsearch database, which is ordinarily not designed for URL use. However, we were able to access it via browser and manipulate the URL search criteria into exposing huge amounts of data.

Not only were the researchers able to see all of this sensitive data, they were also able to change it. Thanks to the list of unencrypted administrator usernames and passwords, researchers were able to add themselves to accounts and utilize stored privileges to examine BioStar 2's databases more thoroughly.

vpnMentor contacted BioStar 2 several times but was ignored repeatedly by its personnel. The only entity that was remotely helpful was the company's French branch, which was apparently instrumental in getting the breach closed. Even so, it still took eight days for BioStar to fix the hole in its system after being notified. vpnMentor didn't publish its findings until after this, but no one can say for sure how long this breach was accessible prior to its discovery by vpnMentor.

Names and passwords are certainly being changed in the wake of this discovery. But this breach was full of biometric info linked to other personally identifiable information held by BioStar 2's customers. Fingerprints and other biometric markers can't be changed. These are inextricably tied to whatever other sensitive information was collected by multiple entities -- much of which was stored in unencrypted form.

Suprema and BioStar 2 will probably take security more seriously in the future, but the damage is done. The fact that the marketing team is issuing statements on the breach rather than someone with direct knowledge of the situation isn't exactly reassuring. Neither is the issued statement, which suggests the company would have rather kept the breach buried, rather than be honest and direct with its users.

Suprema’s head of marketing, Andy Ahn, told the Guardian the company had taken an “in-depth evaluation” of the information provided by vpnmentor and would inform customers if there was a threat.

“If there has been any definite threat on our products and/or services, we will take immediate actions and make appropriate announcements to protect our customers’ valuable businesses and assets,” Ahn said.

In other words, customers will only be informed of the breach if they've been targeted by criminals or malicious hackers. The rest of their customers aren't on the "need to know" list. Fortunately for its out-of-the-loop customers, vpnMentor has made the disclosure the company spent eight days not making.

Filed Under: biometric records, fingerprints, privacy, security
Companies: biostar 2

District Court Rolls Back Magistrate's Decision, Says Compelled Fingerprint Product Isn't A Fifth Amendment Issue

from the SHOW-US-YOUR-HANDS! dept

So much for the Fifth Amendment. At least in Idaho, anyway. Back in January, a magistrate judge rejected the government's attempt to force a suspect to unlock a seized phone using his fingerprints. The judge found the government's request to be a violation of two rights -- the Fifth Amendment protection against compelling a defendant to testify against themselves -- and the Fourth Amendment, since the government hadn't shown a connection between the accused and the seized device.

As the magistrate pointed out, the government could not rely on "foregone conclusion" arguments because it had failed to develop any foregone conclusions. The warrant itself said the government was seeking to search the phone for "indicia of ownership" -- something the government should have been able to plausibly allege long before it started asking the court to compel the suspect to unlock the device.

The judge said the government's application lacked a lot of info it needed to pursue this next step.

The applicant avers that, when questioned at the residence at the time the earlier search warrant was executed, the individual told law enforcement his/her phone was in the bathroom. A phone was found in a bathroom, and the application implies that the individual was not in the bathroom when that statement was made. But three other phones were also located during the search. There is no specific information about how many bathrooms were in the residence. There is no information about whether the individual lives alone or whether anyone else lives or was in the residence at the time of the search. To be clear, none of these facts are determinative of the Court’s conclusion in this case. But they do illustrate that any connection between the individual and the phone at issue here is more tenuous than it might be under other circumstances.

Given the government's inability to tie the suspect to the seized phone, it's absolutely astonishing the district court has decided to reverse the magistrate's decision. (h/t Orin Kerr)

The court's reversal comes to exactly the opposite conclusion using exactly the same information the government presented to the magistrate judge. The government's inability to conclusively tie the phone recovered from the bathroom to the suspect is now, somehow, more than enough info to justify the compelled production of fingerprints. From the decision [PDF]:

The Government further represented in its application for the additional warrant that it already knew this particular cellphone belonged to the individual who was subject to the warrant because the individual stated—when questioned at his residence by police officers executing the warrant—that his phone was in the bathroom where he had been just prior to answering the door. The Google Pixel 3 XL cellphone was subsequently found in that bathroom.

A phone found in a bathroom is now the phone in the bathroom, making all those Fourth and Fifth Amendment concerns vanish into the ether.

But what's now in the ether may not matter -- at least for this phone. The precedent will be helpful but it's too late to do much about the seized phone, as the court points out.

The ability to unlock a cellphone with a fingerprint (biometric encryption) expires after 48 hours of not unlocking it. At that point, a passcode of some type must be used. Here, it took the Magistrate Judge a few days to issue the order denying the warrant1 and then took the Government eight days to file its motion for review. Consequently, any decision by the court in this case will have no impact on this case. The Government simply can no longer unlock the cellphone with a fingerprint. The issue is, therefore, moot under County of Los Angeles v. Davis, 440 U.S. 625, 631 (1979).

The government doesn't want the issue mooted. It wants some precedent, or at least a ruling it can use to persuade magistrates to approve potential Constitutional violations. The government argues contrasting rulings from magistrate judges on compelled product requests creates a "split" the district court must resolve.

The court declines to act on any perceived split here, presumably to the government's chagrin.

[T]he Government has not cited to a single written decision—and none exists to the Court’s knowledge—where a magistrate judge, or any judge from this District, has held that biometric data relating to a cellphone can be obtained by a warrant despite either Fourth Amendment or Fifth Amendment concerns. The mere fact that a magistrate judge has signed search warrants that permitted law enforcement to use a person’s biometrics to unlock electronic devices does not mean that the magistrate judge has had the opportunity to carefully and meaningfully decide the issue raised in this case. After all, the very ex parte nature of applications for search warrants does not lend itself to issues being raised as part of the process. It is not clear to this Court that there is a reasoned split of opinion between the magistrate judges in this District. This Court does not rely on the “split of authority” exception to address this issue.

That's the good news. The government does not have a blank check to compel fingerprint production. In this case, however, the court says the government isn't compelling the production of anything testimonial. But this is only due to the method the government says it will deploy.

Where, as here, the Government agents will pick the fingers to be pressed on the Touch ID sensor, there is no need to engage the thought process of the subject at all in effectuating the seizure. The application of the fingerprint to the sensor is simply the seizure of a physical characteristic, and the fingerprint by itself does not communicate anything. It is less intrusive than a forced blood draw. Both can be done while the individual sleeps or is unconscious. Accordingly, the Court determines—in accordance with a majority of Courts that have weighed in on this issue—that the requested warrant would not violate the Fifth Amendment because it does not require the suspect to provide any testimonial evidence.

Even if the government does nothing more than pick a random finger and apply it, it's using the suspect's body in an attempt to determine something it should have known before seeking compelled production. In this case, it's an undetermined number of "fingers," which suggests the government can keep trying until the device is unlocked or it runs out of fingers.

The government is still searching for "indicia of ownership" and is hoping placing the suspect's fingers on the seized phone will provide it with information the suspect knows, but the government doesn't. Whether or not the government can do this under the Fifth Amendment comes down to its "foregone conclusions," but the government doesn't appear to have one of those to work with.

The district court has turned the government's attempt to find out who owns the seized phone into a foregone conclusion by overriding the magistrate's determination on this issue. This won't set precedent in Idaho but it does indicate the district level will give the government the benefit of the doubt in cases like these, which lowers the bar for acceptable violations of Constitutional rights.

Filed Under: 4th amendment, 5th amendment, fingerprints, magistrate judge

Idaho Magistrate Judge Shoots Down Another Government Request For Compelled Fingerprint Production

from the on-the-Fifth,-I've-told-you-twice dept

Another small victory for Constitutional rights comes via the same federal magistrate who previously rejected another law enforcement request to compel production of fingerprints to unlock a phone.

In May, federal magistrate judge Ronald E. Bush said compelled production of fingerprints violates both the Fourth and Fifth Amendment. He declared the fingerprint application itself to be a search, one performed with the assistance of the suspect. There's the Fourth Amendment issue.

And since the government hadn't provided evidence tying the suspect to the phone, producing fingerprints would provide the government with testimonial evidence it didn't have. The government wanted to search the phone for "indica of ownership" -- something it hoped to perform after it had already compelled production of fingerprints. The government had no "foregone conclusion" to work with, so forcing a suspect to give up information only they know (namely, possibly verifying ownership by unlocking the phone) implicated his Fifth Amendment protections against being forced to testify against himself.

In this case, Judge Bush has handed down another denial [PDF]. Once again, the government wants to compel the unlocking of a device but doesn't have everything it needs. What the government does have isn't much. The evidence tying the suspect to child porn possession is mostly ephemeral: IP addresses, email addresses, and online accounts. Using this as probable cause, the government is asking to search electronics seized from a searched residence. (The government also wants to search the suspect's car, presumably in case any electronics are stashed there.)

As the court points out, the government wants to do things to a phone it hasn't shown will actually need to have this stuff done to it. It's working off an assumption and that assumption isn't enough for the judge to agree to the government's proposed rights violations.

The affidavit describes a feature of the smartphone which, according to the investigator, offers users “the ability to unlock the device via the use of a fingerprint or thumbprint.” It also describes that, in the investigator’s “training and experience, cellular telephone users often enable” such a touch identification security feature “because it is considered to be a more convenient way to unlock the device than by entering a numeric or alphanumeric passcode or password, as well as a more secure way to protect the device’s contents. This is particularly true when the user(s) of the device are engaged in criminal activities and thus have a heightened concern about securing the contents of the device.”

The affiant also states that “[t]he passcode or password that would unlock the cellular telephone device found during the search of [the individual, the vehicle, or the residence] is not known to law enforcement. Thus, it will likely be necessary for law enforcement to press [the individual’s] fingers and thumbs to the [smartphone] found during the search . . . in an attempt to unlock the device for the purpose of executing the search authorized by this warrant.” However, the affidavit does not describe a particular reason to believe that the subject cellphone has enabled a touch identification feature or would have such feature enabled if the device were seized during execution of a search warrant.

The attached footnote provides further reasons why the magistrate is rejecting this application for application of fingerprints.

Regardless of the constitutional issues, the application may also be premature and not ripe for decision. The applicant presupposes that a search will uncover and result in seizure of a specific smartphone at the time of the search but does not identify the device beyond a make and model and does not account for the possibility that a search might uncover additional or different devices.

The court reminds the government that it can no longer take phone searches as lightly as it once did. The Supreme Court's Riley decision made it clear phones are not pants pockets or suitcases or file cabinets. In many cases, they can provide access to a large portion of a person's life. When the government wants access to this wealth of information, it needs to deal with sureties and particulars, not assumptions devices will hold evidence and suspects will provide the keys for entrance. Here, the government does not have enough to demand the production of these keys.

Further, the government cannot demand someone testify against himself. While other courts are still wrestling with this question, Judge Bush's stance on this issue is crystal clear:

[S]ome actions are not within the Fifth Amendment privilege. Furnishing a blood sample, for instance, or providing a handwriting or voice exemplar, standing in a lineup, or submitting to fingerprinting for identification purposes are not testimonial communications because such actions do not require the suspect “to disclose any knowledge he might have” or to “speak his guilt.” Doe, 487 U.S. at 210–211 (citations omitted). The relevant distinction is the “extortion of information from the accused, . . . the attempt to force him to disclose the contents of his own mind.” Id. at 211 (citations omitted).

There is exactly that “extortion” of information here, however. The Government seeks to use the force of a search warrant to compel an individual to literally “open” the “privacies of [his/her] life,” Riley v. California, 573 U.S. at 403, and, by doing so, “to conced[e] the existence, possession and control, and authenticity of the documents tend[ing] to incriminate him.” In re Grand Jury Subpoena Duces Tecum Dated Mar. 25, 2011, 670 F.3d at 1343. The act of being forced to use one’s fingerprint to successfully open the contents of a smartphone is the equivalent of forcing a tangible oral or written statement from that individual that he or she has at least some degree of possession and control of the phone and possession, control and knowledge of its contents.

Once again, the court finds compelled fingerprint production to unlock devices "testimonial." And if it's testimonial, it's blocked by the Fifth Amendment. The government will just have to find another way to get at the evidence it thinks might reside in the phones it thinks it might find whenever it actually manages to get a warrant signed by this judge. Until then, it seriously needs to rethink its approach to this problem because the usual stuff isn't going to work in this court.

Filed Under: 4th amendment, 5th amendment, compelled production, encryption, fingerprints, idaho, magistrate judge, phones, ronald bush, unlock

Massachusetts Judge Says ATF Can Apply A Suspect's Fingerprints To Unlock An IPhone

from the five-finger-Fifth-Amendment-discount dept

It looks like a passcode still beats a fingerprint when it comes to securing your info. Maybe not from criminals, but definitely from the government. Lisa Vaas of Naked Security reports the ATF has received permission from a federal judge to apply a suspect's fingerprints to a phone to unlock it.

[T]he document, issued on 18 April, Massachusetts federal district judge Judith Dein gave agents from the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) the right to press a suspect’s fingers on any iPhone found in his apartment in Cambridge that law enforcement believes that he’s used, in order to unlock the devices with iPhone Touch ID.

The warrant [PDF] authorizes ATF agents to "press the fingers (including the thumbs)" of suspect Robert Brito-Pina to the "Touch ID sensor of any Apple cellular phone" recovered during the search. Brito-Pina is suspected of buying and selling weapons -- neither of which are permissible given his felon status. The ATF apparently believes evidence of this will be found on Pina's iPhone.

There doesn't appear to be any limit on how many fingers the ATF can use to unlock the phone. The warrant says only that officers will decide which fingers to apply. Presumably, that means all of them (including thumbs), since there's no language limiting officers to a certain number of finger applications. The only thing preventing every finger from being applied during the search is the iPhone itself, which will require a passcode after five wrong fingerprint applications.

The phone's nexus is established pretty thoroughly in the warrant application, which much of the sting operation using an arrestee-turned-informant being carried out via text messages. The government moved to unseal the warrant five days after applying for it, suggesting it has already executed this warrant.

The weird thing about the warrant application, which thoroughly details the sting operation and the ATF's surveillance of the suspect, is it appears the swearing agent isn't actually sure Pina owns an iPhone.

Given the popularity of Apple brand devices, I believe it is likely that I will find Apple brand devices such as an Apple iPhone at the Target Location.

And, despite authorizing the agents to only use Pina's finger to unlock any recovered iPhones, the warrant still contains boilerplate stating agents may demand fingerprint applications from anyone at the searched residence.

In some cases, it may not be possible to know with certainty who is the user of a given device, such as if the device is found in a common area of a premises without any identifying information on the exterior of the device. Thus, it will likely be necessary for law enforcement to have the ability to require any occupant of the Target Location to press their finger(s) against the Touch ID sensor of the locked Apple device(s) found during the search of the Subject Premises in order to attempt to identify the device's user(s) and unlock the device(s) via Touch ID.

This case likely won't budge the needle on the Fifth Amendment question. At least, not yet. If Pina wants the evidence gleaned from the iPhone suppressed (assuming there is an iPhone), there may be further discussion of this crucial issue in the future. Most judicial decisions on the use of biometrics to unlock devices have sided with government, asserting that faces and fingerprints are "non-testimonial," even if they're the gateway to plenty of evidence that will be used against the defendant. But there have been a few judges who've taken contrary stances, so the issue is far from settled.

Filed Under: 4th amendment, 5th amendment, atf, fingerprints, massachusetts, search, unlock

Federal Judge Says Compelling People To Unlock Phones With Their Fingerprints/Faces Violates The 5th Amendment

from the surprising-turn-of-events dept

The advent of biometric "passcodes" -- fingerprints and facial recognition -- appear to be leaving those who choose these methods with fewer Fifth Amendment protections. A handful of courts have ruled fingerprints and faces aren't "testimony." Much as officers can collect fingerprints and mugshots without a warrant following an arrest, they can also apply fingers and faces to locked phones to get to the data inside.

But it's not as simple as some court decisions make it appear. Even passwords can be considered testimonial, as they may indicate ownership of a locked device or compel production of evidence to be used against the device's owner. The passcode argument has gone both ways in court, which usually comes down to the individual judge's definition of "foregone conclusion." Does the foregone conclusion refer to the device's ownership or the evidence contained in it? The latter is harder to prove, and raising the burden of proof to this level tends to result in courts finding the compelled production of passwords to be a Fifth Amendment violation.

Via Thomas Brewster at Forbes, there's finally some good news on the biometric security front. A federal judge in California has ruled forcing people to unlock phones using biometric measures is a Fifth Amendment violation.

[I]n a more significant part of the ruling, Judge Westmore declared that the government did not have the right, even with a warrant, to force suspects to incriminate themselves by unlocking their devices with their biological features.

As the court points out [PDF], when the fingerprint IS the password, the Fifth Amendment is implicated despite these features normally being considered non-testimonial.

The Court finds that utilizing a biometric feature to unlock an electronic device is not akin to submitting to fingerprinting or a DNA swab, because it differs in two fundamental ways. First, the Government concedes that a finger, thumb, or other biometric feature may be used to unlock a device in lieu of a passcode. In this context, biometric features serve the same purpose of a passcode, which is to secure the owner's content, pragmatically rendering them functionally equivalent.

The court notes law enforcement is well aware of jurisprudence surrounding device security. In this case, the more time that passed between the seizure of the devices and their compelled unlocking, the less likely law enforcement would be able to evade the Fifth Amendment. Judge Westmore doesn't find this reasoning acceptable.

[A] passcode is generally required "when a device has been restarted, inactive, or has not been unlocked for a certain period of time." This is, no doubt, a security feature to ensure that someone without the passcode cannot readily access the contents of the phone. Indeed, the Government expresses some urgency with the need to compel the use of the biometric features to bypass the need to enter a passcode. This urgency appears to be rooted in the Government's inability to compel the production of the passcode under the current jurisprudence. It follows, however, that if a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one's finger, thumb, iris, face, or other biometric feature to unlock that same device.

The court goes on to say the government had other options to access messages -- like approaching Facebook with a warrant -- rather than intrude on the Fifth Amendment (and the Fourth Amendment -- more on that in a moment), but it chose to do it this way. Just because it's easier and faster to do it via compelled production doesn't make it right. In fact, in the court's eyes, all this effort did was violate the Constitution in multiple ways.

An attempted assault on the Fourth Amendment also occurred in this case. Investigators looking for evidence of extortion via Facebook sought to have every device and person at a residence seized and searched, with every resident compelled to unlock devices found during the search. As the judge points out in the rejection of the search warrant application, the Fourth Amendment requires far more specificity.

This request is overbroad. There are two suspects identified in the affidavit, but the request is neither limited to a particular person nor a particular device.

Thus, the Court finds that the Application does not establish sufficient probable cause to compel any person who happens to be at the Subject Premises at the time of the search to provide a finger, thumb or other biometric feature to potentially unlock any unspecified digital device that may be seized during the otherwise lawful search.

This is a far better answer to this sort of request than others we've seen. Searching someone's home and digging through their electronics is one of the scariest powers the government has. The Fourth Amendment is in place to limit these exercises of immense government power to those that are justifiable and necessary. When judges grant overbroad orders, they're doing more than failing to act as a check against government abuse. They're normalizing abuse of citizens' rights via judicial precedent.

Filed Under: 5th amendment, compelled speech, facial recognition, fingerprints, locked phones, passwords, testimony, unlocking phones

Device Detects Drug Use Through Fingerprints, Raising A Host Of Constitutional Questions

from the defendant-has-indicated-gov't-will-receive-'two-fingers-while-he's-s dept

If this tech becomes a routine part of law enforcement loadouts, judicial Fourth and Fifth Amendment findings are going to be upended. Or, at least, they should be. I guess citizens will just have to see how this all shakes out.

A raft of sensitive new fingerprint-analysis techniques is proving to be a potentially powerful, and in some cases worrying, new avenue for extracting intimate personal information—including what drugs a person has used.

[...]

The new methods use biometrics to analyze biochemical traces in sweat found along the ridges of a fingerprint. And those trace chemicals can quickly reveal whether you have ingested cocaine, opiates, marijuana, or other drugs. One novel, noninvasive forensic technique developed by researchers at the University of Surrey in the United Kingdom can detect cocaine and opiate use from a fingerprint in as little as 30 seconds. The team collected 160 fingerprint samples from 16 individuals at a drug-treatment center who had used cocaine within the past 24 hours—confirmed by saliva testing—along with 80 samples from non-users. The assay—which was so sensitive that it could still detect trace amounts of cocaine after subjects washed their hands with soap—correctly identified 99 percent of the users, and gave false positive results for just 2.5 percent of the nonusers, according to a paper published in Clinical Chemistry.

Let's discuss the phrase "non-invasive." It was relatively non-invasive when fingerprints were simply used to identify people. (That science isn't exactly settled, but we'll set that aside for now.) When smartphones and other devices used fingerprint scanners for ID, the "non-invasive" application of fingerprints was no longer non-invasive. An identifying mark, possessing no Fifth Amendment protection, gave law enforcement and prosecutors the option of using something deemed "non-testimonial" to obtain plenty of evidence to be used against the fingerprinted.

This opens up a whole new Constitutional Pandora's Box by giving officers the potential to apply fingerprints during traffic stops to see if they can't generate enough probable cause to perform a warrantless search of the car and everyone in it. It's generally criminal to possess drugs. Evidence of ingested drugs means suspects possessed them at some point in time, but evidence of drug use is generally only useful in driving under the influence cases. That's in terms of prosecutions, though. For roadside searches -- where officers so very frequently "smell marijuana" -- evidence of drug use is a free pass for warrantless searches.

That's just the Fourth Amendment side. The Fifth Amendment side is its own animal. Evidence obtained through fingerprints would seemingly make the production of fingerprints subject to Fifth Amendment protections. It should at least rise to the level of blood draws and breath tests, even though this is far more intrusive (in terms of evidence obtained) than tech normally deployed at DUI checkpoints. Blood draws often require warrants. Breath tests, depending on surrounding circumstances, aren't nearly as settled, with courts often finding obtaining carbon dioxide from breathing humans to be minimally testimonial.

As Scott Greenfield points out, the first tests of constitutionality will occur at street level. Cops will deploy the tech, hoping to good faith their way past constitutional challenges.

Precedent holds that the police are authorized to seize people’s fingerprints upon arrest, as the Fifth Amendment does not apply to physical characteristics. But the rubric is “fingerprints can be seized” based on their limited utility as physical characteristics used for identification purposes.

If they should be used for entirely different purposes, for the ascertainment of whether a person ingested drugs, then the rationale allowing the seizure of prints under the Fifth Amendment no longer applies. It certainly won’t be in the cops’ best interests to draw this distinction, to limit their use of prints to the purpose for which they’re allowed and to demonstrate constitutional restraint by not exceeding that purpose.

This means everything will get much worse for drivers and other recipients of law enforcement attention in the short-term. When the challenges to searches and seizures filter their way up through the court system, things might improve. But it won't happen rapidly and any judges leaning towards redefining the scope of fingerprint use will face strong government challenges.

It will probably be argued evidence of drug use obtained through these devices is no different than a cop catching a whiff of marijuana. On one hand, no cop could credibly claim to be able to detect drug use simply by touching someone's fingers. On the other hand, the reasonable reliability of the tech makes challenges more difficult than arguing against an officer's claim they smelled drugs during the traffic stop. The key may be predicating a challenge on the fact that the device actually tests sweat, not fingerprints, making it an issue of bodily fluids again and (slightly) raising the bar for law enforcement.

This news isn't disturbing for what it is. The obvious initial application is in workplaces, where random drug tests are standard policies for many companies. That tech advancements would progress to this point -- a 10-minute test that requires only the momentary placement of a finger on a test strip -- was inevitable. It's what comes after that will be significant. Courts have often cut law enforcement a lot of slack and tend to lag far behind tech developments and their implications on Constitutional rights. A new way to obtain evidence using something courts generally don't consider to be testimonial is going to disrupt the Constitution. Hopefully, the courts will recognize the distinction between identification and evidence and rule appropriately.

Filed Under: 4th amendment, 5th amendment, biometrics, drugs, fingerprints, forensics, law enforcement

Cops Follow Up Officer-Involved Shooting By Heading To Funeral Home To Apply Dead Man's Fingers To His Locked Phone

from the you-can't-take-your-rights-with-you dept

When your fingerprint is your device's password, there's little you can do to prevent law enforcement from accessing its contents. In most cases, judges have sided with the government, opining that fingerprints are non-testimonial even if it results in the production of criminal evidence.

The Fifth Amendment offers little protection for those using fingerprints for device security. And the Fourth Amendment offers zero protection against law enforcement using your fingerprint to access locked devices after you've departed the corporeal plain.

"I just felt so disrespected and violated," said Victoria Armstrong, whose fiance, Linus F. Phillip, was shot and killed by a Largo police officer last month.

Armstrong, 28, happened to be at Sylvan Abbey Funeral Home in Clearwater the day two detectives showed up with Phillip’s phone, she said. They were taken to Phillip’s corpse. Then, they tried to unlock the phone by holding the body’s hands up to the phone’s fingerprint sensor.

Armstrong was killed by police officers following a quasi-traffic stop. He jumped back in his car and attempted to drive away when officers began searching him. The officers involved have since been cleared by the state attorney's investigation. For whatever reason, detectives decided they needed access to the dead man's device. Here's the excuse given for macabre undertaking.

Lt. Randall Chaney said it was an unsuccessful attempt to access and preserve data on the phone to aid in the investigation into Phillip’s death and a separate inquiry into drugs that involved Phillip, 30.

It's completely unclear as to how information on the dead man's phone would have aided an investigation into his being shot and killed by officers. The attachment of a vague "drug inquiry" doesn't do much to salvage the search and seizure.

But the Fourth Amendment doesn't apply to dead people or their belongings. And the only reason the officers have to deal with this backlash is because their timing worked out badly. They retrieved the phone but the body had already been released to the funeral home. The seizure/search they would have performed at the morgue unfortunately now had to take place in public.

Since the Fourth Amendment isn't implicated, no warrant was needed, meaning no judge looked over an affidavit and decided unlocking a dead man's phone would somehow aid in an investigation into his death at the hands of the same law enforcement agency now attempting to crack open his phone.

This leads to another problematic aspect of the search: dead men can't be criminally charged. So what's the point in digging for more dirt on the dead man? Even if there's a "drug inquiry" underway, it seems the more honorable approach would be to at least ask the family's permission, if not avoid it entirely by focusing on other, less-dead suspects.

But honorable is the enemy of efficiency. And whatever the law doesn't explicitly forbid will be deployed by law enforcement, no matter how much it negatively affects its relationship with the community it serves.

Filed Under: encryption, fingerprints, funeral, linus phillip, passwords, victoria armstrong

Minnesota Supreme Court Says Unlocking A Phone With A Fingerprint Isn't A Fifth Amendment Issue

from the non-testimonial-act-of-producing-evidence-against-yourself dept

When it comes to the Fifth Amendment, you're better off with a password or PIN securing your device, rather than your fingerprint. Cellphone manufacturers introduced fingerprint readers in an effort to protect users from thieves or other unauthorized access. But it does nothing at all to prevent law enforcement from using their fingerprints to unlock seized devices.

The US Supreme Court hasn't seen a case involving compelled production of fingerprints land on its desk yet and there's very little in the way of federal court decisions to provide guidance. What we have to work with is scattered state court decisions and the implicit understanding that no matter how judges rule, a refusal to turn over a fingerprint or a password is little more than a way to add years to an eventual sentence.

The Minnesota Supreme Court has issued the final word on fingerprints and the Fifth Amendment for state residents. In upholding the appeals court ruling, the Supreme Court says a fingerprint isn't testimonial, even if it results in the production of evidence used against the defendant. (h/t FourthAmendment.com)

From the ruling [PDF]:

Although the Supreme Court’s distinction between the testimonial act of producing documents as evidence and the nontestimonial act of producing the body as evidence is helpful to our analysis, the act here—providing the police a fingerprint to unlock a cellphone—does not fit neatly into either category. Unlike the acts of standing in a lineup or providing a blood, voice, or handwriting sample, providing a fingerprint to unlock a cellphone both exhibits the body (the fingerprint) and produces documents (the contents of the cellphone). Providing a fingerprint gives the government access to the phone’s contents that it did not already have, and the act of unlocking the cellphone communicates some degree of possession, control, and authentication of the cellphone’s contents. See Hubbell, 530 U.S. at 36. But producing a fingerprint to unlock a phone, unlike the act of producing documents, is a display of the physical characteristics of the body, not of the mind, to the police. See Schmerber, 384 U.S. at 763.

Because we conclude that producing a fingerprint is more like exhibiting the body than producing documents, we hold that providing a fingerprint to unlock a cellphone is not a testimonial communication under the Fifth Amendment.

The ruling notes the defendant did try to holdout on this, sticking to his Fifth Amendment arguments. But when the trial court gives you only unpalatable options, defendants tend to give prosecutors what they want.

The district court concluded that compelling Diamond’s fingerprint would not violate his Fifth Amendment privilege because “[c]ompelling the production of [Diamond’s] fingerprint or thumbprint would not call upon the use of [his] mind. It is more akin to providing a key to a lockbox.” Accordingly, it ordered Diamond to “provide a fingerprint or thumbprint as deemed necessary by the Chaska Police Department to unlock his seized cell phone.”

Diamond continued to object to providing the necessary fingerprint for unlocking the phone. Nevertheless, he finally unlocked the cellphone with his fingerprint in court after being held in civil contempt and warned of the possibility and consequences of criminal contempt.

This is an aspect never discussed by the FBI and others engaged in the war on encryption. Many, many people can be motivated to unlock devices when faced with the prospect of indefinite imprisonment on contempt charges. It's something that should work in all but the most extreme criminal cases where the potential imprisonment might be as close to indefinite as humanly possible.

Filed Under: encryption, fifth amendment, fingerprints, first amendment, minnesota, self incrimination

Judge Rejects Warrant Seeking To Force Everyone At A Searched Location To Unlock Seized Electronic Devices

from the new-brute-force-method-revealed dept

Late last year, Thomas Fox-Brewster of Forbes uncovered a strange search warrant among a pile of unsealed documents. The warrant -- approved by a magistrate judge -- allowed law enforcement officers to demand that everyone present at the searched location provide their fingerprints to unlock devices seized from the same location.

In support of its request, the government cited cases dating back to 1910, as though they had any relevance to the current situation. The most recent case cited was 30 years old -- still far from easily applicable to today's smartphones, which are basically pocket-sized personal data centers.

The judge granted it, stating that demands for fingerprints, passwords, or anything (like encryption keys) that might give law enforcement access to the devices' content did not implicate the Fourth or Fifth Amendments. While the magistrate was correct that no court has found the application of fingerprints to unlock devices to be a violation of the Fifth Amendment, the other access options (passwords, encryption keys) might pose Fifth Amendment problems down the road.

Riana Pfefferkorn has uncovered a similar warrant request, but this one has been rejected by the magistrate judge. Pretty much across the board, the order is the antithesis of the one revealed last year. The judge finds [PDF] that the broad request to force everyone present at the residence to apply their fingerprints to seized devices to unlock them implicates multiple Constitutional amendments.

The issues presented in this warrant application are at the cross section of protections provided by the Fourth and Fifth Amendments. Essentially, the government seeks an order from this Court that would allow agents executing this warrant to force "persons at the Subject Premises" to apply their thumbprints and fingerprints to any Apple electronic device recovered at the premises. (See Attach. B, tT 12.) The request is neither limited to a particular person nor a particular device. And, as noted below, the request is made without any specific facts as to who is involved in the criminal conduct linked to the subject premises, or specific facts as to what particular Apple-branded encrypted device is being employed (if any).

The judge notes the government is able to detain and search persons located at the premises being searched, but that does not extend to forcing every single person in a residence at the time of a search to comply with attempts to unlock seized devices. Because the warrant affidavit contained no particularity about the devices or who in the household the government suspected of engaging in criminal activity, the court can't find anything that justifies the broad, inclusive language contained in the request.

This Court agrees that the context in which fingerprints are taken, and not the fingerprints themselves, can raise concerns under the Fourth Amendment. In the instant case, the government is seeking the authority to seize any individual at the subject premises and force the application of their fingerprints as directed by government agents. Based on the facts presented in the application, the Court does not believe such Fourth Amendment intrusions are justified based on the facts articulated.

The court has other problems with the affidavit -- beyond the government's unwarranted extension of Fourth/Fifth Amendment jurisprudence to cover any devices/fingerprints encountered at a searched location. Early in the order, it notes the government is deploying boilerplate nearly as outdated as its case citiations.

Despite the apparent seriousness of the offenses involved, the Court notes that some of the "boilerplate" background information included in the warrant is a bit dated, such as its explanation that "[t]he internet allows any computer to connect to another computer [so] [e]lectronic contact can be made to millions of computers around the world;" its explanation that a "Blackberry" is a common "Personal Digital Assistant" and its suggestion that the use of "cloud technology" is the exceptional way of transferring files and that transferring images to a computer by directly connecting a cable to a camera or other recording device is the expected means of data transfer.

The judge notes outdated boilerplate isn't enough to undo probable cause assertions, but it certainly doesn't help -- especially not when the government is requesting this sort of broad permission.

The inclusion of this somewhat dated view of technology certainly does not distract from the application's goal of establishing probable cause. However, the dated "boilerplate language" is problematic for what is not included. There is absolutely no discussion of wireless internet service and the possibilities and capabilities that wireless service presents in this context. For example, an unsophisticated intemet user, or a careless one, may fail to properly encrypt his wireless service or may share the password injudiciously. Such practices leave open the possibility that it is not an inhabitant of the subject premises that has used the internet to gather and distribute child pornography, but rather it is a person who has access to the internet service at the subject premises.

Obviously, this possibility holds true in all investigations that track the investigation outlined in the instant application. The limitations of this investigation are not fatal to establishing probable cause, but, in the Court's view, these limitations do impact the ability of the government to seek the extraordinary authority related to compelling individuals to provide their fingerprints to unlock an Apple electronic device.

Then there's the other assertions. The government's application does nothing to narrow down which resident it's seeking or what device(s) might contain evidence of criminal activity. What it does appear to be certain about -- for reasons not included in the application -- is that the devices it seeks are Apple products. A footnote in the order questions this assertion.

Why Apple devices are likely to be found at the premises is not explained. The Court is aware that Apple has a large market share in online hardware, but Microsoft's Windows operating systems continue to dominate the overall market share of operating systems used.

What makes these broad, unsupported assertions even worse, especially when combined with the outdated boilerplate, is that this is apparently the direction the government is heading with its search warrants.

In closing, upon presentation of the warrant application to this Court, the government identified for this Court that the warrant application was seeking the forced fingerprinting discussed herein. The government further noted "[t]his is the language that we are making standard in all of our search warrants." This declaration of standardization is perhaps the crux of the problem. As the Court hopes it is plain from the above, the issues presented here require a fact-intensive inquiry both for purposes of the Fourth Amendment and the Fifth Amendment.

More particularity, better probable cause, and fewer assumptions about the Fourth and Fifth Amendment's application in a post-Riley world are what's needed from the government, according to this order. Even though this application was rejected, it's safe to say this same approach has worked elsewhere. We've seen one approved warrant already and there are likely several more safely hidden from the public eye in the government's multitudinous sealed cases.

What's troubling about the government's assertions in this application is its apparent belief it's found an encryption workaround: one that blows past Fourth and Fifth Amendment concerns using little more than boilerplate that still considers cables to be an essential part of "cloud computing," and magistrate judges willing to buy its outdated legal arguments.

Filed Under: 4th amendment, 5th amendment, fingerprints, location, search, warrant