Another Federal Magistrate Says Compelled Production Of Passwords/Biometrics Violates The Fifth Amendment

from the with-bonus-Fourth-Amendment-coverage! dept

In another judicial rarity, a magistrate judge has rejected a warrant request by the federal government to compel a criminal suspect to unlock a phone found during the search of his residence. It won't set precedent but it does present some arguments suspects will find useful when faced with orders for compelled production of passcodes or passwords.

Earlier this year, a California magistrate came to the same conclusion, finding that compelled production of fingerprints or faces to unlock phones violated the Fifth Amendment rights of the suspects targeted by the warrant. Equating biometric security features with passwords, the judge denied the warrant request, stating that if it's a Fifth Amendment violation to compel password production, it's a Fifth Amendment violation to force someone to apply their fingerprints to a locked device.

The device in this case is apparently secured by a swipe pattern. This would require more input from the suspect than simply applying a finger to the device. The court finds [PDF] that this act would be testimonial -- covered by Fifth Amendment protections against self-implication. But it goes further, finding that attempting to violate Fifth Amendment rights causes violations of Fourth Amendment rights.

The Court denies the Government’s application for a warrant authorizing law enforcement to compel an individual to use his/her fingerprints to unlock a certain cellphone. Using the individual’s fingerprints for this purpose would constitute a search and seizure under the Fourth Amendment. For a search and seizure to be lawful under the Fourth Amendment it must be “reasonable.” A search or seizure is unlawful, and therefore unreasonable, when it violates a person’s constitutional rights. Here, compelling the use of the individual’s fingerprints violates the Fifth Amendment right against self-incrimination because the compelled unlocking of the phone with fingerprints would communicate ownership or control over the phone. Because the compelled use of the individual’s fingerprints violates the Fifth Amendment, the search and seizure would not be reasonable under the Fourth Amendment. Thus, the Fourth Amendment and the Fifth Amendment prohibit the result sought by the Government.

The locked phone was taken during a search of the residence for suspected child porn possession. The problem with the government's warrant request is that the compelled production seeks testimonial information that can be gleaned simply by observing the suspect unlocking the device. As the court points out, this isn't acceptable, even if it's little more than a fingerprint being applied to phone's lockscreen. It's what the government doesn't know that hurts its case.

Here, however, the Government seeks to compel the individual to use his/her fingerprint to attempt the unlocking of a cellphone seized at the residence. Indeed, the Government acknowledges that one purpose for doing so is to “search for . . . indicia of ownership.” Aff. in Supp. of App. for Search Warrant 14. Thus, the Government seeks evidence that the individual’s fingerprint unlocks the phone not simply to access its contents but also to establish the individual’s possession and control of the phone and knowledge of its contents.

The government can't rely on the "foregone conclusion" theory since it apparently lacks enough evidence to tie the suspect to the phone found in the bathroom. Without more, the government is relying on the suspect to, in effect, testify against himself by unlocking a device the government can't conclusively say belongs to him.

A footnote details the yawning gap between the actual evidence the government has and the "foregone conclusion" it was hoping to have applied to its warrant request.

The applicant avers that, when questioned at the residence at the time the earlier search warrant was executed, the individual told law enforcement his/her phone was in the bathroom. A phone was found in a bathroom, and the application implies that the individual was not in the bathroom when that statement was made. But three other phones were also located during the search. There is no specific information about how many bathrooms were in the residence. There is no information about whether the individual lives alone or whether anyone else lives or was in the residence at the time of the search. To be clear, none of these facts are determinative of the Court’s conclusion in this case. But they do illustrate that any connection between the individual and the phone at issue here is more tenuous than it might be under other circumstances.

Another footnote suggests that if the government had performed a little bit of due diligence prior to requesting this warrant, things might have gone another way.

There are, of course, other investigative techniques to determine who owned or possessed the phone, such as seeking to lift fingerprints from the device or interviewing witnesses who might connect a specific individual to the phone. Further, the Government has investigatory methods available to it to seek stored communications and subscriber information regarding phones known to be used by a particular person, upon a proper showing.

Finally, the court lays it all out for the government. Compulsion is the opposite of consent. If the government would like to ask the suspect to unlock the phone, it's free to try that angle or anything listed in the footnote above. But what it can't do -- not without violating rights -- is ask the court for permission to force someone to incriminate themselves by inextricably linking a suspect device to themselves.

The reach of this decision goes no further than the rejected warrant. But it does at least show some judges are paying close attention to warrant requests seeking compelled production of passwords or biometric markers. That's good news for Americans and their rights.

Filed Under: 4th amendment, 5th amendment, biometrics, locked phones, magistrate judge, passwords

Federal Judge Says Compelling People To Unlock Phones With Their Fingerprints/Faces Violates The 5th Amendment

from the surprising-turn-of-events dept

The advent of biometric "passcodes" -- fingerprints and facial recognition -- appear to be leaving those who choose these methods with fewer Fifth Amendment protections. A handful of courts have ruled fingerprints and faces aren't "testimony." Much as officers can collect fingerprints and mugshots without a warrant following an arrest, they can also apply fingers and faces to locked phones to get to the data inside.

But it's not as simple as some court decisions make it appear. Even passwords can be considered testimonial, as they may indicate ownership of a locked device or compel production of evidence to be used against the device's owner. The passcode argument has gone both ways in court, which usually comes down to the individual judge's definition of "foregone conclusion." Does the foregone conclusion refer to the device's ownership or the evidence contained in it? The latter is harder to prove, and raising the burden of proof to this level tends to result in courts finding the compelled production of passwords to be a Fifth Amendment violation.

Via Thomas Brewster at Forbes, there's finally some good news on the biometric security front. A federal judge in California has ruled forcing people to unlock phones using biometric measures is a Fifth Amendment violation.

[I]n a more significant part of the ruling, Judge Westmore declared that the government did not have the right, even with a warrant, to force suspects to incriminate themselves by unlocking their devices with their biological features.

As the court points out [PDF], when the fingerprint IS the password, the Fifth Amendment is implicated despite these features normally being considered non-testimonial.

The Court finds that utilizing a biometric feature to unlock an electronic device is not akin to submitting to fingerprinting or a DNA swab, because it differs in two fundamental ways. First, the Government concedes that a finger, thumb, or other biometric feature may be used to unlock a device in lieu of a passcode. In this context, biometric features serve the same purpose of a passcode, which is to secure the owner's content, pragmatically rendering them functionally equivalent.

The court notes law enforcement is well aware of jurisprudence surrounding device security. In this case, the more time that passed between the seizure of the devices and their compelled unlocking, the less likely law enforcement would be able to evade the Fifth Amendment. Judge Westmore doesn't find this reasoning acceptable.

[A] passcode is generally required "when a device has been restarted, inactive, or has not been unlocked for a certain period of time." This is, no doubt, a security feature to ensure that someone without the passcode cannot readily access the contents of the phone. Indeed, the Government expresses some urgency with the need to compel the use of the biometric features to bypass the need to enter a passcode. This urgency appears to be rooted in the Government's inability to compel the production of the passcode under the current jurisprudence. It follows, however, that if a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one's finger, thumb, iris, face, or other biometric feature to unlock that same device.

The court goes on to say the government had other options to access messages -- like approaching Facebook with a warrant -- rather than intrude on the Fifth Amendment (and the Fourth Amendment -- more on that in a moment), but it chose to do it this way. Just because it's easier and faster to do it via compelled production doesn't make it right. In fact, in the court's eyes, all this effort did was violate the Constitution in multiple ways.

An attempted assault on the Fourth Amendment also occurred in this case. Investigators looking for evidence of extortion via Facebook sought to have every device and person at a residence seized and searched, with every resident compelled to unlock devices found during the search. As the judge points out in the rejection of the search warrant application, the Fourth Amendment requires far more specificity.

This request is overbroad. There are two suspects identified in the affidavit, but the request is neither limited to a particular person nor a particular device.

Thus, the Court finds that the Application does not establish sufficient probable cause to compel any person who happens to be at the Subject Premises at the time of the search to provide a finger, thumb or other biometric feature to potentially unlock any unspecified digital device that may be seized during the otherwise lawful search.

This is a far better answer to this sort of request than others we've seen. Searching someone's home and digging through their electronics is one of the scariest powers the government has. The Fourth Amendment is in place to limit these exercises of immense government power to those that are justifiable and necessary. When judges grant overbroad orders, they're doing more than failing to act as a check against government abuse. They're normalizing abuse of citizens' rights via judicial precedent.

Filed Under: 5th amendment, compelled speech, facial recognition, fingerprints, locked phones, passwords, testimony, unlocking phones

Guy Gets Tossed In Jail For Contempt Charges Because Cops Say They Need To Unlock His Phones To Get Evidence Of Drug Possession

from the power-hungry-idiots-on-a-fishing-trip dept

There's a Fifth Amendment case developing in Tampa, Florida revolving around cellphones, passcodes, and contempt charges. (h/t Dissent Doe)

William Montanez has just been jailed for 180 by a Florida judge for refusing to unlock two phones seized from him by police. This happened in an extremely unorthodox fashion. In court, the judge said "Unlock them," and Montanez was handed both phones. He claimed he couldn't remember the passcodes, saying they both had been recently purchased. No passcode, no freedom, the judge instantly ruled.

The police have a warrant and claim that's all they need to demand access to the phones' contents. But that's predicated on a string of events that seem constitutionally-dubious, to say the least.

An emergency petition [PDF] (via Florida You Judge) to challenge the judge's contempt ruling (and the warrant itself) has been filed by Montanez's attorney, Patrick Leduc. The petition details the traffic stop and arrest of Montanez, which appears to contain a handful of constitutional violations.

Montanez was pulled over for failure to yield. During this stop, a K-9 unit was brought to the scene to sniff Montanez's car after he refused to consent to a search. This is already questionable. The Supreme Court's ruling in Rodriguez makes it clear regular traffic stops aren't supposed to be fishing expeditions. If no reasonable suspicion presents itself (and refusing consent isn't suspicious activity), officers aren't allowed to extend stops to further badger drivers into relinquishing consent or bring a dog to scene to ask its permission for a search.

At this point, it's unknown how much time elapsed between the initiation of the traffic stop and the drug dog's arrival. All that's clear from the petition is that the dog wasn't there when the traffic stop began. Whatever the case, Montanez was never issued a citation for the infraction supposedly triggering the stop.

After the dog told the cops it was ok to perform a warrantless search, officers found a misdemeanor amount of marijuana, supposed THC oil (tested only with a drug field test, so…), and a handgun. The passenger of the car was a felon, so it was illegal for him to have it. The same can't be said for Montanez. Again, this may have been mooted by Montanez's mother claiming to own the handgun -- something the state has yet to disprove or even offer an opinion about.

Montanez did claim possession of the marijuana and alleged byproducts. Open-shut misdemeanor offense… except that officers seized his two cellphones and obtained a search warrant for them. This was predicated on one thing: a text message saying "omg did they find it" being received on one of the cellphones during the traffic stop.

Whatever "it" is, the officers appear to have found it. Since all the evidence needed to support the misdemeanor possession charges was already in the hands of law enforcement, why the compelling need to search the seized phones? According to the search warrant affidavit [PDF], the phones will apparently contain evidence of the crimes Montanez is charged with, which would seemingly be entirely supported by the marijuana and (alleged) THC oil already in their possession.

[T]here is now being stored on said Cellular iPhone certain evidence, to-wit: images, text messages, files, telephone numbers, call logs, graphic files, digital media and/or digital files, and any other media that can store digital files and/or digital media. Phone records, records of Internet Service Providers, E-mails and other electronic data, including but not limited to passwords telephone numbers, Emails, Instant messages or text message storage, computer images, computer programs and system documentation; documents files or any other computer data relating to passwords.

Which can provide evidentiary value in proving a violation of the Laws of the State of Florida, to-wit:
the Laws prohibiting: Possession of Cannabis Less Than 20 grams, Possession of Drug Paraphernalia and Possession of a Firearm During the Commission of a Felony

The felony listed here would be carrying the possession of a firearm by a felon. The only felon in the vehicle was the passenger, but it looks like prosecutors want to hang this on Montanez, despite the only other possible felony available being drug trafficking -- and the evidence on hand simply doesn't support that charge.

In any event, there's zero chance Montanez's phones will carry additional evidence of the charged criminal acts, which are all predicated on evidence the police have already obtained. The warrant appears to be a fishing expedition to try to prove Montanez is actually a drug dealer so the felony charge sticks. The two misdemeanor charges already have all the evidence prosecutors need, so police are pressing forward with zero probable cause to nail Montanez with a felony. The problem is, the probable cause has to come before the search, not after it, and that's why his lawyer is challenging the warrant.

The prosecution's request for contempt of court charges cites another state case as support for compelled passcode production. But the case cited here couldn't be more different than this one. While it does deal with compelled password production and contempt charges, it also deals with charges of voyeurism and an unchallenged warrant.

First off, there's a significantly better chance evidence of voyeurism might be contained in a seized cellphone. Second, the warrant in this case is being challenged, which makes it an entirely different judicial animal than the case cited.

As it stands now, Montanez is going to spend six months in jail for preventing police from rooting around in seized cellphones for evidence they don't need and which would likely be highly irrelevant to these criminal proceedings. The police can't show probable cause for this search because none exists. And yet, the judge trying the case demanded Montanez unlock the phones in court and when he failed to do so (Montanez claimed he could not remember the passcodes), the judge tossed him in jail to, I guess, jog his memory.

This case stinks all over. Nothing should move forward until the cops give a better accounting of their actions during the stop and come up with something better than "we just really want to look at his phones" under the heading "input probable cause." But chances are this will all end in Montanez spending an indefinite amount of time in jail without ever having been convicted of a crime.

Filed Under: 4th amendment, contempt, encryption, illegal search, locked phones, william montanez

Verizon Begins Locking Down Its Phones Again, Purportedly To 'Stop Theft'

from the fool-me-once dept

If you've been around a while, you probably know that Verizon has an adversarial relationship with openness and competition. The company's history is rife with attempts to stifle competing emerging technologies that challenged Verizon's own business interests, from its early attempts to block GPS and tethering apps so users would have to subscribe to inferior and expensive Verizon services, to its attempts to block competing mobile payment services to force users (again) onto Verizon's own, inferior products. And that's before you get to Verizon's attempts to kill net neutrality and keep the broadband industry uncompetitive.

In the earlier years, Verizon had a horrible tendency to lock down its devices to a crippling and comical degree. But with the rise of net neutrality, competition from carriers like T-Mobile, and open access conditions affixed to certain spectrum purchased by Verizon, the company slowly-but-surely loosened its iron grip on mobile devices. But let's be clear: the company had to be dragged, kicking and screaming, into the new, more open future we all currently enjoy, where (by and large) you can install whatever apps you like on your device, and attach most mainstream devices (with some caveats) to Verizon's network.

That's why more than a few eyebrows were raised after Verizon gave CNET the early exclusive news (apparently in the hopes that they'd frame it generously, which they did) that the company will soon be locking down its smartphones as part of a purported effort to "combat theft." Carriers have been justly criticized (and sued) for doing too little to prevent theft, in part because they profit on both sides of the equation -- both when a customer comes crying to Verizon to buy a new phone, and when the user with the stolen phone heads to Verizon to re-activate it on a new line.

On its surface, Verizon's plan doesn't seem to have much of an initial impact on traditional users, who'll still get to have their phone unlocked after an unspecified amount of time. The only initial problems that could arise involve users who buy a phone, then head overseas to insert a local SIM to get more reasonably-priced service. Those users may have to contact Verizon before that phone will work, something that may or may not be a pain in the ass in real-world practice.

But it's more the precedent of the move that has people familiar with Verizon's handiwork on this front a little nervous. Especially given Verizon's recent successes in not only killing net neutrality, but gutting most state and federal oversight of ISPs entirely (something many haven't keyed into yet). For one, locking down its devices technically violates the "Carterfone" open access rules affixed to the 700MHz spectrum used in Verizon's network. Verizon was quick to insist to CNET that this shift back toward locking down devices does not violate the "spirit of the agreement":

"The move marks a broad reversal of its policy to offer all of its phones unlocked -- part of a deal with the Federal Communications Commission requiring it to unlock phones as part of its acquisition of the "C block" of 700 megahertz spectrum, which powers its 4G LTE network. One section of the deal specifically prohibits Verizon from configuring handsets to prevent them from working on other networks.

Avi Greengart, an analyst at Global Data, said the policy change appears to contradict the existing rules.

Verizon, however, argues it's still following the intent of the rule.

"This change does not impact the spirit of that agreement as it is designed to deter theft by those who engage in identity theft or other fraud," said a spokeswoman for Verizon. "It is not inconsistent with our obligations under the C Block."

Oh, ok then. The problem is that Verizon doesn't have very much (read: any) credibility on this front, something other news outlets were notably more blunt about:

"Verizon has peddled CNET the story that this is about preventing handset theft and fraud. No facts or figures are provided to back up that assertion.

The simple fact is this: Verizon believes it can get away with SIM-locking its handsets again. This creates confusion for consumers. "Can I take my Verizon phone to another network?" Goes from being answered with a simple "Yes" to "Well, probably, but first you need to contact customer service, ask for us to do this, give us your phone's serial number, wait a week, and make sure this software update comes through."

Again, Verizon's pretty damn ambiguous about the hard specifics of this new plan, only stating the handset lock down will expand over time. Verizon (like many large telecom operators) has a long, proud history of hiding anti-competitive behavior behind faux-technical jargon and a breathless concern over the safety and security of the network. So locking down phones "for security reasons" is great cover for what could be ballooning efforts to make it harder for wireless consumers to switch to competitors. After all, who's going to stop them, net neutrality opponent, former Verizon employee, and current FCC boss Ajit Pai?

Filed Under: fcc, locked phones, theft, unlocked phones
Companies: verizon

Man To Spend 180 Days In Jail For Turning Over Non-Working Password

from the inadvertently-building-up-time-served-credit dept

The protections of the Fifth Amendment are running up against technology and often coming out on the losing end. Court rulings have been anything but consistent to this point. So far it appears password protection beats fingerprints, but not by much.

It all comes down to the individual court. Some view passwords as possibly testimonial in and of themselves, and side with defendants. Others view passwords as something standing in the way of compelled evidence production and punish holdouts with contempt of court charges.

That's what's happening to a Florida man suspected of child abuse. He claims he's given law enforcement his phone's password already, but prosecutors claim the password failed to unlock his phone. They believe his phone holds evidence of the physical abuse alleged -- a claim that seems a bit less believable than those made about child porn viewers and drug dealers.

The court, however, has sided with prosecutors.

A Hollywood man must serve 180 days in jail for refusing to give up his iPhone password to police, a Broward judge ruled Tuesday — the latest salvo in intensifying legal battles over law-enforcement access to smart phones.

Christopher Wheeler, 41, was taken into custody in a Broward Circuit Court, insisting he had already provided the pass code to police investigating him for child abuse, although the number did not work.

All that can be said for certain is prosecutors still don't have an unlocked phone. As prosecutors and this judge see it, the only explanation is that Wheeler lied. That earns him six months of jail time. Maybe Wheeler should have said he couldn't remember.

As Wheeler was jailed Tuesday, the same issue was unfolding in Miami-Dade for a man accused of extorting a social-media celebrity over stolen sex videos.

That man, Wesley Victor, and his girlfriend had been ordered by a judge to produce a pass code to phones suspected of containing text messages showing their collusion in the extortion plot.

Victor claimed he didn't remember the number. He prevailed.

This would be the same judge who determined turning over a password had no Fifth Amendment implications. However, the court found it plausible the defendant might not be able to remember the password to a phone he'd last used over ten months ago. But the ruling doesn't necessarily say the defendant is telling the truth. It only goes so far as saying it's almost impossible to prove he's lying. Given the gap between the phone's seizure and the demand for a password, it's a plausible claim.

His co-defendant made no such claim. Like Wheeler above, Victor's girlfriend handed over a password but it didn't work. The court has asked her to explain why. Given the judge's earlier Fifth Amendment determination, it's safe to assume Hencha Voigt will be facing jail time if the explanation isn't to the judge's liking.

Filed Under: 4th amendment, 5th amendment, christopher wheeler, encryption, forced revelation, locked phones, password, wesley victor