Forced "touch ID" to open locked devices

#1

Security vs. the state:
https://www.techdirt.com/articles/20161016/13545335814/granted-warrant-allowed-feds-to-force-everyone-searched-residence-to-unlock-devices-with-their-fingerprints.shtml

Thoughts on this?

#2

I have a few - about biometrics being unsuitable - but further, I had someone do a quick experiment for me.

Turns out that knuckles are unique enough to work with touchID type systems, and you have 28 of 'em easily available. Kind of increases the search space.

#3

Disclaimer: This isn't legal advice.

As I have understood that specific warrant and the general constitutional protections we have surrounding our phones and other portable digital storage devices with biometric-controlled locks, both the Fourth and Fifth Amendments are implicated (or avoided, as the case may be).

Fourth: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

Fifth: "No person . . . shall be compelled in any criminal case to be a witness against himself."

You have Fourth Amendment protection when you have what's called a "reasonable expectation of privacy." A lot of things go into this, and people can devote entire careers and bodies of scholarship to these four words, so for the sake of this little comment just assume my conclusory statements have adequate legal analyses behind them.

Some courts have more or less determined that the average person does NOT have a reasonable expectation of privacy when it comes to their fingerprints, since we leave them everywhere we go. Same with hair samples, skin flakes, etc. Fucked up, I know. Now, in this case there was a search warrant, which in all likelihood was issued based on a probable cause affidavit that a cop wrote. We don't have the warrant or the affidavit, so I can't say for sure. So where you have a "reasonable expectation of privacy" the cops need a warrant to conduct a search. Here, at least a police department who applied for the warrant wanted to make sure there wasn't an argument around "you have a REP with regard to the privacy of your fingerprint, so you needed a warrant, and you didn't have one!" Even if that jurisdiction says you don't need a warrant anyway. (Aside: It's not difficult to get a warrant. Probable cause is a pretty low bar).

As far as the Fifth Amendment is concerned, this is why I tell folks at the know your rights workshops I give to use a passcode or passphrase, since that's "testimonial," a.k.a. it's stuff that's stored inside your head. It's a knowledge-based protection, not a meatspace-based one. So neither the 4th nor the 5th protects you from being compelled to hand over your literal finger to unlock a biometric lock.

The two problems here, legally-speaking, that the investigators face are (1) was the warrant actually supported by probable cause and (2) there is a prohibition on "general warrants" or "all-persons warrants" because they are so broad and it's so easy to abuse one's power with a warrant that says "all persons who are in such-and-such a place at such-and-such a time blah blah blah."

Two final thoughts: These apply to everyone in the territorial jurisdiction of the US, regardless of citizenship status. This only applies to regular criminal investigations—it doesn't apply to either issues of national security (i.e. foreign-sourced threats to the nation, as opposed to domestic security, which is domestic-sourced threats to the nation), and it also doesn't apply to "border searches" conducted by ICE, CBP, or another agency incorporated under the DHS. Border searches have a lower bar to reach than probable cause, and the justifications for the searches are different. It's a different conversation entirely.

Hope this is helpful! Encrypt your shit with a passcode! At least 7-8 characters!

#4

That's an excellent and comprehensive summary. One point you didn't mention: if ordered to open a passcode protected device and the owner fails to comply, a contempt of court action can still put you in jail for some arbitrary (and maybe capricious and potentially extended) period of time. It's particularly notable that at country's borders (differently defined by the general public and the US government), a "Constitution-free" zone is in effect and none of the usual/expected protections apply.

It's unfortunate that word-smithing and vexing, arcane legalisms have parsed civil rights to the extent they have. Worse, technically unsophisticated judges and juries make pronouncements based on limited or no knowledge and what's invoked by creative prosecutors is often not even correct, if I've understood matters accurately.

Thanks!
KAC

#5

Yes! Agh contempt of court is such crap! Judicially-created crimes are a direct affront to nulla poena sine lege, or no punishment that's not legislatively created. And the way they describe this kind of imprisonment? "The defendant possesses the keys to his own cell." Bah!

I was just at a talk tonight that argued somewhat persuasively that the law always being one step behind tech is actually a good thing, but it's late and I can't synthesize the argument. I just remember that I was pretty convinced.

#6

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.