A case in California involving blackmail threats made over Facebook Messenger shows how courts are grappling with the constitutionality of requiring fingerprint swipes to unlock smart devices.
A federal judge earlier this year barred Oakland, Calif., police from forcing the alleged blackmailers to swipe open their phones because it was akin to providing potentially incriminating testimony. Police were probing a complaint that two people were threatening to release embarrassing videos of a third person if they didn’t get money.
But around the country, judges have split on whether forcing criminal suspects to open their phones with biometric identifiers, such as fingerprints and face or eye scans, violates the Fifth Amendment’s right against self-incrimination. A Bloomberg Law analysis of cases since 2017 found an even split: courts in three cases ruled that compelled decryption using biometrics violates the Fifth Amendment and, in another three, found that it doesn’t.
Biometrics’ growing use in products ranging from smart phones to home security systems is forcing courts to tackle a slew of new questions as they try to link the emerging technology to protections in the U.S. Constitution, privacy attorneys say.
The central question is whether swiping a finger or scanning an eye to unlock a phone amounts to testimony that the device belongs to the person doing the unlocking, attorneys say.
“There’s a lack of total consensus over how to address compelled decryption,” Alan Butler, senior counsel at the Electronic Privacy Information Center in Washington, said. “It gets trickier with biometrics because you end up with situations where the use of the biometric feature isn’t just about decrypting data. It’s also about identifying people and associating them with the decrypted data.”
Judges typically run into questions on biometric decryption when reviewing government search warrant applications that would force criminal suspects to use biometric identifiers to unlock devices found during searches. One main issue is whether applying fingerprints or scanning faces are mere physical acts, or effectively serve as testimony that could be used against a suspect.
Some judges have held that using biometric features invokes the Fifth Amendment because a suspect’s fingerprint essentially gives the government access to a host of information, Orin Kerr, a law professor at Berkeley Law in California, said. But others have ruled that the Fifth Amendment doesn’t apply because biometric features require the use of people’s bodies, not their minds.
Criminal suspects likely aren’t communicating anything when they open a device—as long as the government doesn’t make them choose which body part to use, Kerr, who specializes in criminal procedure, said.
The U.S. District Court for the District of Idaho, for example, ruled in July that the government could force a child pornography suspect to open a cell phone with his fingerprint. Applying a fingerprint to a sensor simply amounts to the seizure of a physical characteristic, and the suspect wouldn’t use his mind because government agents would pick which finger to use, the court ruled in In re White Google Pixel 3 XL Cellphone in a Black Incipio Case.
Nearly a year earlier, a U.S. District Court for the District of Columbia magistrate judge ruled that using a suspect’s biometrics to open a device isn’t testimonial because it’s like using a key, rather than a combination lock, to open a safe. The government picks which finger to apply to the sensor, so the person needn’t think about the act, the judge said in In re Search of [Redacted].
Other judges, including the U.S. District Court for the Northern District of California magistrate judge in In re Search of a Residence in Oakland, have held that opening a phone with a biometric feature is testimonial because it communicates that the suspect owns or at least can control the device. The magistrate judge found probable cause to search the premises but prohibited police from compelling finger swipes to unlock digital devices because such acts would prove that a suspect owns or has access to the devices.
“As it stands, courts are making up these distinctions among different fact patterns,” Butler said. “And there’s a lot of uncertainty.”
Passcode v. Fingerprint
Courts also are grappling with the potential constitutional differences between requiring suspects to enter a passcode or apply a fingerprint to unlock devices.
The magistrate judge in the Oakland case said that if the government can’t compel a person to provide a passcode to open a device, it also can’t compel someone to provide a biometric feature to unlock that same device.
But another Northern District of California judge found that passcodes and biometric keys serve different functions. The court in United States v. Maffei excluded a defendant’s cell phone passcode from evidence because it exceeded the scope of the search warrant. The case didn’t address whether biometric features are testimonial.
Biometrics may be less likely to violate the Fifth Amendment because scanning a fingerprint appears less connected to the idea of disclosing information than entering a six-digit password, Laurent A. Sacharoff, a law professor at the University of Arkansas School of Law, said.
Federal courts have held that the government can require suspects to display their handwriting or try on clothing to see if it fits. Fingerprints and iris scans may fit with that line of reasoning because they’re displaying a physical characteristic rather than communicating a thought, Sacharoff, who teaches criminal law and cybercrime, said.
Governments can try bypassing the Fifth Amendment by going to a device manufacturer for passcodes or other unlocking information, attorneys say. If they successfully get material from a company or third party, it’s not self-incrimination, Sacharoff said.
Even so, government agents continue seeking warrants to force criminal suspects to open their devices—leading judges to mixed conclusions about whether the Constitution allows it.