Stop Using Your Face or Thumb to Unlock Your Phone

🌈 Abstract

The article discusses a recent court ruling in the United States that concluded state highway police were acting lawfully when they forcibly unlocked a suspect's phone using their fingerprint. It highlights the ongoing debate around the use of biometrics, such as fingerprints and facial recognition, to access digital devices and the implications for privacy and civil liberties, especially for groups more likely to interact with law enforcement.

🙋 Q&A

[01] The 9th Circuit Court of Appeals Ruling

1. What was the key ruling by the 9th Circuit Court of Appeals?

• The 9th Circuit Court of Appeals ruled that state highway police acted lawfully when they used a suspect's (Jeremy Travis Payne) thumbprint to unlock his phone after a drug bust.
• The court said this did not violate the suspect's 5th Amendment rights against self-incrimination or the 4th Amendment's protections against unlawful search and seizure.

2. What was the court's reasoning for this ruling?

• The court panel said that using the suspect's thumbprint to unlock the phone was not considered "testimonial" and was similar to a blood draw or fingerprint taken during booking, which merely provides police access to potential information.
• The court acknowledged that the Supreme Court and other circuit courts have not yet addressed whether the compelled use of biometrics to unlock a device is considered testimonial.

3. How did the suspect's parole agreement factor into the ruling?

• The suspect was on parole at the time, and a stipulation of his parole agreement was that he be willing to provide a passcode to his devices, though the agreement did not explicitly refer to biometric data.
• The court panel said the evidence from the suspect's phone was lawfully acquired because it "required no cognitive exertion" on his part.

[02] Experts' Views on Biometrics and Police

1. What is the general consensus among experts regarding biometrics and the 5th Amendment?

• The general consensus is that there is more 5th Amendment protection for passwords than for biometrics, as passwords require revealing the contents of one's mind, while biometrics do not.

2. How does the EFF recommend protecting your phone from police searches?

• The EFF recommends turning off biometrics (fingerprint or facial recognition) on your phone before interacting with police, as this provides stronger protection than biometrics.
• Even then, there are still many nuances and uncertainties around the legal implications of biometrics and nested biometrics (e.g., unlocking apps with biometrics).

3. What is the EFF's advice for encrypting your phone and app data?

• The EFF advises encrypting your phone and app data, as police often have broad access to the contents of a phone found "in plain view", even with a warranted search.
• Encrypted data provides better protection than unencrypted data, even if police gain access to the device.