US Court: Police can’t force people to unlock their phone with biometrics

More U.S. judges are siding with citizens’ privacy rights when it comes to mobile device searches.

A judge for the U.S District Court for the Northern District of California recently ruled that U.S. law enforcement cannot force people to use their face, finger, or other biometric method to unlock their device. This remains true even in instances when a warrant gives law enforcement the right to search the device. The order, first reported by Forbes, is seen as a win for citizens.

Before this order, law enforcement could wrangle people into pressing their thumb on a fingerprint reader or looking at their phone to unlock it. For example, in October 2018 the FBI forced a suspected child abuser to use his face to unlock his phone. At the same time, however, the law does not allow police to force suspects to provide a PIN, password, or passcode. This new ruling puts all unlocking methods in the same playing field, protecting people’s privacy.

At issue are rights guaranteed in the Fourth and Fifth Amendments concerning searches, privacy, and self incrimination.

“If a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device,” said the judge.

The relevant case involves an extortion crime tied to Facebook wherein the suspects allegedly demanded payment lest they release “embarrassing” photos of the victim to social media contacts. Law enforcement was granted a warrant to search the suspects’ phones. The police attempted to have the suspects unlock their devices with fingerprint and face identification, but the suspects refused.

While this ruling doesn’t instantly mean every such case in the country should be overturned, it may be used to set precedent in future cases. Moving forward, law enforcement will need to be more careful about privacy and how suspect devices are unlocked.

Of course, police use of GrayKey’s makes this ruling somewhat irrelevant. The GrayKey is a device available to law enforcement that can beat the passcode on iPhones. Officers need only connect the iPhone to the device via Lightning cable and the box does the rest.

Apple responded by adding a function to iOS 12 that defeats this tool by locking out the Lightning port for any purpose other than charging with the phone is secured. It’s not clear if or how the GrayKey handles Android devices.