Evan Schuman comments on a recent court opinion in Virginia v. Baust that a person can be compelled to open his phone with his fingerprint but that trying to compel the person to disclose his password implicates the 5th Amendment [media coverage of ruling, commentary by Orin Kerr].
In his commentary, Evan argues that a fingerprint scan is just a substitute PIN, which can’t be required by law enforcement. Here’s a snippet from his commentary:
But consider this scenario. I have a physical key that opens a physical deadbolt on the front door of my house. Because certain family members (who I will not name; they know who they are) have a tendency to forget or lose their house keys, I’ve debated changing the lock to accommodate a PIN keypad.
Now, according to this weird legal distinction, I could be forced to give my key to the police, but not my lock’s PIN. But hold on. Just as the iPhone’s finger scan is simply a digital version of a password/PIN, that deadbolt’s PIN is simply a digital alternative to my physical key. On what possible rationale should law enforcement treat the two differently?
Read his article on ComputerWorld.
Correction: This article previously misspelled Evan Schuman’s name.
“On what possible rationale should law enforcement treat the two differently?”
Per an online Stanford Uni surveillance Law course the rationale, by the courts, is as follows when making a determination on compelled production:
Does the production involve “contents of [the] mind” providing implicit testimony about existence, possession, control, or authenticity of Evidence?
Is the production like
A) opening a safe with a key, or
B) opening a safe with a combination (where you have to mentally remember/recall something)
“In order to be eligible for 5th Amendment protection, a security feature must involve a mental secret”.
Thus why biometric data (finger print to open an apple device) is not protected.
Interesting, hunh?
So now I carry a dead persons finger with me at all times to open my apple devices. Where I hid the finger is a mental secret now 😉 Go to town w/ that one 😛
Run that one by Jonathan to see if he thinks the court would find that dead person’s finger a “thing” under the law equivalent to a key. If you said you hid or misplaced your key or that its location was a secret, I think they could still compel you, so your argument might not hold up. But it’s a nice try. 🙂
The point of the column was to take it up a notch. Law enforcement doesn’t generally want your PIN or your biometric ID.They want the contents of the protected item (phone, laptop, desktop, tablet, etc.). It’s like in a house, they don’t want the combo to the safe. They just want the contents of the safe.
So …. the court has to decide if law enforcement has the right to access the data of that device while investigating this crime. Whether law enforcement should or should not have that access is an entirely different–and very worthy–discussion. But this column started with the premise of the judiciary deciding that law enforcement should indeed have access. At THAT point, there shouldn’t be a distinction between locking an iPhone with a PIN or with a biometric scan that is acting as a replacement for the PIN. At least that was SUPPOSED to be the column’s point.
I generally have problems with all these cases because I believe that if you compel the person to unlock their device or compel them to participate in unlocking a device, it should implicate 5-A. Of course, I am not a lawyer, and lawyers would likely pull their hair out (or mine, if they could reach it), explaining what’s wrong with my thinking.