Is the Battle Over for Smart-Phones? Search Warrants Should Not Overcome Biometric Protections

By Sonthonax SaintGermain*

In Riley v. California,[1] the Court held that a warrant is required for all searches of cellular phones regardless of whether the search is incident to a lawful arrest.[2]  The Court reasoned that the traditional considerations for the “search-incident-to-arrest doctrine” are not applicable to the capacity and nature of data stored in modern smart-phones.[3]  Riley is a resounding victory for “privacy specialists” and advocates of a digital approach to the Fourth Amendment doctrine.[4]  Yet determining whether Riley carries those aspirations to fruition requires the Court to keep up with the rapid changes in the smart-phone industry.  It is almost certain that a smart-phone model would become either obsolete within a year or unfashionable within a shorter time period.[5]  The technological advances that are made with every “jump” to the next generation are, to the untrained-eye, somewhat nonexistent.[6]  The legal possibilities, however, are ever changing, as the functions of a handheld device resemble less those of a landline than those of a personal computer.[7]  Hence, the next challenge for the Court may be the use of biometric technology (or Biometrics) in smart-phones and computing tablets.

Biometrics “take[s] something unique to the individual—a fingerprint, an iris, voice or facial features—as authentication” to identify that person.[8]  The latest iterations of the Apple iPhone use Biometrics—the Touch ID—to allow customers to access to their device by using their fingerprints.[9]  Each iPhone is equipped with “Touch ID . . . capable of 360-degree readability” allowing rapid access to the device without the added step of entering the previously required four-digit personal identification number (PIN).[10]  Hours after its initial announcement privacy concerns were voiced.[11]  This essay, however, addresses a separate question: whether a search warrant requires a person to bypass the biometric lock on his phone.

Protection could be through the Fifth Amendment’s Privilege against Self-Incrimination. The privilege is violated when a person is forced to communicate information that would lead to evidence incriminating him in the commission of a crime.[12]  There are three requirements in this prohibition.  First, there must be compulsion or involuntary disclosure.[13]  Second, the information obtained must be incriminating against the person providing it.[14]  However, the person need only have a belief the information is incriminating.[15]  And finally, the compulsion must apply to conduct that is communicative.[16]  Thus, the Court’s Self-Incrimination cases look at whether there was a testimonial communication.  Hence three factual patterns raise the Self-Incrimination clause: (1) physical exhibition;[17] (2) production of evidence;[18] and (3) information attesting to the defendant’s state of mind.  The Court drew distinctions between “real or physical evidence” and evidence of factual assertions.[19]  Because of its nature, any information gleaned from fingerprints through the Touch ID would be considered as “real or physical evidence” and be barred from Self-Incrimination protection under the first line of cases.

Stemming from Holt v. United States,[20] these cases hold that the exhibition of certain “physical characteristics” is not dispositive of the accused’s belief of his guilt.  In Holt, the Court reviewed the guilty verdict of a murder trial.[21]  Holt, the defendant, argued that the trial court could not compel him to wear a blouse allegedly belonging to the murderer.[22]  The Court found that this claim was “an extravagant extension of the [Fifth] Amendment.”[23]  The Court reasoned that trial courts are required to compel defendants to come forward in criminal cases to allow the “jury to look at [him] and compare his features with a photograph in proof.”[24]  The Court reasoned that, no “statements” were made and the order did not “extort [any] communications . . . from him . . . .”[25]  The Court understood the Fifth Amendment as not abrogating the state power to compel the physical exhibition of defendants in a criminal matter.[26]  Since Holt, the Court has held that compulsion to participate in police lineups,[27] to provide voice exemplars,[28] to submit to a blood test[29] or a roadside sobriety test,[30] or to give a handwriting sample are not protected by the Self-Incrimination clause.[31]

However, for fingerprints, protection depends on the Court’s characterization of biometric locks: Are they manual key locks or combination locks? In Doe v. United States[32] (Doe II) the Court upheld a “consent directive” compelling the petitioner to “authorize foreign banks to disclose” certain documents.[33]  The Court held that the directive was non-testimonial.[34]  Justice Stevens dissented.[35]  He posited whether a defendant “can . . . be compelled to use his mind to assist the prosecution in convicting him of a crime . . . .”[36]  The answer, to Justice Stevens, seemed clear: “no.”[37]  In reaching this conclusion, he stated that the defendant “may in some cases be forced to surrender a key to a strongbox containing incriminating documents, but . . . he [cannot] be compelled to reveal the combination to his wall safe by word or deed.”[38]  No member of the Court joined his dissent.  In a footnote responding to this hypothetical, Justice Blackmun, writing for the majority, stated:

We do not disagree with the dissent that the expression of the contents of an individual’s mind is testimonial communication for purposes of the Fifth Amendment.  We simply disagree with the dissent’s conclusion that the execution of the consent directive at issue here forced petitioner to express the contents of his mind.  In our view, such compulsion is more like being forced to surrender a key to a strongbox containing incriminating documents than it is like being compelled to reveal the combination to [petitioner’s] wall safe.[39]

The majority accepted the distinction,[40] but it pointed that the disagreement between Justice Stevens and his colleagues was whether the directive was a key or a combination.[41]

Stevens’ position did not win the day, and his distinction may have gone unnoticed if not for United States v. Hubbell.[42]  In Hubbell the Court held that producing documents pursuant to a subpoena, which does not describe with particularity the documents sought, violates the Self-Incrimination clause.[43]  Justice Stevens, now writing for an eight-member majority, stated, “[the] assembly of those documents was like telling an inquisitor the combination to a wall safe, not like being forced to surrender the key to a strongbox.”[44]  The distinction was reiterated and entered the Court’s jurisprudence if only as a dictum.  Nonetheless, it is relevant to our concerns.

Two things are clear from Doe II’s footnote 9.  First, a defendant cannot be compelled to reveal the content of his mind.  This proposition is inherent from the Self-Incrimination clause and the Court’s line of cases on physical characteristics.  A defendant cannot reveal his thoughts and knowledge without bearing testimony to his guilt—that is a given.

Second, producing the key to a strongbox, unlike providing the combination to a wall safe,[45] is not testimonial of the defendant’s content of his mind.  Put differently, the possession of a key—even if it is the only copy—does not testify that the possessor is aware of the content of the strongbox.  When stated as such, this proposition is obvious and has no practical application.[46]  But it may yet be incorrect.  For one, the production of tangible evidence is indicative, almost akin to testimony, of “existence, control, and location of” potentially incriminating evidence.[47]  Equally so, in providing the key upon request, the arrestee is clearly stating that he is aware of its purpose.  Yet even if this notion stands, this would suggest that if a person is privy to the combination of a safe he is automatically privy to its contents.  That is simply incongruent.  One can point to several persons sharing the combination of their safe with guarantors—if only to insure against memory failure.  But if the Court were suggesting that knowledge of the combination creates a temptation to investigate its content and thus leading to testimonial knowledge, what would prevent the detainer of the key from pursuing the same end?[48]  The truth is simple: the Court accepted the distinction without elaboration.[49]

If fingerprint locks are comparable to key locks, then the privilege does not insulate the owner of the iPhone from being compelled to provide access to it.  But if they are more like the combination locks, then the privilege applies.  At first glimpse, a thumbprint is more like a key.  It is tangible.  It is mechanical in its application.  And it requires no recollection of memory in order to operate it.[50]  This lack of memorization may have created this odd distinction.  But the differences are more compelling.  A fingerprint does more than provide access.  It could be use to authenticate identity.[51]  Hence the fingerprint—much like the PIN—must be chosen as the exact means of access to the device;[52] and thus, although to a minimum, testify that there was a conscious thought process applied in its selection.

The strongbox analogy does nothing to resolve this issue.  It is clear that the Court would not entertain compelled acquisition of a safe combination, PIN or Password.[53]  However the analogy creates more uncertainty than it would resolve.  Fingerprint locks are more like passwords and usernames when used in conjunction to gain access.  It identifies the user and authenticates his identity all in one motion.[54]

However, if biometric access suggests identity and control, the problem is perhaps moot, since all searches must be pursuant to a warrant, and hence subject to the particularity requirement.[55]  This is not necessarily true.  Evidence seized from smart-phones may not be accessible unless police officers can bypass the biometric locks.    Yet, regardless of a warrant, a defendant is under no obligation “to aid” police officers in accessing evidence on his device.[56]  In Andresen v. Maryland,[57] the Court addressed whether the Self-Incrimination clause precludes the prosecution from introducing evidence seized pursuant to a search warrant in its case-in-chief against the defendant.[58]  The evidence at issue was “business records [containing] statements made by the petitioner.”[59]  The Court held that “suppression” was not compelled because the defendant “was not asked to say or to do anything.”[60]  The Court said, “when these records were introduced at trial, they were authenticated by a handwriting expert, not by” the defendant.[61]

However in reaching this conclusion the Court was careful to separate the Fifth Amendment problem from the defendant’s obligations vis-à-vis the police investigation under a search warrant: “a seizure of [incriminating] materials by law enforcement officers differs [from production of the same materials in compliance with a subpoena], in a crucial respect . . . . [The] individual against whom the search is directed is not required to aid in the discovery, production, or authentication of incriminating evidence.”[62]  Andresen conflicts with the strongbox analogy found in Doe II and Hubbell.  But it is clear from Andresen that a defendant need not “aid” the police in its investigation.[63]  Providing the key to a strongbox, one clearly insurmountable by any other means, is providing aid in a criminal investigation.

If Andresen is still good law, it stands that a warrant cannot compel the defendant to “aid” in his indictment, arrest or prosecution.[64]  The Fifth Amendment guarantees this protection, and the Fourth Amendment does not deplete it.  The state cannot circumvent one constitutional prohibition by satisfying another.  Meeting all of the requirements for a valid warrant cannot—and should not—allow police officers to compel criminal suspects to assist in their own prosecution.[65]  Thus police officers seeking to access a smart-phone must bypass the biometric lock by means independent from compelling the defendant to do so.

 


*J.D. University of Illinois (’14); M.Sc. Applied Economics, Florida State University (’09). Special thanks go to Benjamin Sunshine for bringing this topic to my attention. I also give thanks my Professors: Margareth Etienne, Andrew Leipold, and Shannon Moritz, as well as Dean Jamelle Sharpe for their advice. Thanks are also due to my friends: Michael Corliss, and Derek Dion, in conjunction with the Editing Board at the Illinois Journal of Law, Tech. & Policy for their support and indulgence. Finally I thank my family and loved ones, in particular my parents.

[1] Riley v. California, 134 S. Ct. 2473 (2014).

[2] Id. at 2485 (“[O]fficers must generally secure a warrant before conducting such a search.”).

[3] Id. (declining to extend United States v. Robinson, 414 U.S. 218 (1973)).

[4] Richard Re, Symposium: Inaugurating the Digital Fourth Amendment, SCOTUSblog (June 26, 2014, 12:37 PM), http://www.scotusblog.com/2014/06/symposium-inaugurating-the-digital-fourth-amendment/.

[5]  See Suzanne Choney, Planned Obsolescence: Cell Phone Models, NBC News (Feb. 24, 2009, 8:57 AM), (http://www.nbcnews.com/id/29258026/ns/technology_and_science-digital_home/t/planned-obsolescence-cell-phone-models/ (“[M]ost phones have a market life cycle of nine to 12 months.”).

[6]  See id.  (stating a new model may “still look[] like the original . . . but . . . has a few new features”).

 

[7] Riley v. California, 134 S. Ct. 2473, 2489 (2014) (“The term ‘cell phone’ is itself misleading shorthand; many of these devices are in fact minicomputers that also happen to have the capacity to be used as a telephone.”) (emphasis added).

[8] Mark G. Milone, Biometric Surveillance: Searching For Identity, 57 Bus. Law 497, 497 (2001) (“Biometrics use immutable personal characteristics, such as facial features, fingerprints, and retinal patterns, to establish and authenticate identity.”).

[9] Touch ID. Security. Right at Your Fingertip., Apple, https://www.apple.com/iphone-6/touch-id/ (last visited Oct. 4, 2014).

[10] Id.; see also David Pogue, In Arrival of 2 iPhones, 3 Lessons, N.Y. Times (Sept. 17, 2013), http://www.nytimes.com/2013/09/18/technology/personaltech/in-arrival-of-2-iphones-3-lessons.html (“[Y]es, a password is a hassle; half of [smart-phone] users never bother setting one up.”).

[11] Apple Fingerprint Tech Raises “Privacy Questions,” BBC News (Sept. 20, 2013, 1:28 PM), http://www.bbc.co.uk/news/technology-24177851 (“Senator Al Franken, chairman of the influential Senate Judiciary Subcommittee on Privacy, Technology and the Law, has written to Apple boss Tim Cook explaining his security concerns.”).

[12] See U.S. Const. amend. V (“No person shall . . . be compelled in any criminal case to be a witness against himself.”); see also Holt v. United States, 218 U.S. 245, 252–53 (1910) (expressing the self-incrimination as a “prohibition of the use of [extorted] communications”).

[13] Holt, 218 U.S. at 252–53 (stating the clause “is a prohibition [against] the use of physical or moral compulsion”).

[14] That is simply found in the language of the Amendment. Cf. U.S. Const. amend. V (“No person shall . . . be compelled in any criminal case to be a witness against himself.”).

[15] Cf. Pennsylvania v. Muniz, 496 U.S. 582, 615 (1990) (Rehnquist, C.J., concurring) (“By ‘incriminating response’ we refer to any response—whether inculpatory or exculpatory—that the prosecution may seek to introduce at trial.”) (internal citation omitted).

[16] Holt, 218 U.S. at 252–53 (stating the clause “is a prohibition [against extorting] communication”).

[17] Id. at 245; Schmerber v. California, 384 U.S. 757 (1967); United States v. Wade, 388 U.S. 218 (1967); Gilbert v. California, 388 U.S. 263 (1967); United States v. Dionisio, 410 U.S. 1 (1973); Pennsylvania v. Muniz, 496 U.S. 582 (1990).

[18] Fisher v. United States, 425 U.S. 391 (1976); United States v. Doe (Doe I), 465 U.S. 605 (1984); Doe v. United States (Doe II), 487 U.S. 201 (1988).

[19] Muniz, 496 U.S. at 591.

[20] Holt, 218 U.S. at 245.

[21] Id. at 246.

[22] Id. at 252.

[23] Id. at 252.

[24] Id. at 253.

[25] Id. at 253.

[26] Schmerber v. California, 384 U.S. 757, 761 (1966).

[27] United States v. Wade, 388 U.S. 218, 222 (1967).

[28] Id. at 222–23; United States v. Dionisio, 410 U.S. 1, 17–18 (1973).

[29] Schmerber, 384 U.S. at 761.

[30] Pennsylvania v. Muniz, 496 U.S. 582, 590 (1990).  The Court however framed its ruling to only include test that would not require the accused from giving an answers the veracity of which can become testimonial.  Id. at 600.

[31] Gilbert v. California, 388 U.S. 263, 266–67 (1967).

[32] Doe v. United States, 487 U.S. 201 (1988).

[33] Id. at 219.

[34] Id.

[35] Id. at 219–21 (Stevens, J., Dissenting).

[36] Id.

[37] Id.

[38] Id. (emphasis added).

[39] Id. at 210 n.9 (internal citation and quotation marks omitted) (emphasis added).

[40] Id.

[41] Id.

[42] United States v. Hubbell, 530 U.S. 27 (2000).

[43] Id. at 43.

[44] Id. at 43 (citing Doe II, 487 U.S. at 210 n.9).

[45] This part is almost self-evident.  Safe combinations, much like passwords, require mental recollection.

[46] Practically speaking, combination locks are nothing more than the evolutionary successors of key locks.

[47] Adam M. Gershowitz, Password Protected? Can a Password Save Your Cell Phone from a Search Incident to Arrest?, 96 Iowa L. Rev. 1125, 1171 (2011) (citing Fisher v. United States, 425 U.S. 391, 410 (1976); Commonwealth v. Hughes, 404 N.E.2d 1239, 1244–45 (Mass. 1980)).

[48] One answer is that a person may be in possession of a key without knowing its purpose.  That cannot be the answer because a person can also know a sequence of numbers without knowing its meaning.  For example: what is the meaning of 01.02.54?

[49] The Strongbox analogy gets more complicated when we expand its reach.  Take the following two scenarios that paradoxically lead to opposing results.  First if a person has four keys on a keychain, one of which opens a door, he can be compelled to identify which one opens the door.  Yet consider a door that has four locks, and the same key opens all four.  If, to open the door, the person must always unlock the locks in a given sequence—almost like a safe combination—then it stems from Dow II that he cannot be compelled to tell the authorities which sequence, even though he is required to provide the key.

[50] See Gershowitz, supra note 48 at 1171 (suggesting PINs are testimonial because they “reveal the contents of [a person’s] mind by recalling” the sequence).

[51] Kristian Köhntopp, Comment to Fingerprints are Usernames, not Passwords, Dustin Kirland (Oct. 7, 2013), http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html (“We could each conveniently identify ourselves by our fingerprint.”).

[52] See Apple, supra note 10 (explaining the process for calibrating the fingerprint authentication system).

[53] See, e.g., In re Boucher, No. 2:06-mj-91, 2007 WL 4246473, at *2 (D. Vt. Nov. 29, 2007), rev’d No. 2:06-mj-91, 2009 WL 424718 (D. Vt. Feb. 19, 2009) (denying prosecutors request that the subject of Grand Jury subpoena provides access to his computer by entering the password, even if done privately in a secluded room).

[54] But see Köhntopp, supra note 52 (suggesting “biometrics cannot, and absolutely must not, be used to authenticate an identity”).

[55] Cf. Riley v. California, 134 S. Ct. 2473, 2485 (2014) (“[O]fficers must generally secure a warrant before conducting such a search.”).  The particularity requirement would overcome the generality of the subpoena found in Hubbell.

[56] Andresen v. Maryland, 427 U.S. 463, 473–74 (1976).

[57] Id..

[58] Id. at 465.

[59] Id. at 471.

[60] Id. at 473.

[61] Id. at 474.  This answer reinforced a consistent theme requiring an intermediary separating an inference of guilt from the conduct.  See, e.g., Holt v. United States, 218 U.S. 245 (1910) (requiring jury to authenticate physical match); Schmerber v. California, 384 U.S. 757 (1967) (requiring blood testing); United States v. Wade, 388 U.S. 218 (1967) (requiring voice matching); Gilbert v. California, 388 U.S. 263 (1967) (requiring hand exemplar matching).

[62] Id. at 473–74 (emphasis added).

[63] Id.

[64] Id.

[65] Cf. id. This is true both from Andresen, and the language and spirit of the Bill of Rights.