Biometrics , Encryption & Key Management , Enterprise Mobility Management / BYOD

Federal Judge Rejects Fingerprint Collection

Ruling: Request Would Violate Fourth and Fifth Amendments
Federal Judge Rejects Fingerprint Collection
Photo: Ervins Strauhmanis (Flickr/CC)

A federal judge in Illinois has rejected part of a search warrant application that would allow police to force anyone present at the time of a raid to use their fingerprints to unlock digital devices. But the decision far from resolves law enforcement's efforts to overcome encryption.

See Also: Securing Your Business Begins with Password Security

The case, first reported by Motherboard based on a court filing posted by a fellow at Stanford University, illustrates how government prosecutors are hotly pursuing a much easier way to circumvent encryption, which can often be costly or simply impossible to defeat.

Last year, federal prosecutors were granted a search warrant that authorized law enforcement officers to depress the fingers of anyone in a house in Lancaster, Calif. (see Police Can Collect Fingerprints to Unlock Phone).

But in the Illinois case, prosecutors ran into constitutional roadblocks.

The search warrant application involved someone who was believed to be involved in trafficking child pornography. In his opinion, Judge M. David Weisman of the U.S. District Court for Northern Illinois writes that the government did establish probable cause for searching the residence. But he rejected a part of the warrant that would compel anyone at the residence to unlock their devices, which the government believes are either Apple iPhones or iPads. Weisman writes that the request is not compatible with the Fourth Amendment, which prohibits unreasonable search and seizure, and the Fifth Amendment, which establishes the right against self-incrimination.

Freeze! Give Me Your Finger

One problem is that the search warrant application lacks information about who lives at the residence, other than one person. Another problem is it doesn't explain what types of hardware may be at the residence or offer evidence linking the person named in the warrant to child pornography, Weisman writes. Both pose constitutional concerns.

As far as the Fourth Amendment, the warrant doesn't establish probable cause for anyone at the property to surrender his or her fingerprint, Weisman writes. The issue isn't the fingerprint, but rather the detention of someone to obtain it. If individuals aren't connected to the location that is searched, they can't be held, at least according to a prior case, Weisman writes.

The Fifth Amendment allows people to decline to provide evidence that is self-incriminating. The U.S. government argues here that producing a physical characteristic - i.e. a fingerprint - isn't "testimonial." Generally, that premise agrees with other cases, albeit ones that far precede the smartphone era and biometric security advances.

But at least one other case has concluded that that the "act of producing" could be testimonial, particularly when someone has to use their knowledge in order to do that. Weisman made that connection given that people have to set up their devices in order to lock them.

"By using a finger to unlock a phone's contents, a suspect is producing the contents on the phone," Weisman writes. "With a touch of a finger, a suspect is testifying that he or she has accessed the phone before, at a minimum, to set up the fingerprint password capabilities, and that he or she currently has some level of control over or relatively significant connection to the phone and its contents."

Not A Rule, However

Still, Weisman writes that his decision is not absolute for forced fingerprinting. It could be required, for example, when the government already knows about specific information or someone is able to testify about it. That would undermine the Fifth Amendment claim.

Also, the Fourth Amendment protection may fall away if the government shows a firmer connection between an individual and criminal conduct, Weisman writes. Government prosecutors could very well make that connection after a search warrant is executed and then apply for more search warrants. But in the meantime, "we are simply not there yet," he writes.

About the Author

Jeremy Kirk

Jeremy Kirk

Executive Editor, Security and Technology, ISMG

Kirk was executive editor for security and technology for Information Security Media Group. Reporting from Sydney, Australia, he created "The Ransomware Files" podcast, which tells the harrowing stories of IT pros who have fought back against ransomware.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.